From fde1c4104c5d92060a79f70f153f8296dee380b2 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Tue, 15 Oct 2024 22:21:07 +0200
Subject: [PATCH] Protect against direct access to $_POST, $_GET and $_REQUEST.

---
 include/ajax/ajax_ledger.php               |  4 +-
 include/anc_pa.inc.php                     |  2 +-
 include/bank.inc.php                       |  2 +-
 include/cfgtags.inc.php                    |  4 +-
 include/class/acc_account_ledger.class.php | 27 +++++------
 include/extension_choice.inc.php           | 54 ----------------------
 include/lettering.gestion.inc.php          | 29 ++++++++++--
 7 files changed, 44 insertions(+), 78 deletions(-)
 delete mode 100644 include/extension_choice.inc.php

diff --git a/include/ajax/ajax_ledger.php b/include/ajax/ajax_ledger.php
index d130998ee..5cfe228aa 100644
--- a/include/ajax/ajax_ledger.php
+++ b/include/ajax/ajax_ledger.php
@@ -397,7 +397,7 @@ switch ($action) {
 						', array($jr_id));
                 $cn->exec_sql("select comptaproc.jrn_add_note($1,$2)",
                     array($jr_id, $http->post('jrn_note')));
-                $rapt = $_POST['rapt'];
+                $rapt = $http->post('rapt');
 
                 if ($g_parameter->MY_UPDLAB == 'Y' && isset ($_POST['j_id'])) {
                     $a_rowid = $http->post("j_id");
@@ -486,7 +486,7 @@ switch ($action) {
     case 'ask_extdate':
         $date = new IDate('p_date');
         $html .= "<form id=\"form_" . $div . "\" onsubmit=\"return reverseOperation(this);\">";
-        $html .= HtmlInput::hidden('jr_id', $_REQUEST['jr_id']) .
+        $html .= HtmlInput::hidden('jr_id', $http->request('jr_id','number')) .
             HtmlInput::hidden('div', $div) .
             dossier::hidden() .
             HtmlInput::hidden('act', 'reverseop');
diff --git a/include/anc_pa.inc.php b/include/anc_pa.inc.php
index b77026234..5dfc4c0f6 100644
--- a/include/anc_pa.inc.php
+++ b/include/anc_pa.inc.php
@@ -120,7 +120,7 @@ if ($sa=="pa_detail")
     $ret.=HtmlInput::submit('export_analytic_axis',_("Export CSV"));
     $ret.='</form>';
     $ret.=HtmlInput::button_anchor(_('Efface ce plan'), '', 'remove_analytic_plan',
-                    'onclick="return confirm_box(\'remove_analytic_plan\',\'Effacer ?\',function () {window.location=\'do.php?ac='.$_REQUEST['ac'].'&pa_id='.$_GET['pa_id'].'&sa=pa_delete&'.$str_dossier.'\';})"',
+                    'onclick="return confirm_box(\'remove_analytic_plan\',\'Effacer ?\',function () {window.location=\'do.php?ac='.$http->request('ac').'&pa_id='.$http->get('pa_id','number').'&sa=pa_delete&'.$str_dossier.'\';})"',
                     'smallbutton');
 
     $ret.='</div>';
diff --git a/include/bank.inc.php b/include/bank.inc.php
index 61017cc98..a0db678e7 100644
--- a/include/bank.inc.php
+++ b/include/bank.inc.php
@@ -93,7 +93,7 @@ if ( $low_action == "list" )
 
     ?>
     <input type="submit" class="button" name="submit_query" value="<?php echo _('recherche')?>">
-                                           <input type="hidden" name="ac" value="<?php echo $_REQUEST['ac']?>">
+                                           <input type="hidden" name="ac" value="<?php echo $http->request('ac')?>">
                                                                      </form>
                                                                      </div>
                                                                      <?php
diff --git a/include/cfgtags.inc.php b/include/cfgtags.inc.php
index 684120040..037fd0a95 100644
--- a/include/cfgtags.inc.php
+++ b/include/cfgtags.inc.php
@@ -31,7 +31,7 @@ if (!defined('ALLOWED'))
  *
  * ***************************************************************************** */
 $tabs=new Html_Tab("tg", _("Etiquette"));
-
+$http=new \HttpInput();
 ob_start();
 $tag=new Tag($cn);
 $uos=new Single_Record('tag');
@@ -64,7 +64,7 @@ if (isset($_POST['save_tag_sb']))
     </p>
 <?php
 $tag->show_list();
-$js=sprintf("onclick=\"show_tag('%s','%s','%s','p')\"", Dossier::id(), $_REQUEST['ac'], '-1');
+$js=sprintf("onclick=\"show_tag('%s','%s','%s','p')\"", Dossier::id(), $http->request('ac'), '-1');
 echo HtmlInput::button("tag_add", "Création étiquette", $js);
 ?>
 </div>
diff --git a/include/class/acc_account_ledger.class.php b/include/class/acc_account_ledger.class.php
index 2e3aa4079..ec62751e7 100644
--- a/include/class/acc_account_ledger.class.php
+++ b/include/class/acc_account_ledger.class.php
@@ -634,6 +634,7 @@ class Acc_Account_Ledger
      */
     static function HtmlTableHeader($actiontarget="poste")
     {
+        $http=new \HttpInput();
       switch($actiontarget)
 	{
 	case 'poste':
@@ -651,13 +652,13 @@ class Acc_Account_Ledger
 
