admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'accept7100' into entreprise

Browse source 
* accept7100:
  Security ; remove direct access to global http variable
  cosmetic gestion -> tiers -> balance , remove the style inline cosmetic gestion -> tiers -> lettering
This commit is contained in:
Dany De Bontridder 2019-09-16 17:46:56 +02:00
commit d898a7a766
4 changed files with 42 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

19
include/balance_card.inc.php
View file

@ -24,12 +24,13 @@
*/
if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
require_once NOALYSS_INCLUDE.'/class/exercice.class.php';
$http=new HttpInput();
global $g_user;
echo '<div class="content" style="width:90%;margin-left:5%">';
echo '<div class="content">';
$exercice=new Exercice($cn);
$old='';
$fiche=new Fiche($cn,$_GET['f_id']);
$fiche=new Fiche($cn,$http->get('f_id',"number"));
$year=$g_user->get_exercice();
if ( $year == 0 )
{
@ -43,7 +44,7 @@ else
$array['to_periode']=$limit_periode[1]->last_day();
if (isset($_GET['ex']))
{
$limit_periode=$per->get_limit($_GET['ex']);
$limit_periode=$per->get_limit($http->get('ex','number'));
$array['from_periode']=$limit_periode[0]->first_day();
}
@ -52,16 +53,16 @@ else
*/
if ($exercice->count() > 1 )
{
$default=(isset($_GET['ex']))?$_GET['ex']:$year;
$default=$http->get("ex","number",$year);
$dossier=dossier::id();
$old='<form method="get" action="do.php">';
$is=$exercice->select('ex',$default,'onchange = "submit(this)"');
$old.="Autre exercice ".$is->input();
$old.=HtmlInput::hidden('f_id',$_GET['f_id']);
$old.=HtmlInput::hidden('ac',$_GET['ac']);
$old.=HtmlInput::hidden('sb',$_GET['sb']);
$old.=HtmlInput::hidden('sc',$_GET['sc']);
$old.=sprintf(_("Autre exercice %s"),$is->input());
$old.=HtmlInput::hidden('f_id',$http->get('f_id'));
$old.=HtmlInput::hidden('ac',$http->get('ac'));
$old.=HtmlInput::hidden('sb',$http->get('sb'));
$old.=HtmlInput::hidden('sc',$http->get('sc'));
$old.=dossier::hidden();
$old.='</form>';
}

2
include/category_card.inc.php
View file

@ -140,7 +140,7 @@ if ($ss_action=='cn')
echo '<div class="content">';
echo dossier::hidden();
$f=new Fiche($cn, $_REQUEST['f_id']);
$f=new Fiche($cn, $http->request('f_id','number'));
$contact=new Contact($cn);
$contact->company=$f->get_quick_code();
echo $contact->summary("");

16
include/lettering.gestion.inc.php
View file

@ -6,14 +6,14 @@ if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
require_once NOALYSS_INCLUDE.'/class/lettering.class.php';
global $g_user;
echo '<div class="content">';
$http=new HttpInput();
echo '<div id="search">';
echo '<FORM METHOD="GET">';
echo dossier::hidden();
echo HtmlInput::hidden('ac',$_REQUEST['ac']);
echo HtmlInput::hidden('sb',$_REQUEST['sb']);
echo HtmlInput::hidden('sc',$_REQUEST['sc']);
echo HtmlInput::hidden('f_id',$_REQUEST['f_id']);
echo HtmlInput::hidden('ac',$http->request('ac'));
echo HtmlInput::hidden('sb',$http->request('sb'));
echo HtmlInput::hidden('sc',$http->request('sc'));
echo HtmlInput::hidden('f_id',$http->request('f_id'));
echo '<table width="50%">';
@ -23,7 +23,7 @@ $periode=new Periode($cn);
list($first_per,$last_per)=$periode->get_limit($exercice);
$start=new IDate('start');
$start->value=(isset($_GET['start']))?$_GET['start']:$first_per->first_day();
$start->value=(isset($_GET['start']))?$http->get('start'):$first_per->first_day();
$r=td(_('Date début'));
$r.=td($start->input());
echo tr($r);
@ -41,7 +41,7 @@ $sel->value=array(
array('value'=>1,'label'=>_('Opérations lettrées')),
array('value'=>2,'label'=>_('Opérations NON lettrées'))
);
if (isset($_GET['type_let'])) $sel->selected=$_GET['type_let'];
if (isset($_GET['type_let'])) $sel->selected=$http->get('type_let');
else $sel->selected=1;
$r= td("Filtre ").
@ -68,7 +68,7 @@ if ( isset($_POST['record']))
//--------------------------------------------------------------------------------
if ( isset($_GET['start']) && isset($_GET['end']))
{
if ( isDate($_GET['start']) == null || isDate($_GET['end']) == null )
if ( isDate($http->get('start') ) == null || isDate($http->get ('end') ) == null )
{
echo alert(_('Date malformée, désolé'));
return;

36
include/template/letter_all.php
View file

@ -77,11 +77,11 @@ $r=sprintf('<A class="detail" style="text-decoration:underline" href="javascrip
<td> <?php echo $r?> </td>
<td> <?php echo h($this->content[$i]['jr_comment'])?> </td>
<?php if ($this->content[$i]['j_debit']=='t') : ?>
<td style="text-align:right"> <?php echo nb($this->content[$i]['j_montant'])?> </td>
<td style="text-align:right"> <?php echo nbm($this->content[$i]['j_montant'])?> </td>
<td></td>
<?php else : ?>
<td></td>
<td style="text-align:right"> <?php echo nb($this->content[$i]['j_montant'])?> </td>
<td style="text-align:right"> <?php echo nbm($this->content[$i]['j_montant'])?> </td>
<?php endif ?>
<td style="text-align:center">
<?php
@ -110,15 +110,25 @@ $amount_cred+=($this->content[$i]['j_debit']=='f')?$this->content[$i]['j_montant
<?php
endfor;
?>
<tr class="highlight">
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td class="num"> <?php echo nbm($amount_deb,2);?> </td>
<td class="num"> <?php echo nbm($amount_cred,2);?> </td>
<td class="num">
<?php
bcscale(2);
$solde=bcsub($amount_deb,$amount_cred);
if ( $solde > 0 )
printf (_("Solde débiteur : %s"),nbm($solde));
elseif ($solde < 0)
printf (_("Solde créditeur : %s"),nbm(abs($solde)));
?>
</td>
</table>
<h2 class="info2" style="margin:0 0"> <?php echo _("Solde débit")?> : <?php echo nb($amount_deb);?></h2>
<h2 class="info2" style="margin:0 0"> <?php echo _("Solde crédit")?> : <?php echo nb($amount_cred);?></h2>
<?php
bcscale(2);
$solde=bcsub($amount_deb,$amount_cred);
if ( $solde > 0 ) :
?>
<h2 class="info2" style="margin:0 0"> <?php echo _("Solde débiteur")?> : <?php echo nb($solde)?></h2>
<?php else : ?>
<h2 class="info2" style="margin:0 0"> <?php echo _("Solde créditeur")?> : <?php echo nb(abs($solde))?></h2>
<?php endif; ?>