From c0a6e7e07ffc66f70e4999555777129d831e8f62 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Mon, 16 Sep 2019 17:45:52 +0200 Subject: [PATCH 1/2] cosmetic gestion -> tiers -> balance , remove the style inline cosmetic gestion -> tiers -> lettering --- include/balance_card.inc.php | 19 ++++++++--------- include/template/letter_all.php | 36 +++++++++++++++++++++------------ 2 files changed, 33 insertions(+), 22 deletions(-) diff --git a/include/balance_card.inc.php b/include/balance_card.inc.php index 1ae88340e..14646522a 100644 --- a/include/balance_card.inc.php +++ b/include/balance_card.inc.php @@ -24,12 +24,13 @@ */ if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis'); require_once NOALYSS_INCLUDE.'/class/exercice.class.php'; +$http=new HttpInput(); global $g_user; -echo '
'; +echo '
'; $exercice=new Exercice($cn); $old=''; -$fiche=new Fiche($cn,$_GET['f_id']); +$fiche=new Fiche($cn,$http->get('f_id',"number")); $year=$g_user->get_exercice(); if ( $year == 0 ) { @@ -43,7 +44,7 @@ else $array['to_periode']=$limit_periode[1]->last_day(); if (isset($_GET['ex'])) { - $limit_periode=$per->get_limit($_GET['ex']); + $limit_periode=$per->get_limit($http->get('ex','number')); $array['from_periode']=$limit_periode[0]->first_day(); } @@ -52,16 +53,16 @@ else */ if ($exercice->count() > 1 ) { - $default=(isset($_GET['ex']))?$_GET['ex']:$year; + $default=$http->get("ex","number",$year); $dossier=dossier::id(); $old='
'; $is=$exercice->select('ex',$default,'onchange = "submit(this)"'); - $old.="Autre exercice ".$is->input(); - $old.=HtmlInput::hidden('f_id',$_GET['f_id']); - $old.=HtmlInput::hidden('ac',$_GET['ac']); - $old.=HtmlInput::hidden('sb',$_GET['sb']); - $old.=HtmlInput::hidden('sc',$_GET['sc']); + $old.=sprintf(_("Autre exercice %s"),$is->input()); + $old.=HtmlInput::hidden('f_id',$http->get('f_id')); + $old.=HtmlInput::hidden('ac',$http->get('ac')); + $old.=HtmlInput::hidden('sb',$http->get('sb')); + $old.=HtmlInput::hidden('sc',$http->get('sc')); $old.=dossier::hidden(); $old.='
'; } diff --git a/include/template/letter_all.php b/include/template/letter_all.php index 811f3d43b..32f4e867e 100644 --- a/include/template/letter_all.php +++ b/include/template/letter_all.php @@ -77,11 +77,11 @@ $r=sprintf(' content[$i]['j_montant'])?> + content[$i]['j_montant'])?> - content[$i]['j_montant'])?> + content[$i]['j_montant'])?> content[$i]['j_debit']=='f')?$this->content[$i]['j_montant + + + + + + + + + + 0 ) + printf (_("Solde débiteur : %s"),nbm($solde)); + elseif ($solde < 0) + printf (_("Solde créditeur : %s"),nbm(abs($solde))); + + + ?> + + -

:

-

:

- 0 ) : -?> -

:

- -

:

- From b674242c82b58d52f79930030b6861f894dd0405 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Mon, 16 Sep 2019 17:46:25 +0200 Subject: [PATCH 2/2] Security ; remove direct access to global http variable --- include/category_card.inc.php | 2 +- include/lettering.gestion.inc.php | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/include/category_card.inc.php b/include/category_card.inc.php index ce26bc148..42f0e2f85 100644 --- a/include/category_card.inc.php +++ b/include/category_card.inc.php @@ -140,7 +140,7 @@ if ($ss_action=='cn') echo '
'; echo dossier::hidden(); - $f=new Fiche($cn, $_REQUEST['f_id']); + $f=new Fiche($cn, $http->request('f_id','number')); $contact=new Contact($cn); $contact->company=$f->get_quick_code(); echo $contact->summary(""); diff --git a/include/lettering.gestion.inc.php b/include/lettering.gestion.inc.php index ad44c2afc..f4a1c559c 100644 --- a/include/lettering.gestion.inc.php +++ b/include/lettering.gestion.inc.php @@ -6,14 +6,14 @@ if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis'); require_once NOALYSS_INCLUDE.'/class/lettering.class.php'; global $g_user; echo '
'; - +$http=new HttpInput(); echo '