diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php
index ddbc7123d70..8c6f7687263 100644
--- a/htdocs/adherents/card.php
+++ b/htdocs/adherents/card.php
@@ -822,7 +822,7 @@ else
// Login
if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED))
{
- print '| '.$langs->trans("Login").' / '.$langs->trans("Id").' | login).'"> |
';
+ print '| '.$langs->trans("Login").' / '.$langs->trans("Id").' | login).'"> |
';
}
// Type
@@ -1066,7 +1066,7 @@ else
// Login
if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED))
{
- print '| '.$langs->trans("Login").' / '.$langs->trans("Id").' | login).'"> |
';
+ print '| '.$langs->trans("Login").' / '.$langs->trans("Id").' | login).'"> |
';
}
// Morphy
@@ -1090,7 +1090,7 @@ else
print "";
// Company
- print '| '.$langs->trans("Company").' | societe).'"> |
';
+ print '| '.$langs->trans("Company").' | societe).'"> |
';
// Civility
print '| '.$langs->trans("UserTitle").' | ';
@@ -1099,11 +1099,11 @@ else
print ' |
';
// Lastname
- print '| '.$langs->trans("Lastname").' | lastname).'"> | ';
+ print '
| '.$langs->trans("Lastname").' | lastname).'"> | ';
print '
';
// Firstname
- print '| '.$langs->trans("Firstname").' | firstname).'"> | ';
+ print '
| '.$langs->trans("Firstname").' | firstname).'"> | ';
print '
';
// Photo
@@ -1122,24 +1122,24 @@ else
print '';
// EMail
- print '| '.($conf->global->ADHERENT_MAIL_REQUIRED?'':'').$langs->trans("EMail").($conf->global->ADHERENT_MAIL_REQUIRED?'':'').' | email).'"> |
';
+ print '| '.($conf->global->ADHERENT_MAIL_REQUIRED?'':'').$langs->trans("EMail").($conf->global->ADHERENT_MAIL_REQUIRED?'':'').' | email).'"> |
';
// Password
if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED))
{
- print '| '.$langs->trans("Password").' | pass).'"> |
';
+ print '| '.$langs->trans("Password").' | pass).'"> |
';
}
// Address
print '| '.$langs->trans("Address").' | ';
- print '';
+ print '';
print ' |
';
// Zip / Town
print '| '.$langs->trans("Zip").' / '.$langs->trans("Town").' | ';
- print $formcompany->select_ziptown((isset($_POST["zipcode"])?$_POST["zipcode"]:$object->zip),'zipcode',array('town','selectcountry_id','state_id'),6);
+ print $formcompany->select_ziptown((isset($_POST["zipcode"])?GETPOST("zipcode",'',2):$object->zip),'zipcode',array('town','selectcountry_id','state_id'),6);
print ' ';
- print $formcompany->select_ziptown((isset($_POST["town"])?$_POST["town"]:$object->town),'town',array('zipcode','selectcountry_id','state_id'));
+ print $formcompany->select_ziptown((isset($_POST["town"])?GETPOST("town",'',2):$object->town),'town',array('zipcode','selectcountry_id','state_id'));
print ' |
';
// Country
@@ -1153,23 +1153,23 @@ else
if (empty($conf->global->MEMBER_DISABLE_STATE))
{
print '| '.$langs->trans('State').' | ';
- print $formcompany->select_state($object->state_id,isset($_POST["country_id"])?$_POST["country_id"]:$object->country_id);
+ print $formcompany->select_state($object->state_id,isset($_POST["country_id"])?GETPOST("country_id"):$object->country_id);
print ' |
';
}
// Pro phone
- print '| '.$langs->trans("PhonePro").' | phone).'"> |
';
+ print '| '.$langs->trans("PhonePro").' | phone).'"> |
';
// Personal phone
- print '| '.$langs->trans("PhonePerso").' | phone_perso).'"> |
';
+ print '| '.$langs->trans("PhonePerso").' | phone_perso).'"> |
';
// Mobile phone
- print '| '.$langs->trans("PhoneMobile").' | phone_mobile).'"> |
';
+ print '| '.$langs->trans("PhoneMobile").' | phone_mobile).'"> |
';
// Skype
if (! empty($conf->skype->enabled))
{
- print '| '.$langs->trans("Skype").' | skype).'"> |
';
+ print '| '.$langs->trans("Skype").' | skype).'"> |
';
}
// Birthday
@@ -1179,7 +1179,7 @@ else
// Public profil
print "| ".$langs->trans("Public")." | \n";
- print $form->selectyesno("public",(isset($_POST["public"])?$_POST["public"]:$object->public),1);
+ print $form->selectyesno("public",(isset($_POST["public"])?GETPOST("public",'',2):$object->public),1);
print " |
\n";
// Categories
diff --git a/htdocs/admin/menus/index.php b/htdocs/admin/menus/index.php