         echo "<table  >";
         echo '<TR>';
-        $str_ople=(isset($_REQUEST['ople']))?HtmlInput::hidden('ople',$_REQUEST['ople']):'';
+        $str_ople=(isset($_REQUEST['ople']))?HtmlInput::hidden('ople',$http->request('ople')):'';
 	if ($actiontarget=='poste')
 	  {
 	    echo '<TD><form method="GET" ACTION="export.php">'.
 	      dossier::hidden().
 	      HtmlInput::submit('bt_other',"Autre poste").
-	      $hid->input("type","poste").$hid->input('ac',$_REQUEST['ac'])."</form></TD>";
+	      $hid->input("type","poste").$hid->input('ac',$http->request('ac'))."</form></TD>";
 	  }
 
         $id=uniqid("pdf_");
@@ -668,21 +669,21 @@ class Acc_Account_Ledger
         HtmlInput::hidden('act',$action_pdf).
         $hid->input("type","poste").$str_ople.
         $hid->input('p_action','impress').
-        $hid->input("from_periode",$_REQUEST['from_periode']).
-        $hid->input("to_periode",$_REQUEST['to_periode'])
+        $hid->input("from_periode",$http->request('from_periode')).
+        $hid->input("to_periode",$http->request('to_periode'))
 	  ;
 
 	if ( isset($_REQUEST['letter'] )) echo HtmlInput::hidden('letter','2');
 	if ( isset($_REQUEST['solded'] )) echo HtmlInput::hidden('solded','1');
 
 	if (isset($_REQUEST['from_poste']))
-	  echo HtmlInput::hidden('from_poste',$_REQUEST['from_poste']);
+	  echo HtmlInput::hidden('from_poste',$http->request('from_poste'));
 
 	if (isset($_REQUEST['to_poste']))
-	  echo HtmlInput::hidden('to_poste',$_REQUEST['to_poste']);
+	  echo HtmlInput::hidden('to_poste',$http->request('to_poste'));
 
         if (isset($_REQUEST['poste_id']))
-	  echo HtmlInput::hidden("poste_id",$_REQUEST['poste_id']);
+	  echo HtmlInput::hidden("poste_id",$http->request('poste_id'));
 
         if (isset($_REQUEST['poste_fille']))
             echo $hid->input('poste_fille','on');
@@ -697,17 +698,17 @@ class Acc_Account_Ledger
 	HtmlInput::hidden('act',$action_csv).
         $hid->input("type","poste").$str_ople.
         $hid->input('p_action','impress').
-        $hid->input("from_periode",$_REQUEST['from_periode']).
-	  $hid->input("to_periode",$_REQUEST['to_periode']);
+        $hid->input("from_periode",$http->request('from_periode')).
+	  $hid->input("to_periode",$http->request('to_periode'));
 
 	if (isset($_REQUEST['from_poste']))
-	  echo HtmlInput::hidden('from_poste',$_REQUEST['from_poste']);
+	  echo HtmlInput::hidden('from_poste',$http->request('from_poste'));
 
 	if (isset($_REQUEST['to_poste']))
-	  echo HtmlInput::hidden('to_poste',$_REQUEST['to_poste']);
+	  echo HtmlInput::hidden('to_poste',$http->request('to_poste'));
 
         if (isset($_REQUEST['poste_id']))
-	  echo HtmlInput::hidden("poste_id",$_REQUEST['poste_id']);
+	  echo HtmlInput::hidden("poste_id",$http->request('poste_id'));
 
