*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -49,11 +49,14 @@ $extrafields = new ExtraFields($db);
$errmsg=''; $errmsgs=array();
-$action=GETPOST("action");
-$rowid=GETPOST("rowid");
-$typeid=GETPOST("typeid");
+$action=GETPOST('action','alpha');
+$confirm=GETPOST('confirm','alpha');
+$rowid=GETPOST('rowid','int');
+$typeid=GETPOST('typeid','int');
+$userid=GETPOST('userid','int');
+$socid=GETPOST('socid','int');
-if ($rowid)
+if ($rowid > 0)
{
// Load member
$result = $object->fetch($rowid);
@@ -70,6 +73,10 @@ if ($rowid)
|| (($user->id != $adh->user_id) && $user->rights->user->user->password) );
}
}
+else
+{
+ accessforbidden();
+}
// Define variables to know what current user can do on members
$canaddmember=$user->rights->adherent->creer;
@@ -93,12 +100,12 @@ $parameters=array('socid'=>$socid);
$reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks
-if ($_POST['action'] == 'setuserid' && ($user->rights->user->self->creer || $user->rights->user->user->creer))
+if ($action == 'setuserid' && ($user->rights->user->self->creer || $user->rights->user->user->creer))
{
$error=0;
if (empty($user->rights->user->user->creer)) // If can edit only itself user, we can link to itself only
{
- if ($_POST["userid"] != $user->id && $_POST["userid"] != $object->user_id)
+ if ($userid != $user->id && $userid != $object->user_id)
{
$error++;
$mesg=''.$langs->trans("ErrorUserPermissionAllowsToLinksToItselfOnly").'
';
@@ -107,24 +114,23 @@ if ($_POST['action'] == 'setuserid' && ($user->rights->user->self->creer || $use
if (! $error)
{
- if ($_POST["userid"] != $object->user_id) // If link differs from currently in database
+ if ($userid != $object->user_id) // If link differs from currently in database
{
- $result=$object->setUserId($_POST["userid"]);
+ $result=$object->setUserId($userid);
if ($result < 0) dol_print_error($object->db,$object->error);
- $_POST['action']='';
$action='';
}
}
}
-if ($_POST['action'] == 'setsocid')
+if ($action == 'setsocid')
{
$error=0;
if (! $error)
{
- if ($_POST["socid"] != $object->fk_soc) // If link differs from currently in database
+ if ($socid != $object->fk_soc) // If link differs from currently in database
{
$sql ="SELECT rowid FROM ".MAIN_DB_PREFIX."adherent";
- $sql.=" WHERE fk_soc = '".$_POST["socid"]."'";
+ $sql.=" WHERE fk_soc = '".$socid."'";
$sql.=" AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
@@ -135,7 +141,7 @@ if ($_POST['action'] == 'setsocid')
$othermember=new Adherent($db);
$othermember->fetch($obj->rowid);
$thirdparty=new Societe($db);
- $thirdparty->fetch($_POST["socid"]);
+ $thirdparty->fetch($socid);
$error++;
$errmsg=''.$langs->trans("ErrorMemberIsAlreadyLinkedToThisThirdParty",$othermember->getFullName($langs),$othermember->login,$thirdparty->name).'
';
}
@@ -143,9 +149,8 @@ if ($_POST['action'] == 'setsocid')
if (! $error)
{
- $result=$object->setThirdPartyId($_POST["socid"]);
+ $result=$object->setThirdPartyId($socid);
if ($result < 0) dol_print_error($object->db,$object->error);
- $_POST['action']='';
$action='';
}
}
@@ -153,13 +158,13 @@ if ($_POST['action'] == 'setsocid')
}
// Create user from a member
-if ($_POST["action"] == 'confirm_create_user' && $_POST["confirm"] == 'yes' && $user->rights->user->user->creer)
+if ($action == 'confirm_create_user' && $confirm == 'yes' && $user->rights->user->user->creer)
{
if ($result > 0)
{
// Creation user
$nuser = new User($db);
- $result=$nuser->create_from_member($object,$_POST["login"]);
+ $result=$nuser->create_from_member($object,GETPOST('login','alpha'));
if ($result < 0)
{
@@ -174,13 +179,13 @@ if ($_POST["action"] == 'confirm_create_user' && $_POST["confirm"] == 'yes' && $
}
// Create third party from a member
-if ($_POST["action"] == 'confirm_create_thirdparty' && $_POST["confirm"] == 'yes' && $user->rights->societe->creer)