index c8b7b469bd2..acfa9d2dccd 100644
--- a/htdocs/admin/menus/index.php
+++ b/htdocs/admin/menus/index.php
@@ -71,7 +71,7 @@ if ($action == 'up')
// Get current position
$sql = "SELECT m.rowid, m.position, m.type, m.fk_menu";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE m.rowid = ".$_GET["menuId"];
+ $sql.= " WHERE m.rowid = ".GETPOST("menuId","int");
dol_syslog("admin/menus/index.php ".$sql);
$result = $db->query($sql);
$num = $db->num_rows($result);
@@ -89,11 +89,11 @@ if ($action == 'up')
// Menu before
$sql = "SELECT m.rowid, m.position";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE (m.position < ".($current['order'])." OR (m.position = ".($current['order'])." AND rowid < ".$_GET["menuId"]."))";
- $sql.= " AND m.menu_handler='".$menu_handler_to_search."'";
+ $sql.= " WHERE (m.position < ".($current['order'])." OR (m.position = ".($current['order'])." AND rowid < ".GETPOST("menuId","int")."))";
+ $sql.= " AND m.menu_handler='".$db->escape($menu_handler_to_search)."'";
$sql.= " AND m.entity = ".$conf->entity;
- $sql.= " AND m.type = '".$current['type']."'";
- $sql.= " AND m.fk_menu = '".$current['fk_menu']."'";
+ $sql.= " AND m.type = '".$db->escape($current['type'])."'";
+ $sql.= " AND m.fk_menu = '".$db->escape($current['fk_menu'])."'";
$sql.= " ORDER BY m.position, m.rowid";
dol_syslog("admin/menus/index.php ".$sql);
$result = $db->query($sql);
@@ -127,7 +127,7 @@ elseif ($action == 'down')
// Get current position
$sql = "SELECT m.rowid, m.position, m.type, m.fk_menu";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE m.rowid = ".$_GET["menuId"];
+ $sql.= " WHERE m.rowid = ".GETPOST("menuId","int");
dol_syslog("admin/menus/index.php ".$sql);
$result = $db->query($sql);
$num = $db->num_rows($result);
@@ -145,11 +145,11 @@ elseif ($action == 'down')
// Menu after
$sql = "SELECT m.rowid, m.position";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE (m.position > ".($current['order'])." OR (m.position = ".($current['order'])." AND rowid > ".$_GET["menuId"]."))";
- $sql.= " AND m.menu_handler='".$menu_handler_to_search."'";
+ $sql.= " WHERE (m.position > ".($current['order'])." OR (m.position = ".($current['order'])." AND rowid > ".GETPOST("menuId","int")."))";
+ $sql.= " AND m.menu_handler='".$db->escape($menu_handler_to_search)."'";
$sql.= " AND m.entity = ".$conf->entity;
- $sql.= " AND m.type = '".$current['type']."'";
- $sql.= " AND m.fk_menu = '".$current['fk_menu']."'";
+ $sql.= " AND m.type = '".$db->escape($current['type'])."'";
+ $sql.= " AND m.fk_menu = '".$db->escape($current['fk_menu'])."'";
$sql.= " ORDER BY m.position, m.rowid";
dol_syslog("admin/menus/index.php ".$sql);
$result = $db->query($sql);
@@ -180,7 +180,7 @@ elseif ($action == 'confirm_delete' && $confirm == 'yes')
$db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."menu";
- $sql.= " WHERE rowid = ".$_GET['menuId'];
+ $sql.= " WHERE rowid = ".GETPOST('menuId','int');
$resql=$db->query($sql);
if ($resql)
{
@@ -245,11 +245,11 @@ if ($action == 'delete')
{
$sql = "SELECT m.titre";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE m.rowid = ".$_GET['menuId'];
+ $sql.= " WHERE m.rowid = ".GETPOST('menuId','int');
$result = $db->query($sql);
$obj = $db->fetch_object($result);
- print $form->formconfirm("index.php?menu_handler=".$menu_handler."&menuId=".$_GET['menuId'],$langs->trans("DeleteMenu"),$langs->trans("ConfirmDeleteMenu",$obj->titre),"confirm_delete");
+ print $form->formconfirm("index.php?menu_handler=".$menu_handler."&menuId=".GETPOST('menuId','int'),$langs->trans("DeleteMenu"),$langs->trans("ConfirmDeleteMenu",$obj->titre),"confirm_delete");
}
@@ -298,7 +298,7 @@ if ($conf->use_javascript_ajax)
$sql = "SELECT m.rowid, m.titre, m.langs, m.mainmenu, m.leftmenu, m.fk_menu, m.fk_mainmenu, m.fk_leftmenu, m.module";
$sql.= " FROM ".MAIN_DB_PREFIX."menu as m";
- $sql.= " WHERE menu_handler = '".$menu_handler_to_search."'";
+ $sql.= " WHERE menu_handler = '".$db->escape($menu_handler_to_search)."'";