 	if ( isset($_REQUEST['letter'] )) echo HtmlInput::hidden('letter','2');
 	if ( isset($_REQUEST['solded'] )) echo HtmlInput::hidden('solded','1');
@@ -716,7 +717,7 @@ class Acc_Account_Ledger
             echo $hid->input('poste_fille','on');
         if (isset($_REQUEST['oper_detail']))
             echo $hid->input('oper_detail','on');
-        if (isset($_REQUEST['poste_id'])) echo $hid->input("poste_id",$_REQUEST['poste_id']);
+        if (isset($_REQUEST['poste_id'])) echo $hid->input("poste_id",$http->request('poste_id'));
 
         echo "</form></TD>";
 	echo '<td style="vertical-align:top">';
diff --git a/include/extension_choice.inc.php b/include/extension_choice.inc.php
deleted file mode 100644
index 8bc6c1785..000000000
--- a/include/extension_choice.inc.php
+++ /dev/null
@@ -1,54 +0,0 @@
-<?php
-//This file is part of NOALYSS and is under GPL 
-//see licence.txt
-
-if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
-require_once NOALYSS_INCLUDE.'/lib/ac_common.php';
-require_once NOALYSS_INCLUDE.'/constant.php';
-require_once NOALYSS_INCLUDE.'/lib/function_javascript.php';
-require_once  NOALYSS_INCLUDE.'/constant.security.php';
-echo '<div class="topmenu">';
-@html_page_start($_SESSION[SESSION_KEY.'g_theme']);
-
-$cn=Dossier::connect();
-global $g_user;
-$g_user=new Noalyss_user($cn);
-$g_user->check();
-$only_plugin=$g_user->check_dossier(dossier::id());
-
-
-/* javascript file */
-echo load_all_script();
-
-/* show all the extension we can access */
-$a=new ISelect('plugin_code');
-$a->value=Extension::make_array($cn);
-$a->selected=(isset($_REQUEST['plugin_code']))?strtoupper($_REQUEST['plugin_code']):'';
-
-/* no plugin available */
-if ( count($a->value) == 0 )
-{
-    alert(j(_("Aucune extension  disponible")));
-    exit;
-}
-
-/* only one plugin available then we don't propose a choice*/
-if ( count($a->value)==1  )
-{
-    $_REQUEST['plugin_code']=$a->value[0]['value'];
-}
-echo '</div>';
-/*else
-{
-	if (!isset($_REQUEST['ac'])) echo_warning ("ac non positionné");
-    echo '<form method="get" action="do.php">';
-    echo Dossier::hidden();
-    echo HtmlInput::request_to_hidden(array('plugin_code','ac'));
-    echo _('Extension').$a->input().HtmlInput::submit('go',_("Choix de l'extension"));
-    echo '</form>';
-    echo '<hr>';
-}*/
-
-//if ( isset($_REQUEST['plugin_code']))
-//	require_once NOALYSS_INCLUDE.'/extension_get.inc.php';
-?>
diff --git a/include/lettering.gestion.inc.php b/include/lettering.gestion.inc.php
index e3251389c..1749d2577 100644
--- a/include/lettering.gestion.inc.php
+++ b/include/lettering.gestion.inc.php
@@ -1,7 +1,26 @@
 <?php
-//This file is part of NOALYSS and is under GPL 
-//see licence.txt
-
+/*
+ *   This file is part of NOALYSS.
+ *
+ *   NOALYSS is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   NOALYSS is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with NOALYSS; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+// Copyright(2004) Dany De Bontridder danydb@aevalys.eu
+/*! \file
+ * \brief lettering
+ * some variable are already defined ($cn, $g_user ...)
+ */
 if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
 global $g_user;
 echo '<div class="content">';
@@ -52,7 +71,7 @@ echo '<br>';
 echo HtmlInput::submit("seek",_('Recherche'));
 echo '</FORM>';
 echo '</div>';
-//if (! isset($_REQUEST['seek'])) exit;
+
 echo '<hr>';
 //--------------------------------------------------------------------------------
 // record the data
@@ -74,7 +93,7 @@ if ( isset($_GET['start']) && isset($_GET['end']))
       }
   }
 echo '<div id="list">';
-$fiche=new Fiche($cn,$_REQUEST['f_id']);
+$fiche=new Fiche($cn, $http->request('f_id',"number"));
 $quick_code=$fiche->get_quick_code();
 $letter=new Lettering_Card($cn);
 $letter->set_parameter('quick_code',$quick_code);