From 34aa64bae21e92d215bcf88b38f3c9ef467911b6 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 27 Sep 2019 12:36:15 +0200
Subject: [PATCH] Update element.php

---
 htdocs/projet/element.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/htdocs/projet/element.php b/htdocs/projet/element.php
index aea1626e67b..1b1ca30f161 100644
--- a/htdocs/projet/element.php
+++ b/htdocs/projet/element.php
@@ -512,9 +512,9 @@ if ($action=="addelement")
 elseif ($action == "unlink")
 {
 
-	$tablename = GETPOST("tablename");
-    $projectField = GETPOST("projectfield");
-	$elementselectid = GETPOST("elementselect");
+	$tablename = GETPOST("tablename", "aZ09");
+    $projectField = GETPOST("projectfield", "aZ09");
+	$elementselectid = GETPOST("elementselect", "int");
 
 	$result = $object->remove_element($tablename, $elementselectid, $projectField);
 	if ($result < 0)
@@ -890,7 +890,7 @@ foreach ($listofreferent as $key => $value)
 				{
 					if (empty($conf->global->PROJECT_DISABLE_UNLINK_FROM_OVERVIEW) || $user->admin)		// PROJECT_DISABLE_UNLINK_FROM_OVERVIEW is empty by defaut, so this test true
 					{
-						print sprintf('<a href="%s?id=%s&action=unlink&tablename=%s&elementselect=%s&projectfield=%s" class="reposition">', $_SERVER["PHP_SELF"], $projectid, $tablename, $element->id, $project_field?: 'fk_projet');
+						print '<a href="' . $_SERVER["PHP_SELF"] . '?id=' . $projectid . '&action=unlink&tablename=' . $tablename . '&elementselect=' . $element->id . ($project_field ? '&projectfield=' . $project_field : '') . " class="reposition">';
 						print img_picto($langs->trans('Unlink'), 'unlink');
 						print '</a>';
 					}