$sql.= " AND entity = ".$conf->entity;
//$sql.= " AND fk_menu >= 0";
$sql.= " ORDER BY m.position, m.rowid"; // Order is position then rowid (because we need a sort criteria when position is same)
diff --git a/htdocs/admin/perms.php b/htdocs/admin/perms.php
index 8ce7e046186..e023af90067 100644
--- a/htdocs/admin/perms.php
+++ b/htdocs/admin/perms.php
@@ -44,7 +44,7 @@ if (!$user->admin) accessforbidden();
if ($action == 'add')
{
$sql = "UPDATE ".MAIN_DB_PREFIX."rights_def SET bydefault=1";
- $sql.= " WHERE id = ".$_GET["pid"];
+ $sql.= " WHERE id = ".GETPOST("pid",'int');
$sql.= " AND entity = ".$conf->entity;
$db->query($sql);
}
@@ -52,7 +52,7 @@ if ($action == 'add')
if ($action == 'remove')
{
$sql = "UPDATE ".MAIN_DB_PREFIX."rights_def SET bydefault=0";
- $sql.= " WHERE id = ".$_GET["pid"];
+ $sql.= " WHERE id = ".GETPOST('pid','int');
$sql.= " AND entity = ".$conf->entity;
$db->query($sql);
}
diff --git a/htdocs/bookmarks/card.php b/htdocs/bookmarks/card.php
index 67e01bcb773..bef65d409a3 100644
--- a/htdocs/bookmarks/card.php
+++ b/htdocs/bookmarks/card.php
@@ -69,7 +69,7 @@ if ($action == 'add' || $action == 'addproduct' || $action == 'update')
exit;
}
- if ($action == 'update') $bookmark->fetch($_POST["id"]);
+ if ($action == 'update') $bookmark->fetch(GETPOST("id",'int'));
// Check if null because user not admin can't set an user and send empty value here.
if(!empty($userid))
$bookmark->fk_user=$userid;
@@ -217,7 +217,7 @@ if ($id > 0 && ! preg_match('/^add/i',$action))
print '';
- print '| '.$langs->trans("Ref").' | '.$bookmark->ref.' |
';
+ print '| '.$langs->trans("Ref").' | '.$bookmark->ref.' |
';
print '| ';
if ($action == 'edit') {
@@ -231,7 +231,7 @@ if ($id > 0 && ! preg_match('/^add/i',$action))
}
print ' | ';
- if ($action == 'edit') print 'title).'">';
+ if ($action == 'edit') print 'title).'">';
else print $bookmark->title;
print ' |
';
@@ -301,6 +301,8 @@ if ($id > 0 && ! preg_match('/^add/i',$action))
}
+ // Buttons
+
print "\n";
// Edit
diff --git a/htdocs/cashdesk/tpl/validation2.tpl.php b/htdocs/cashdesk/tpl/validation2.tpl.php
index 7bc7999d377..b74f5afdd52 100644
--- a/htdocs/cashdesk/tpl/validation2.tpl.php
+++ b/htdocs/cashdesk/tpl/validation2.tpl.php
@@ -33,7 +33,7 @@ $langs->load("bills");
largeur = 600;
hauteur = 500;
opt = 'width='+largeur+', height='+hauteur+', left='+(screen.width - largeur)/2+', top='+(screen.height-hauteur)/2+'';
- window.open('validation_ticket.php?facid=', 'trans('PrintTicket') ?>', opt);
+ window.open('validation_ticket.php?facid=', 'trans('PrintTicket') ?>', opt);
}
popupTicket();
diff --git a/htdocs/comm/contact.php b/htdocs/comm/contact.php
index c7690e7e16f..7b71e3ade9c 100644
--- a/htdocs/comm/contact.php
+++ b/htdocs/comm/contact.php
@@ -125,6 +125,8 @@ if ($resql)
$title = (! empty($conf->global->SOCIETE_ADDRESSES_MANAGEMENT) ? $langs->trans("ListOfContacts") : $langs->trans("ListOfContactsAddresses"));
print_barre_liste($title.($label?" (".$label.")":""),$page, $_SERVER["PHP_SELF"], $param,$sortfield,$sortorder,"",$num);
+ print '
";
+
+ print '';
+
$db->free($resql);
}
else
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index 5cc7fcedf4d..575a55e435f 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -283,14 +283,14 @@ if ($socid > 0)
print '';
print '";
}
diff --git a/htdocs/commande/customer.php b/htdocs/commande/customer.php
index 391962c98cb..8190367a06a 100644
--- a/htdocs/commande/customer.php
+++ b/htdocs/commande/customer.php
@@ -44,11 +44,13 @@ accessforbidden();
$langs->load("companies");
$langs->load("orders");
+
+$limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit;
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
$page = GETPOST("page",'int');
if ($page == -1) { $page = 0; }
-$offset = $conf->liste_limit * $page;
+$offset = $limit * $page;
$pageprev = $page - 1;
$pagenext = $page + 1;
if (! $sortorder) $sortorder="ASC";
@@ -77,32 +79,32 @@ $sql.= " AND s.entity IN (".getEntity('societe', 1).")";
