admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

#315 Détail article

Browse source 
fix small bug
Protect search against sql attack
This commit is contained in:
Dany De Bontridder 2011-12-21 11:12:32 +00:00
parent a84e8d4ff1
commit fd482cf60d
4 changed files with 28 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
html/ajax_ledger.php
View file

@ -367,7 +367,8 @@ case 'save':
$cn->exec_sql("select comptaproc.jrn_add_note($1,$2)",
array($jr_id,$_POST['jrn_note']));
$rapt=$_POST['rapt'];
if ( $g_parameter->MY_UPDLAB=='Y')
if ( $g_parameter->MY_UPDLAB=='Y' && isset ($_POST['j_id']))
{
$a_rowid=$_POST["j_id"];
for ($e=0;$e<count($a_rowid);$e++)

7
include/class_acc_ledger.php
View file

@ -2564,14 +2564,15 @@ class Acc_Ledger extends jrn_def_sql
{
$desc=sql_string($desc);
$fil_desc=$and." ( upper(jr_comment) like upper('%".$desc."%') or upper(jr_pj_number) like upper('%".$desc."%') ".
" or upper(jr_internal) like upper('%".$desc."%') )";
" or upper(jr_internal) like upper('%".$desc."%')
or jr_grpt_id in (select j_grpt from jrnx where j_text ~* '".$desc."'))";
$and=" and ";
}
// Poste
if ( isset ($accounting) && $accounting != null )
{
$fil_account=$and." jr_grpt_id in (select j_grpt
from jrnx where j_poste::text like '$accounting%' ) ";
from jrnx where j_poste::text like '".sql_string($accounting)."%' ) ";
$and=" and ";
}
// Quick Code
@ -2579,7 +2580,7 @@ class Acc_Ledger extends jrn_def_sql
if ( isset ($qcode) && $qcode != null )
{
$fil_qcode=$and." jr_grpt_id in ( select j_grpt from
jrnx where trim(j_qcode) = upper(trim('$qcode')))";
jrnx where trim(j_qcode) = upper(trim('".sql_string($qcode)."')))";
$and=" and ";
}

3
include/template/ledger_detail_bottom.php
View file

@ -1,7 +1,8 @@
<fieldset>
<legend>
<? echo _('Rapprochement');?>
</legend>
<?
echo _('Rapprochement');
$oRap=new Acc_Reconciliation($cn);
$oRap->jr_id=$jr_id;
$aRap=$oRap->get();

26
include/template/ledger_detail_misc.php
View file

@ -115,20 +115,34 @@ echo '</tr>';
else
$view_history='';
$row.=td($view_history);
if ( $q[$e]['j_text']!='')
$l_lib = $q[$e]['j_text'] ;
if ( $l_lib!='')
{
$row.=td(h(strip_tags($q[$e]['j_text'])));
}else
if ( $q[$e]['j_qcode'] !='') {
$l_lib=$q[$e]['j_text'];
}
else if ( $q[$e]['j_qcode'] !='') {
// nom de la fiche
$ff=new Fiche($cn);
$ff->get_by_qcode( $q[$e]['j_qcode']);
$row.=td(h($ff->strAttribut(ATTR_DEF_NAME)));
$l_lib=$ff->strAttribut(ATTR_DEF_NAME);
} else {
// libellé du compte
$name=$cn->get_value('select pcm_lib from tmp_pcmn where pcm_val=$1',array($q[$e]['j_poste']));
$row.=td(h($name));
$l_lib=$name;
}
$l_lib=strip_tags($l_lib);
if ($owner->MY_UPDLAB == 'Y')
{
$hidden = HtmlInput::hidden("j_id[]", $q[$e]['j_id']);
$input = new IText("e_march" . $q[$e]['j_id'] . "_label", $l_lib);
}
else
{
$input = new ISpan("e_march" . $q[$e]['j_id'] . "_label");
$hidden = HtmlInput::hidden("j_id[]", $q[$e]['j_id']);
}
$row.=td($input->input().$hidden);
$montant=td(nbm($q[$e]['j_montant']),'class="num"');
$row.=($q[$e]['j_debit']=='t')?$montant:td('');
$row.=($q[$e]['j_debit']=='f')?$montant:td('');