admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Protect against direct access to $_POST, $_GET and $_REQUEST.

Browse source
This commit is contained in:
sparkyx 2024-10-15 22:21:07 +02:00
parent 47149cc673
commit fde1c4104c
7 changed files with 44 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/ajax/ajax_ledger.php
View file

@ -397,7 +397,7 @@ switch ($action) {
', array($jr_id));
$cn->exec_sql("select comptaproc.jrn_add_note($1,$2)",
array($jr_id, $http->post('jrn_note')));
$rapt = $_POST['rapt'];
$rapt = $http->post('rapt');
if ($g_parameter->MY_UPDLAB == 'Y' && isset ($_POST['j_id'])) {
$a_rowid = $http->post("j_id");
@ -486,7 +486,7 @@ switch ($action) {
case 'ask_extdate':
$date = new IDate('p_date');
$html .= "<form id=\"form_" . $div . "\" onsubmit=\"return reverseOperation(this);\">";
$html .= HtmlInput::hidden('jr_id', $_REQUEST['jr_id']) .
$html .= HtmlInput::hidden('jr_id', $http->request('jr_id','number')) .
HtmlInput::hidden('div', $div) .
dossier::hidden() .
HtmlInput::hidden('act', 'reverseop');

2
include/anc_pa.inc.php
View file

@ -120,7 +120,7 @@ if ($sa=="pa_detail")
$ret.=HtmlInput::submit('export_analytic_axis',_("Export CSV"));
$ret.='</form>';
$ret.=HtmlInput::button_anchor(_('Efface ce plan'), '', 'remove_analytic_plan',
'onclick="return confirm_box(\'remove_analytic_plan\',\'Effacer ?\',function () {window.location=\'do.php?ac='.$_REQUEST['ac'].'&pa_id='.$_GET['pa_id'].'&sa=pa_delete&'.$str_dossier.'\';})"',
'onclick="return confirm_box(\'remove_analytic_plan\',\'Effacer ?\',function () {window.location=\'do.php?ac='.$http->request('ac').'&pa_id='.$http->get('pa_id','number').'&sa=pa_delete&'.$str_dossier.'\';})"',
'smallbutton');
$ret.='</div>';

2
include/bank.inc.php
View file

@ -93,7 +93,7 @@ if ( $low_action == "list" )
?>
<input type="submit" class="button" name="submit_query" value="<?php echo _('recherche')?>">
<input type="hidden" name="ac" value="<?php echo $_REQUEST['ac']?>">
<input type="hidden" name="ac" value="<?php echo $http->request('ac')?>">
</form>
</div>
<?php

4
include/cfgtags.inc.php
View file

@ -31,7 +31,7 @@ if (!defined('ALLOWED'))
*
* ***************************************************************************** */
$tabs=new Html_Tab("tg", _("Etiquette"));
$http=new \HttpInput();
ob_start();
$tag=new Tag($cn);
$uos=new Single_Record('tag');
@ -64,7 +64,7 @@ if (isset($_POST['save_tag_sb']))
</p>
<?php
$tag->show_list();
$js=sprintf("onclick=\"show_tag('%s','%s','%s','p')\"", Dossier::id(), $_REQUEST['ac'], '-1');
$js=sprintf("onclick=\"show_tag('%s','%s','%s','p')\"", Dossier::id(), $http->request('ac'), '-1');
echo HtmlInput::button("tag_add", "Création étiquette", $js);
?>
</div>