if (!$user->rights->societe->client->voir && !$socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id;
if (dol_strlen($stcomm))
{
- $sql.= " AND s.fk_stcomm=$stcomm";
-}
-
-if ($_GET["search_nom"])
-{
- $sql.= " AND s.nom like '%".$db->escape(strtolower($_GET["search_nom"]))."%'";
-}
-if ($_GET["search_compta"])
-{
- $sql.= " AND s.code_compta like '%".$db->escape($_GET["search_compta"])."%'";
-}
-if ($_GET["search_code_client"])
-{
- $sql.= " AND s.code_client like '%".$db->escape($_GET["search_code_client"])."%'";
+ $sql.= " AND s.fk_stcomm=".$stcomm;
}
+if (GETPOST("search_nom")) $sql.= natural_search("s.nom", GETPOST("search_nom"));
+if (GETPOST("search_compta")) $sql.= natural_search("s.code_compta", GETPOST("search_compta"));
+if (GETPOST("search_code_client")) $sql.= natural_search("s.code_client", GETPOST("search_code_client"));
if (dol_strlen($begin))
{
$sql.= " AND s.nom like '".$db->escape($begin)."'";
}
-if ($socid)
+if ($socid > 0)
{
$sql.= " AND s.rowid = ".$socid;
}
$sql.= " AND c.fk_statut in (1, 2) AND c.facture = 0";
$sql.= " GROUP BY s.nom";
-$sql.= " ORDER BY $sortfield $sortorder " . $db->plimit($conf->liste_limit+1, $offset);
+$sql.= $db->order($sortfield,$sortorder);
+
+// Count total nb of records
+$nbtotalofrecords = -1;
+if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST))
+{
+ $result = $db->query($sql);
+ $nbtotalofrecords = $db->num_rows($result);
+}
+
+$sql.= $db->plimit($limit + 1, $offset);
//print $sql;
$resql = $db->query($sql);
@@ -129,26 +131,27 @@ if ($resql)
print '';
print '| ';
- print ' | ';
+ print '';
print ' | ';
print '';
- print '';
+ print '';
print ' | ';
print '';
- print '';
+ print '';
print ' | ';
print '';
print '';
print ' | ';
+
print "
\n";
$var=true;
- while ($i < min($num,$conf->liste_limit))
+ while ($i < min($num,$limit))
{
$obj = $db->fetch_object($resql);
diff --git a/htdocs/commande/orderstoinvoice.php b/htdocs/commande/orderstoinvoice.php
index f9767c74695..74861d3ee67 100644
--- a/htdocs/commande/orderstoinvoice.php
+++ b/htdocs/commande/orderstoinvoice.php
@@ -46,7 +46,7 @@ $langs->load('companies');
if (! $user->rights->facture->creer)
accessforbidden();
-$id = (GETPOST('id')?GETPOST('id','int'):GETPOST("facid")); // For backward compatibility
+$id = (GETPOST('id')?GETPOST('id','int'):GETPOST("facid","int")); // For backward compatibility
$ref = GETPOST('ref','alpha');
$action = GETPOST('action','alpha');
$confirm = GETPOST('confirm','alpha');
@@ -112,7 +112,7 @@ if (($action == 'create' || $action == 'add') && !$error)
$langs->load('main');
if (isset($_GET['orders_to_invoice']))
{
- $orders_id = $_GET['orders_to_invoice'];
+ $orders_id = GETPOST('orders_to_invoice','',1);
$n = count($orders_id);
$i = 0;
@@ -122,7 +122,7 @@ if (($action == 'create' || $action == 'add') && !$error)
}
if (isset($_POST['orders_to_invoice']))
{
- $orders_id = $_POST['orders_to_invoice'];
+ $orders_id = GETPOST('orders_to_invoice','',1);
$nn = count($orders_id);
$ii = 0;
diff --git a/htdocs/compta/localtax/reglement.php b/htdocs/compta/localtax/reglement.php
index 54530b14443..df96d0b7d67 100644
--- a/htdocs/compta/localtax/reglement.php
+++ b/htdocs/compta/localtax/reglement.php
@@ -31,7 +31,7 @@ $langs->load("compta");
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'tax', '', '', 'charges');
-$ltt=$_REQUEST["localTaxType"];
+$ltt=GETPOST("localTaxType");
/*
* View
@@ -45,7 +45,7 @@ print load_fiche_titre($langs->transcountry($ltt==2?"LT2Payments":"LT1Payments",
$sql = "SELECT rowid, amount, label, f.datev as dm";
$sql.= " FROM ".MAIN_DB_PREFIX."localtax as f ";
-$sql.= " WHERE f.entity = ".$conf->entity." AND localtaxtype=".$ltt;
+$sql.= " WHERE f.entity = ".$conf->entity." AND localtaxtype=".$db->escape($ltt);
$sql.= " ORDER BY dm DESC";
$result = $db->query($sql);
diff --git a/htdocs/compta/tva/quadri_detail.php b/htdocs/compta/tva/quadri_detail.php
index 128eb6456f3..e0a19d7a0f3 100644
--- a/htdocs/compta/tva/quadri_detail.php
+++ b/htdocs/compta/tva/quadri_detail.php
@@ -48,7 +48,7 @@ $langs->load("trips");
