From fd482cf60d56ddae322eee9421650642e1cb8a2b Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Wed, 21 Dec 2011 11:12:32 +0000
Subject: [PATCH] =?UTF-8?q?#315=20D=C3=A9tail=20article=20fix=20small=20bu?=
 =?UTF-8?q?g=20Protect=20search=20against=20sql=20attack?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 html/ajax_ledger.php                      |  3 ++-
 include/class_acc_ledger.php              |  7 +++---
 include/template/ledger_detail_bottom.php |  3 ++-
 include/template/ledger_detail_misc.php   | 26 +++++++++++++++++------
 4 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/html/ajax_ledger.php b/html/ajax_ledger.php
index 87235d9d1..08e8d7777 100644
--- a/html/ajax_ledger.php
+++ b/html/ajax_ledger.php
@@ -367,7 +367,8 @@ case 'save':
 	    $cn->exec_sql("select comptaproc.jrn_add_note($1,$2)",
 			  array($jr_id,$_POST['jrn_note']));
             $rapt=$_POST['rapt'];
-            if ( $g_parameter->MY_UPDLAB=='Y')
+            
+            if ( $g_parameter->MY_UPDLAB=='Y' && isset ($_POST['j_id']))
             {
                 $a_rowid=$_POST["j_id"];
                 for ($e=0;$e<count($a_rowid);$e++)
diff --git a/include/class_acc_ledger.php b/include/class_acc_ledger.php
index bb370b4ef..358f5d33c 100644
--- a/include/class_acc_ledger.php
+++ b/include/class_acc_ledger.php
@@ -2564,14 +2564,15 @@ class Acc_Ledger extends jrn_def_sql
         {
 			$desc=sql_string($desc);
             $fil_desc=$and." ( upper(jr_comment) like upper('%".$desc."%') or upper(jr_pj_number) like upper('%".$desc."%') ".
-                      " or upper(jr_internal)  like upper('%".$desc."%') )";
+                      " or upper(jr_internal)  like upper('%".$desc."%') 
+                          or jr_grpt_id in (select j_grpt from jrnx where j_text ~* '".$desc."'))";
             $and=" and ";
         }
         //    Poste
         if ( isset ($accounting) && $accounting != null )
         {
             $fil_account=$and."  jr_grpt_id in (select j_grpt
-                         from jrnx where j_poste::text like '$accounting%' )  ";
+                         from jrnx where j_poste::text like '".sql_string($accounting)."%' )  ";
             $and=" and ";
         }
         // Quick Code
@@ -2579,7 +2580,7 @@ class Acc_Ledger extends jrn_def_sql
         if ( isset ($qcode)  && $qcode != null )
         {
             $fil_qcode=$and."  jr_grpt_id in ( select j_grpt from
-                       jrnx where trim(j_qcode) = upper(trim('$qcode')))";
+                       jrnx where trim(j_qcode) = upper(trim('".sql_string($qcode)."')))";
             $and=" and ";
         }
 
diff --git a/include/template/ledger_detail_bottom.php b/include/template/ledger_detail_bottom.php
index c56b699e2..afaeb6af8 100644
--- a/include/template/ledger_detail_bottom.php
+++ b/include/template/ledger_detail_bottom.php
@@ -1,7 +1,8 @@
 <fieldset>
 <legend>
+<? echo _('Rapprochement');?>
+</legend>
 <?
-echo _('Rapprochement');
 $oRap=new Acc_Reconciliation($cn);
 $oRap->jr_id=$jr_id;
 $aRap=$oRap->get();
diff --git a/include/template/ledger_detail_misc.php b/include/template/ledger_detail_misc.php
index 2176b396c..74df73c32 100644
--- a/include/template/ledger_detail_misc.php
+++ b/include/template/ledger_detail_misc.php
@@ -115,20 +115,34 @@ echo '</tr>';
     else
       $view_history='';
     $row.=td($view_history);
-	if ( $q[$e]['j_text']!='')
+$l_lib = $q[$e]['j_text'] ;
+   
+    if ( $l_lib!='')
 	{
-	 $row.=td(h(strip_tags($q[$e]['j_text'])));
-	}else
-    if ( $q[$e]['j_qcode'] !='') {
+	 $l_lib=$q[$e]['j_text'];
+	}
+      else  if ( $q[$e]['j_qcode'] !='') {
       // nom de la fiche
       $ff=new Fiche($cn);
       $ff->get_by_qcode( $q[$e]['j_qcode']);
-      $row.=td(h($ff->strAttribut(ATTR_DEF_NAME)));
+      $l_lib=$ff->strAttribut(ATTR_DEF_NAME);
     } else {
       // libellé du compte
       $name=$cn->get_value('select pcm_lib from tmp_pcmn where pcm_val=$1',array($q[$e]['j_poste']));
-      $row.=td(h($name));
+      $l_lib=$name;
     }
+    $l_lib=strip_tags($l_lib);
+    if ($owner->MY_UPDLAB == 'Y')
+    {
+        $hidden = HtmlInput::hidden("j_id[]", $q[$e]['j_id']);
+        $input = new IText("e_march" . $q[$e]['j_id'] . "_label", $l_lib);
+    }
+    else
+    {
+        $input = new ISpan("e_march" . $q[$e]['j_id'] . "_label");
+        $hidden = HtmlInput::hidden("j_id[]", $q[$e]['j_id']);
+    }
+     $row.=td($input->input().$hidden);
     $montant=td(nbm($q[$e]['j_montant']),'class="num"');
     $row.=($q[$e]['j_debit']=='t')?$montant:td('');
     $row.=($q[$e]['j_debit']=='f')?$montant:td('');