27
include/class/acc_account_ledger.class.php
View file

@ -634,6 +634,7 @@ class Acc_Account_Ledger
*/
static function HtmlTableHeader($actiontarget="poste")
{
$http=new \HttpInput();
switch($actiontarget)
{
case 'poste':
@ -651,13 +652,13 @@ class Acc_Account_Ledger
echo "<table >";
echo '<TR>';
$str_ople=(isset($_REQUEST['ople']))?HtmlInput::hidden('ople',$_REQUEST['ople']):'';
$str_ople=(isset($_REQUEST['ople']))?HtmlInput::hidden('ople',$http->request('ople')):'';
if ($actiontarget=='poste')
{
echo '<TD><form method="GET" ACTION="export.php">'.
dossier::hidden().
HtmlInput::submit('bt_other',"Autre poste").
$hid->input("type","poste").$hid->input('ac',$_REQUEST['ac'])."</form></TD>";
$hid->input("type","poste").$hid->input('ac',$http->request('ac'))."</form></TD>";
}
$id=uniqid("pdf_");
@ -668,21 +669,21 @@ class Acc_Account_Ledger
HtmlInput::hidden('act',$action_pdf).
$hid->input("type","poste").$str_ople.
$hid->input('p_action','impress').
$hid->input("from_periode",$_REQUEST['from_periode']).
$hid->input("to_periode",$_REQUEST['to_periode'])
$hid->input("from_periode",$http->request('from_periode')).
$hid->input("to_periode",$http->request('to_periode'))
;
if ( isset($_REQUEST['letter'] )) echo HtmlInput::hidden('letter','2');
if ( isset($_REQUEST['solded'] )) echo HtmlInput::hidden('solded','1');
if (isset($_REQUEST['from_poste']))
echo HtmlInput::hidden('from_poste',$_REQUEST['from_poste']);
echo HtmlInput::hidden('from_poste',$http->request('from_poste'));
if (isset($_REQUEST['to_poste']))
echo HtmlInput::hidden('to_poste',$_REQUEST['to_poste']);
echo HtmlInput::hidden('to_poste',$http->request('to_poste'));
if (isset($_REQUEST['poste_id']))
echo HtmlInput::hidden("poste_id",$_REQUEST['poste_id']);
echo HtmlInput::hidden("poste_id",$http->request('poste_id'));
if (isset($_REQUEST['poste_fille']))
echo $hid->input('poste_fille','on');
@ -697,17 +698,17 @@ class Acc_Account_Ledger
HtmlInput::hidden('act',$action_csv).
$hid->input("type","poste").$str_ople.
$hid->input('p_action','impress').
$hid->input("from_periode",$_REQUEST['from_periode']).
$hid->input("to_periode",$_REQUEST['to_periode']);
$hid->input("from_periode",$http->request('from_periode')).
$hid->input("to_periode",$http->request('to_periode'));
if (isset($_REQUEST['from_poste']))
echo HtmlInput::hidden('from_poste',$_REQUEST['from_poste']);
echo HtmlInput::hidden('from_poste',$http->request('from_poste'));
if (isset($_REQUEST['to_poste']))
echo HtmlInput::hidden('to_poste',$_REQUEST['to_poste']);
echo HtmlInput::hidden('to_poste',$http->request('to_poste'));
if (isset($_REQUEST['poste_id']))
echo HtmlInput::hidden("poste_id",$_REQUEST['poste_id']);
echo HtmlInput::hidden("poste_id",$http->request('poste_id'));
if ( isset($_REQUEST['letter'] )) echo HtmlInput::hidden('letter','2');
if ( isset($_REQUEST['solded'] )) echo HtmlInput::hidden('solded','1');
@ -716,7 +717,7 @@ class Acc_Account_Ledger
echo $hid->input('poste_fille','on');
if (isset($_REQUEST['oper_detail']))
echo $hid->input('oper_detail','on');
if (isset($_REQUEST['poste_id'])) echo $hid->input("poste_id",$_REQUEST['poste_id']);
if (isset($_REQUEST['poste_id'])) echo $hid->input("poste_id",$http->request('poste_id'));
echo "</form></TD>";
echo '<td style="vertical-align:top">';

54
include/extension_choice.inc.php
View file

@ -1,54 +0,0 @@
<?php
//This file is part of NOALYSS and is under GPL
//see licence.txt
if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
require_once NOALYSS_INCLUDE.'/lib/ac_common.php';
require_once NOALYSS_INCLUDE.'/constant.php';
require_once NOALYSS_INCLUDE.'/lib/function_javascript.php';
require_once NOALYSS_INCLUDE.'/constant.security.php';
echo '<div class="topmenu">';
@html_page_start($_SESSION[SESSION_KEY.'g_theme']);
$cn=Dossier::connect();
global $g_user;
$g_user=new Noalyss_user($cn);
$g_user->check();
$only_plugin=$g_user->check_dossier(dossier::id());
/* javascript file */
echo load_all_script();
/* show all the extension we can access */
$a=new ISelect('plugin_code');
$a->value=Extension::make_array($cn);
$a->selected=(isset($_REQUEST['plugin_code']))?strtoupper($_REQUEST['plugin_code']):'';
/* no plugin available */
if ( count($a->value) == 0 )
{
alert(j(_("Aucune extension disponible")));
exit;
}
/* only one plugin available then we don't propose a choice*/
if ( count($a->value)==1 )
{
$_REQUEST['plugin_code']=$a->value[0]['value'];
}
echo '</div>';
/*else
{
if (!isset($_REQUEST['ac'])) echo_warning ("ac non positionné");
echo '<form method="get" action="do.php">';
echo Dossier::hidden();
echo HtmlInput::request_to_hidden(array('plugin_code','ac'));
echo _('Extension').$a->input().HtmlInput::submit('go',_("Choix de l'extension"));
echo '</form>';
echo '<hr>';
}*/
//if ( isset($_REQUEST['plugin_code']))
// require_once NOALYSS_INCLUDE.'/extension_get.inc.php';
?>

29
include/lettering.gestion.inc.php
View file

@ -1,7 +1,26 @@
<?php
//This file is part of NOALYSS and is under GPL
//see licence.txt
/*
* This file is part of NOALYSS.
*
* NOALYSS is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* NOALYSS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with NOALYSS; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
// Copyright(2004) Dany De Bontridder danydb@aevalys.eu
/*! \file
* \brief lettering
* some variable are already defined ($cn, $g_user ...)
*/
if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
global $g_user;
echo '<div class="content">';
@ -52,7 +71,7 @@ echo '<br>';
echo HtmlInput::submit("seek",_('Recherche'));
echo '</FORM>';
echo '</div>';
//if (! isset($_REQUEST['seek'])) exit;
echo '<hr>';
//--------------------------------------------------------------------------------
// record the data
@ -74,7 +93,7 @@ if ( isset($_GET['start']) && isset($_GET['end']))
}
}
echo '<div id="list">';
$fiche=new Fiche($cn,$_REQUEST['f_id']);
$fiche=new Fiche($cn, $http->request('f_id',"number"));
$quick_code=$fiche->get_quick_code();
$letter=new Lettering_Card($cn);
$letter->set_parameter('quick_code',$quick_code);