$langs->load("other");
// Date range
-$year=GETPOST("year");
+$year=GETPOST("year","int");
if (empty($year))
{
$year_current = strftime("%Y",dol_now());
@@ -57,15 +57,15 @@ if (empty($year))
$year_current = $year;
$year_start = $year;
}
-$date_start=dol_mktime(0,0,0,$_REQUEST["date_startmonth"],$_REQUEST["date_startday"],$_REQUEST["date_startyear"]);
-$date_end=dol_mktime(23,59,59,$_REQUEST["date_endmonth"],$_REQUEST["date_endday"],$_REQUEST["date_endyear"]);
+$date_start=dol_mktime(0,0,0,GETPOST("date_startmonth"),GETPOST("date_startday"),GETPOST("date_startyear"));
+$date_end=dol_mktime(23,59,59,GETPOST("date_endmonth"),GETPOST("date_endday"),GETPOST("date_endyear"));
// Quarter
if (empty($date_start) || empty($date_end)) // We define date_start and date_end
{
$q=GETPOST("q");
if (empty($q))
{
- if (isset($_REQUEST["month"])) { $date_start=dol_get_first_day($year_start,$_REQUEST["month"],false); $date_end=dol_get_last_day($year_start,$_REQUEST["month"],false); }
+ if (GETPOST("month")) { $date_start=dol_get_first_day($year_start,GETPOST("month"),false); $date_end=dol_get_last_day($year_start,GETPOST("month"),false); }
else
{
$month_current = strftime("%m",dol_now());
diff --git a/htdocs/core/class/html.formsms.class.php b/htdocs/core/class/html.formsms.class.php
index b2802f91c09..9412582599d 100644
--- a/htdocs/core/class/html.formsms.class.php
+++ b/htdocs/core/class/html.formsms.class.php
@@ -255,7 +255,7 @@ function limitChars(textarea, limit, infodiv)
}
else
{
- print "withto) && $this->withto != '1'? (isset($_REQUEST["sendto"])?$_REQUEST["sendto"]:$this->withto):"+")."\">";
+ print "withto) && $this->withto != '1'? (isset($_REQUEST["sendto"])?GETPOST("sendto"):$this->withto):"+")."\">";
if (! empty($this->withtosocid) && $this->withtosocid > 0)
{
$liste=array();
@@ -290,11 +290,11 @@ function limitChars(textarea, limit, infodiv)
if ($this->withbodyreadonly)
{
print nl2br($defaultmessage);
- print '';
+ print '';
}
else
{
- print '';
+ print '';
print ''.$langs->trans("SmsInfoCharRemain").': '.(160-dol_strlen($defaultmessage)).'
';
}
print "\n";
diff --git a/htdocs/core/datepicker.php b/htdocs/core/datepicker.php
index 63b765fbadb..eeb20ee265c 100644
--- a/htdocs/core/datepicker.php
+++ b/htdocs/core/datepicker.php
@@ -108,7 +108,7 @@ if (isset($_GET["m"]) && isset($_GET["y"]))
if ($qualified)
{
//print $_GET["cm"].",".$_GET["sd"].",".$_GET["m"].",".$_GET["y"];exit;
- displayBox($_GET["sd"],$_GET["m"],$_GET["y"]);
+ displayBox(GETPOST("sd",'alpha'),GETPOST("m",'int'),GETPOST("y",'int'));
}
else
{
diff --git a/htdocs/core/filemanagerdol/connectors/php/io.php b/htdocs/core/filemanagerdol/connectors/php/io.php
index 731509b6e10..77c8c3ec253 100644
--- a/htdocs/core/filemanagerdol/connectors/php/io.php
+++ b/htdocs/core/filemanagerdol/connectors/php/io.php
@@ -44,7 +44,7 @@ function GetResourceTypePath($resourceType, $sCommand)
{
global $Config ;
- if ( $sCommand == "QuickUpload")
+ if ($sCommand == "QuickUpload")
return $Config['QuickUploadPath'][$resourceType] ;
else
return $Config['FileTypesPath'][$resourceType] ;
@@ -60,7 +60,7 @@ function GetResourceTypePath($resourceType, $sCommand)
function GetResourceTypeDirectory($resourceType, $sCommand)
{
global $Config ;
- if ( $sCommand == "QuickUpload")
+ if ($sCommand == "QuickUpload")
{
if ( strlen($Config['QuickUploadAbsolutePath'][$resourceType]) > 0)
return $Config['QuickUploadAbsolutePath'][$resourceType] ;
@@ -299,7 +299,7 @@ function IsAllowedCommand($sCommand)
{
global $Config ;
- if ( !in_array($sCommand, $Config['ConfigAllowedCommands']))
+ if (! in_array($sCommand, $Config['ConfigAllowedCommands']))
return false ;
return true ;
@@ -315,7 +315,7 @@ function GetCurrentFolder()
if (!isset($_GET)) {
global $_GET;
}
- $sCurrentFolder = isset( $_GET['CurrentFolder'] ) ? $_GET['CurrentFolder'] : '/' ;
+ $sCurrentFolder = isset( $_GET['CurrentFolder'] ) ? GETPOST('CurrentFolder', '', 1) : '/' ;
// Check the current folder syntax (must begin and start with a slash).
