admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

#315 Détail article

Browse source 
fix small bug
Protect search against sql attack
This commit is contained in:
Dany De Bontridder 2011-12-21 11:12:32 +00:00
parent a84e8d4ff1
commit fd482cf60d
4 changed files with 28 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
include/class_acc_ledger.php
View file

@ -2564,14 +2564,15 @@ class Acc_Ledger extends jrn_def_sql
{
$desc=sql_string($desc);
$fil_desc=$and." ( upper(jr_comment) like upper('%".$desc."%') or upper(jr_pj_number) like upper('%".$desc."%') ".
" or upper(jr_internal) like upper('%".$desc."%') )";
" or upper(jr_internal) like upper('%".$desc."%')
or jr_grpt_id in (select j_grpt from jrnx where j_text ~* '".$desc."'))";
$and=" and ";
}
// Poste
if ( isset ($accounting) && $accounting != null )
{
$fil_account=$and." jr_grpt_id in (select j_grpt
from jrnx where j_poste::text like '$accounting%' ) ";
from jrnx where j_poste::text like '".sql_string($accounting)."%' ) ";
$and=" and ";
}
// Quick Code
@ -2579,7 +2580,7 @@ class Acc_Ledger extends jrn_def_sql
if ( isset ($qcode) && $qcode != null )
{
$fil_qcode=$and." jr_grpt_id in ( select j_grpt from
jrnx where trim(j_qcode) = upper(trim('$qcode')))";
jrnx where trim(j_qcode) = upper(trim('".sql_string($qcode)."')))";
$and=" and ";
}