+if ($action == 'confirm_create_thirdparty' && $confirm == 'yes' && $user->rights->societe->creer)
{
if ($result > 0)
{
// Creation user
$company = new Societe($db);
- $result=$company->create_from_member($object,$_POST["companyname"]);
+ $result=$company->create_from_member($object,GETPOST('companyname','alpha'));
if ($result < 0)
{
@@ -195,7 +200,7 @@ if ($_POST["action"] == 'confirm_create_thirdparty' && $_POST["confirm"] == 'yes
}
}
-if ($_REQUEST["action"] == 'confirm_sendinfo' && $_REQUEST["confirm"] == 'yes')
+if ($action == 'confirm_sendinfo' && $confirm == 'yes')
{
if ($object->email)
{
@@ -204,7 +209,7 @@ if ($_REQUEST["action"] == 'confirm_sendinfo' && $_REQUEST["confirm"] == 'yes')
}
}
-if ($_REQUEST["action"] == 'update' && ! $_POST["cancel"] && $user->rights->adherent->creer)
+if ($action == 'update' && ! $_POST["cancel"] && $user->rights->adherent->creer)
{
require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
@@ -328,8 +333,8 @@ if ($_REQUEST["action"] == 'update' && ! $_POST["cancel"] && $user->rights->adhe
}
}
- $_GET["rowid"]=$object->id;
- $_REQUEST["action"]='';
+ $rowid=$object->id;
+ $action='';
}
else
{
@@ -340,7 +345,7 @@ if ($_REQUEST["action"] == 'update' && ! $_POST["cancel"] && $user->rights->adhe
}
}
-if ($_POST["action"] == 'add' && $user->rights->adherent->creer)
+if ($action == 'add' && $user->rights->adherent->creer)
{
$datenaiss='';
if (isset($_POST["naissday"]) && $_POST["naissday"]
@@ -499,7 +504,7 @@ if ($_POST["action"] == 'add' && $user->rights->adherent->creer)
}
}
-if ($user->rights->adherent->supprimer && $_REQUEST["action"] == 'confirm_delete' && $_REQUEST["confirm"] == 'yes')
+if ($user->rights->adherent->supprimer && $action == 'confirm_delete' && $confirm == 'yes')
{
$result=$object->delete($rowid);
if ($result > 0)
@@ -513,7 +518,7 @@ if ($user->rights->adherent->supprimer && $_REQUEST["action"] == 'confirm_delete
}
}
-if ($user->rights->adherent->creer && $_POST["action"] == 'confirm_valid' && $_POST["confirm"] == 'yes')
+if ($user->rights->adherent->creer && $action == 'confirm_valid' && $confirm == 'yes')
{
$result=$object->validate($user);
@@ -547,7 +552,7 @@ if ($user->rights->adherent->creer && $_POST["action"] == 'confirm_valid' && $_P
}
}
-if ($user->rights->adherent->supprimer && $_POST["action"] == 'confirm_resign' && $_POST["confirm"] == 'yes')
+if ($user->rights->adherent->supprimer && $action == 'confirm_resign' && $confirm == 'yes')
{
$adht = new AdherentType($db);
$adht->fetch($object->typeid);
@@ -580,7 +585,7 @@ if ($user->rights->adherent->supprimer && $_POST["action"] == 'confirm_resign' &
}
}
-if ($user->rights->adherent->supprimer && $_POST["action"] == 'confirm_del_spip' && $_POST["confirm"] == 'yes')
+if ($user->rights->adherent->supprimer && $action == 'confirm_del_spip' && $confirm == 'yes')
{
if (! count($object->errors))
{
@@ -591,7 +596,7 @@ if ($user->rights->adherent->supprimer && $_POST["action"] == 'confirm_del_spip'
}
}
-if ($user->rights->adherent->creer && $_POST["action"] == 'confirm_add_spip' && $_POST["confirm"] == 'yes')
+if ($user->rights->adherent->creer && $action == 'confirm_add_spip' && $confirm == 'yes')
{
if (! count($object->errors))
{
@@ -629,7 +634,7 @@ if ($action == 'create')
$object->fk_departement = $_POST["departement_id"];
// We set country_id, country_code and country for the selected country
- $object->country_id=$_POST["country_id"]?$_POST["country_id"]:$mysoc->country_id;
+ $object->country_id=GETPOST('country_id','int')?GETPOST('country_id','int'):$mysoc->country_id;
if ($object->country_id)
{
$tmparray=getCountry($object->country_id,'all');
@@ -674,7 +679,7 @@ if ($action == 'create')
$morphys["phy"] = $langs->trans("Physical");
$morphys["mor"] = $langs->trans("Moral");
print ''.$langs->trans("Nature")." \n";
- print $form->selectarray("morphy", $morphys, isset($_POST["morphy"])?$_POST["morphy"]:$object->morphy, 1);