if (!preg_match('|/$|', $sCurrentFolder))
diff --git a/htdocs/core/photos_resize.php b/htdocs/core/photos_resize.php
index 2ef81d6e8df..ae73347edfa 100644
--- a/htdocs/core/photos_resize.php
+++ b/htdocs/core/photos_resize.php
@@ -34,7 +34,7 @@ $langs->load("other");
$id=GETPOST('id','int');
$action=GETPOST('action','alpha');
$modulepart=GETPOST('modulepart','alpha')?GETPOST('modulepart','alpha'):'produit|service';
-$original_file = isset($_REQUEST["file"])?urldecode($_REQUEST["file"]):'';
+$original_file = GETPOST("file");
$backtourl=GETPOST('backtourl');
$cancel=GETPOST("cancel");
diff --git a/htdocs/core/tpl/objectline_create.tpl.php b/htdocs/core/tpl/objectline_create.tpl.php
index c87a243a1c3..30027560140 100644
--- a/htdocs/core/tpl/objectline_create.tpl.php
+++ b/htdocs/core/tpl/objectline_create.tpl.php
@@ -153,7 +153,7 @@ else {
}
}
- echo $form->select_type_of_lines(isset($_POST["type"])?$_POST["type"]:-1,'type',1,1,$forceall);
+ echo $form->select_type_of_lines(isset($_POST["type"])?GETPOST("type",'alpha',2):-1,'type',1,1,$forceall);
echo '';
@@ -253,25 +253,25 @@ else {
tva_assuj == "0") echo ''.vatrate(0, true);
- else echo $form->load_tva('tva_tx', (isset($_POST["tva_tx"])?$_POST["tva_tx"]:-1), $seller, $buyer, 0, 0, '', false, 1);
+ else echo $form->load_tva('tva_tx', (isset($_POST["tva_tx"])?GETPOST("tva_tx",'alpha',2):-1), $seller, $buyer, 0, 0, '', false, 1);
?>
|
- ">
+ ">
|
multicurrency->enabled)) { $colspan++;?>
- ">
+ ">
|
- ">
+ ">
|
- ">
+ | ">
|
global->PRODUCT_USE_UNITS)
@@ -281,7 +281,7 @@ else {
print '';
}
?>
- remise_percent); ?>">% |
+ remise_percent); ?>">% |
situation_cycle_ref) {
$coldisplay++;
@@ -296,7 +296,7 @@ else {
- ">
+ ">
global->DISPLAY_MARGIN_RATES))
{
- echo '% | ';
+ echo '% | ';
$coldisplay++;
}
if (! empty($conf->global->DISPLAY_MARK_RATES))
{
- echo '% | ';
+ echo '% | ';
$coldisplay++;
}
}
diff --git a/htdocs/core/tpl/objectline_edit.tpl.php b/htdocs/core/tpl/objectline_edit.tpl.php
index 74c6bdd4211..e684e3c2750 100644
--- a/htdocs/core/tpl/objectline_edit.tpl.php
+++ b/htdocs/core/tpl/objectline_edit.tpl.php
@@ -185,7 +185,7 @@ $coldisplay=-1; // We remove first td
rights->margins->creer) {
if (! empty($conf->global->DISPLAY_MARGIN_RATES))
{
- $margin_rate = (isset($_POST["np_marginRate"])?$_POST["np_marginRate"]:(($line->pa_ht == 0)?'':price($line->marge_tx)));
+ $margin_rate = (isset($_POST["np_marginRate"])?GETPOST("np_marginRate","alpha",2):(($line->pa_ht == 0)?'':price($line->marge_tx)));
// if credit note, dont allow to modify margin
if ($line->subprice < 0)
echo ''.$margin_rate.'% | ';
@@ -195,7 +195,7 @@ $coldisplay=-1; // We remove first td
}
elseif (! empty($conf->global->DISPLAY_MARK_RATES))
{
- $mark_rate = (isset($_POST["np_markRate"])?$_POST["np_markRate"]:price($line->marque_tx));
+ $mark_rate = (isset($_POST["np_markRate"])?GETPOST("np_markRate",'alpha',2):price($line->marque_tx));
// if credit note, dont allow to modify margin
if ($line->subprice < 0)
echo ''.$mark_rate.'% | ';
diff --git a/htdocs/expensereport/synchro_compta.php b/htdocs/expensereport/synchro_compta.php
deleted file mode 100644
index eba616d2620..00000000000
--- a/htdocs/expensereport/synchro_compta.php
+++ /dev/null
@@ -1,216 +0,0 @@
-
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see .
