From 1bfd3f609cd25a97790fca18a5cdc62efa43a7a3 Mon Sep 17 00:00:00 2001
From: Regis Houssin <regis@dolibarr.fr>
Date: Fri, 15 May 2009 14:21:57 +0000
Subject: [PATCH] =?UTF-8?q?Fix:=20ajout=20d'un=20jeton=20al=E9atoire=20dan?=
 =?UTF-8?q?s=20les=20requetes=20POST?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 htdocs/admin/tools/dolibarr_export.php         |  2 +-
 htdocs/cashdesk/index.php                      | 11 ++++-------
 htdocs/cashdesk/templates/facturation1.tpl.php |  3 +++
 htdocs/cashdesk/templates/validation1.tpl.php  |  1 +
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/htdocs/admin/tools/dolibarr_export.php b/htdocs/admin/tools/dolibarr_export.php
index 0ddef8e323e..0a64b249e77 100644
--- a/htdocs/admin/tools/dolibarr_export.php
+++ b/htdocs/admin/tools/dolibarr_export.php
@@ -66,7 +66,7 @@ if ($_GET["msg"])
 
 <!-- Dump of a server -->
 <form method="post" action="export.php" name="dump">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken'] ?>" />
+<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 
 <input type="hidden" name="export_type" value="server" />
 
diff --git a/htdocs/cashdesk/index.php b/htdocs/cashdesk/index.php
index 93d8c23c05c..223770c0e88 100644
--- a/htdocs/cashdesk/index.php
+++ b/htdocs/cashdesk/index.php
@@ -63,25 +63,22 @@ if ( $_SESSION['uid'] > 0 ) {
 <div class="principal_login">
 <fieldset class="cadre_facturation"><legend class="titre1">Identification</legend>
 <form class="formulaire_login" id="frmLogin" method="post" action="index_verif.php">
-	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken'] ?>" />
+	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 
 <table>
 
 	<tr>
 		<td class="label1">Nom d'utilisateur</td>
-		<td><input name="txtUsername" class="texte_login" type="text"
-			value="<?php echo $_GET['user']; ?>" /></td>
+		<td><input name="txtUsername" class="texte_login" type="text"	value="<?php echo $_GET['user']; ?>" /></td>
 	</tr>
 	<tr>
 		<td class="label1">Mot de passe</td>
-		<td><input name="pwdPassword" class="texte_login" type="password"
-			value="" /></td>
+		<td><input name="pwdPassword" class="texte_login" type="password"	value="" /></td>
 	</tr>
 
 </table>
 
-<span class="bouton_login"><input name="sbmtConnexion" type="submit"
-	value="Connexion" /></span>
+<span class="bouton_login"><input name="sbmtConnexion" type="submit" value="Connexion" /></span>
 
 </form>
 </fieldset>
diff --git a/htdocs/cashdesk/templates/facturation1.tpl.php b/htdocs/cashdesk/templates/facturation1.tpl.php
index f723b8f6d97..9e9d2d11433 100644
--- a/htdocs/cashdesk/templates/facturation1.tpl.php
+++ b/htdocs/cashdesk/templates/facturation1.tpl.php
@@ -20,6 +20,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 <!-- ========================= Cadre "Article" ============================= -->
 <fieldset class="cadre_facturation"><legend class="titre1">Article</legend>
 	<form id="frmFacturation" class="formulaire1" method="post" action="facturation_verif.php">
+		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 
 		<input type="hidden" name="hdnSource" value="NULL" />
 
@@ -103,6 +104,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 	</form>
 
 	<form id="frmQte" class="formulaire1" method="post" action="facturation_verif.php?action=ajout_article" onsubmit ="javascript: return verifSaisie();">
+		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 		<table>
 			<tr><th class="label1">Quantité</th><th class="label1">Stock</th><th class="label1">Prix unitaire</th><th></th><th class="label1">Taux TVA</th><th class="label1">Remise (%)</th><th class="label1">Prix total</th></tr>
 			<tr>
@@ -145,6 +147,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 
 <!-- ========================= Cadre "Différence" ============================= -->
 <form id="frmDifference"  class="formulaire1" method="post" onsubmit="javascript: return verifReglement()" action="validation_verif.php?action=valide_achat">
+	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 <fieldset class="cadre_facturation"><legend class="titre1">Différence</legend>
 		<table>
 			<tr><th class="label1">Montant dû</th><th class="label1">Encaissé</th><th class="label1">Rendu</th></tr>
diff --git a/htdocs/cashdesk/templates/validation1.tpl.php b/htdocs/cashdesk/templates/validation1.tpl.php
index 22d4dca209d..199f40774fb 100644
--- a/htdocs/cashdesk/templates/validation1.tpl.php
+++ b/htdocs/cashdesk/templates/validation1.tpl.php
@@ -62,6 +62,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 	</table>
 
 	<form id="frmValidation" class="formulaire2" method="post" action="validation_verif.php?action=valide_facture">
+		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
 
 		<p class="note_label">Notes<br /><textarea class="textarea_note" name="txtaNotes"></textarea></p>