+ print $form->selectarray("morphy", $morphys, GETPOST('morphy','alpha')?GETPOST('morphy','alpha'):$object->morphy, 1);
print " \n";
// Type
@@ -682,26 +687,26 @@ if ($action == 'create')
$listetype=$adht->liste_array();
if (count($listetype))
{
- print $form->selectarray("typeid", $listetype, isset($_POST["typeid"])?$_POST["typeid"]:$typeid, 1);
+ print $form->selectarray("typeid", $listetype, GETPOST('typeid','int')?GETPOST('typeid','int'):$typeid, 1);
} else {
print ''.$langs->trans("NoTypeDefinedGoToSetup").' ';
}
print "\n";
// Company
- print ''.$langs->trans("Company").' '.$langs->trans("Company").' '.$langs->trans("UserTitle").' ';
- print $formcompany->select_civility(isset($_POST["civilite_id"])?$_POST["civilite_id"]:$object->civilite_id,'civilite_id').' ';
+ print $formcompany->select_civility(GETPOST('civilite_id','int')?GETPOST('civilite_id','int'):$object->civilite_id,'civilite_id').'';
print ''.$langs->trans("Lastname").' '.$langs->trans("Lastname").' '.$langs->trans("Firstname").' '.$langs->trans("Firstname").' '.$langs->trans("Address").' ';
- print '';
+ print '';
print ' '.$langs->trans("Zip").' / '.$langs->trans("Town").' ';
- print $formcompany->select_ziptown((isset($_POST["zipcode"])?$_POST["zipcode"]:$object->zip),'zipcode',array('town','selectcountry_id','departement_id'),6);
+ print $formcompany->select_ziptown((GETPOST('zipcode','alpha')?GETPOST('zipcode','alpha'):$object->zip),'zipcode',array('town','selectcountry_id','departement_id'),6);
print ' ';
- print $formcompany->select_ziptown((isset($_POST["town"])?$_POST["town"]:$object->town),'town',array('zipcode','selectcountry_id','departement_id'));
+ print $formcompany->select_ziptown((GETPOST('town','alpha')?GETPOST('town','alpha'):$object->town),'town',array('zipcode','selectcountry_id','departement_id'));
print ' '.$langs->trans('Country').' ';
- print $form->select_country(isset($_POST["country_id"])?$_POST["country_id"]:$object->country_id,'country_id');
+ print $form->select_country(GETPOST('country_id','alpha')?GETPOST('country_id','alpha'):$object->country_id,'country_id');
if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionnarySetup"),1);
print ' '.$langs->trans('State').' ';
if ($object->country_id)
{
- print $formcompany->select_state(isset($_POST["departement_id"])?$_POST["departement_id"]:$object->fk_departement,$object->country_code);
+ print $formcompany->select_state(GETPOST('departement_id','int')?GETPOST('departement_id','int'):$object->fk_departement,$object->country_code);
}
else
{
@@ -749,16 +754,16 @@ if ($action == 'create')
}
// Tel pro
- print ' '.$langs->trans("PhonePro").' '.$langs->trans("PhonePro").' '.$langs->trans("PhonePerso").' '.$langs->trans("PhonePerso").' '.$langs->trans("PhoneMobile").' '.$langs->trans("PhoneMobile").' '.($conf->global->ADHERENT_MAIL_REQUIRED?'':'').$langs->trans("EMail").($conf->global->ADHERENT_MAIL_REQUIRED?' ':'').' '.($conf->global->ADHERENT_MAIL_REQUIRED?'':'').$langs->trans("EMail").($conf->global->ADHERENT_MAIL_REQUIRED?' ':'').' ".$langs->trans("Birthday")." \n";
@@ -777,7 +782,7 @@ if ($action == 'create')
{
foreach($extrafields->attribute_label as $key=>$label)
{
- $value=(isset($_POST["options_".$key])?$_POST["options_".$key]:$object->array_options["options_".$key]);
+ $value=(isset($_POST["options_".$key])?GETPOST('options_'.$key,'alpha'):$object->array_options["options_".$key]);
print ' '.$label.' ';
print $extrafields->showInputField($key,$value);
print ' ';
- print_fleche_navigation($page,$_SERVER["PHP_SELF"],'&id='.GETPOST('id'),($num > $listlimit),$langs->trans("Page").' '.($page+1));
+ print_fleche_navigation($page,$_SERVER["PHP_SELF"],'&id='.GETPOST('id','int'),($num > $listlimit),$langs->trans("Page").' '.($page+1));
print ' ';
print '';
@@ -756,7 +756,7 @@ if ($_GET["id"])
{
print '