- */
-
-require '../main.inc.php';
-require_once DOL_DOCUMENT_ROOT . '/compta/bank/class/account.class.php';
-require_once DOL_DOCUMENT_ROOT . '/expensereport/class/expensereport.class.php';
-
-$langs->load("companies");
-$langs->load("users");
-$langs->load("trips");
-$langs->load("banks");
-
-$idAccount=isset($_GET["account"])?$_GET["account"]:$_POST["account"];
-
-if ($_GET["action"] == 'confirm_ndf_to_account' && $_GET["confirm"] == "yes"):
-
- $idTrip = $_GET['idTrip'];
-
- $expensereport = new ExpenseReport($db);
- $expensereport->fetch($idTrip,$user);
-
- $dateop = dol_mktime(12,0,0,$datePaiement[1],$datePaiement[2],$datePaiement[0]);
- $operation = $expensereport->code_paiement;
- $label = "Règlement ".$expensereport->ref;
- $amount = - price2num($expensereport->total_ttc);
- $num_chq = '';
- $cat1 = '';
-
- $user = new User($db);
- $user->fetch($user->id);
-
- $acct=new Account($db,$idAccount);
- $insertid = $acct->addline($dateop, $operation, $label, $amount, $num_chq, $cat1, $user);
-
- if ($insertid > 0):
- $sql = " UPDATE ".MAIN_DB_PREFIX."expensereport as d";
- $sql.= " SET integration_compta = 1, fk_bank_account = $idAccount";
- $sql.= " WHERE rowid = $idTrip";
- $resql=$db->query($sql);
- if($result):
- Header("Location: ".$_SERVER["PHP_SELF"]."?account=".$idAccount);
- exit;
- else:
- dol_print_error($db);
- endif;
- else:
- dol_print_error($db,$acct->error);
- endif;
-endif;
-
-if ($_GET["action"] == 'confirm_account_to_ndf' && $_GET["confirm"] == "yes"):
-
- $idTrip = $_GET['idTrip'];
-
- $expensereport = new ExpenseReport($db);
- $expensereport->fetch($idTrip,$user);
-
- $sql = "DELETE FROM ".MAIN_DB_PREFIX."bank";
- $sql.= " WHERE label LIKE '%".$expensereport->ref."%'";
- $resql=$db->query($sql);
- if ($resql > 0):
- $sql = " UPDATE ".MAIN_DB_PREFIX."expensereport as d";
- $sql.= " SET integration_compta = 0, fk_bank_account = 0";
- $sql.= " WHERE rowid = $idTrip";
- $resql=$db->query($sql);
- if($result):
- Header("Location: ".$_SERVER["PHP_SELF"]."?account=".$idAccount);
- exit;
- else:
- dol_print_error($db);
- endif;
- else:
- dol_print_error($db);
- endif;
-endif;
-
-
-/*
- * Actions
- */
-
-llxHeader();
-
-$html = new Form($db);
-
-$submit = isset($_POST['submit'])?true:false;
-$idAccount=isset($_GET["account"])?$_GET["account"]:$_POST["account"];
-
-print load_fiche_titre($langs->trans("TripSynch"));
-
-
-dol_fiche_head('');
-
-
-if ($_GET["action"] == 'ndfTOaccount'):
- $idTrip = $_GET['idTrip'];
- $ret=$html->form_confirm($_SERVER["PHP_SELF"]."?idTrip=".$idTrip."&account=".$idAccount,$langs->trans("ndfToAccount"),$langs->trans("ConfirmNdfToAccount"),"confirm_ndf_to_account","","",1);
- if ($ret == 'html') print '
';
-endif;
-
-if ($_GET["action"] == 'accountTOndf'):
- $idTrip = $_GET['idTrip'];
- $ret=$html->form_confirm($_SERVER["PHP_SELF"]."?idTrip=".$idTrip."&account=".$idAccount,$langs->trans("AccountToNdf"),$langs->trans("ConfirmAccountToNdf"),"confirm_account_to_ndf","","",1);
- if ($ret == 'html') print '
';
-endif;
-
-if(empty($submit) && empty($idAccount)):
-
- print "";
-
-else:
-
- print "";
-
- $sql = "SELECT d.fk_bank_account, d.ref, d.rowid, d.date_valid, d.fk_user_author, d.total_ttc, d.integration_compta, d.fk_statut";
- $sql.= " ,CONCAT(u.firstname,' ',u.lastname) as declarant_NDF";
- $sql.= " FROM ".MAIN_DB_PREFIX."expensereport as d";
- $sql.= " INNER JOIN ".MAIN_DB_PREFIX."user as u ON d.fk_user_author = u.rowid";
- $sql.= " WHERE d.fk_statut = 6";
- $sql.= ' AND d.entity IN ('.getEntity('expensereport', 1).')';
- $sql.= " ORDER BY d.date_valid DESC";
-
- $resql=$db->query($sql);
- if ($resql):
- $num = $db->num_rows($resql); $i = 0;
- if($num>0):
-
- $account=new Account($db);
- $account->fetch($idAccount);
-
- print '
';
-
- print "";
- print '';
- print '| '.$langs->trans("Ref").' | ';
- print ''.$langs->trans("DateValidation").' | ';
- print ''.$langs->trans("USER_AUTHOR").' | ';
- print ''.$langs->trans("TotalTTC").' | ';
- print 'Actions | ';
- print 'Compte | ';
- print 'Int. | ';
- print '
';
-
- while($i<$num):
- $objp = $db->fetch_object($resql);
- $var=!$var;
- print '';
- print ''.$objp->ref.' | ';
- print ''.dol_print_date($db->jdate($objp->date_valid),'day').' | ';
- print ''.img_object($langs->trans("ShowUser"),"user").' '.$objp->declarant_NDF.' | ';
- print ''.$objp->total_ttc.' '.$langs->trans("EURO").' | ';
-
- if($objp->integration_compta)
- {
- print ' | ';
- }
- else
- {
- print ' | ';
- }
-
- print ''.$account->label.' | ';
-
- if($objp->integration_compta)
- {
- print ' | ';
- }
- else
- {
- print ' | ';
- }
-
- print "";
- $i++;
- endwhile;
-
- print "
";
-
- else:
- print ''.$langs->trans("NoTripToSync").'
';
- endif;
-
- $db->free($resql);
- else:
- dol_print_error($db);
- endif;
-
-endif;
-
-dol_fiche_end();
-
-llxFooter();
-
-$db->close();
\ No newline at end of file
diff --git a/htdocs/fourn/commande/orderstoinvoice.php b/htdocs/fourn/commande/orderstoinvoice.php
index 89f0a942172..1f87cdf5929 100644
--- a/htdocs/fourn/commande/orderstoinvoice.php
+++ b/htdocs/fourn/commande/orderstoinvoice.php
@@ -108,7 +108,7 @@ if (($action == 'create' || $action == 'add') && ! $error) {
$langs->load('products');
$langs->load('main');
if (isset($_GET['orders_to_invoice'])) {
- $orders_id = $_GET['orders_to_invoice'];
+ $orders_id = GETPOST('orders_to_invoice','',1);
$n = count($orders_id);
$i = 0;
@@ -116,7 +116,7 @@ if (($action == 'create' || $action == 'add') && ! $error) {
$_GET['originid'] = $orders_id[0];
}
if (isset($_POST['orders_to_invoice'])) {
- $orders_id = $_POST['orders_to_invoice'];
+ $orders_id = GETPOST('orders_to_invoice','',1);
$nn = count($orders_id);
$ii = 0;
@@ -149,10 +149,10 @@ if (($action == 'create' || $action == 'add') && ! $error) {
$datefacture = dol_mktime(date("h"), date("M"), 0, date("m"), date("d"), date("Y"));
}
if (! $error) {
- $object->ref = $_POST['ref'];
- $object->ref_supplier = $_POST['ref_supplier'];
- $object->socid = $_POST['socid'];
- $object->libelle = $_POST['libelle'];
+ $object->ref = GETPOST('ref');
+ $object->ref_supplier = GETPOST('ref_supplier');
+ $object->socid = GETPOST('socid','int');
+ $object->libelle = GETPOST('libelle');
$object->date = $datefacture;
$object->date_echeance = $datedue;
$object->note_public = GETPOST('note_public');
@@ -178,7 +178,7 @@ if (($action == 'create' || $action == 'add') && ! $error) {
foreach ( $orders_id as $origin => $origin_id ) {
$origin_id = (! empty($origin_id) ? $origin_id : $orders_id[$ii]);
- $object->add_object_linked($_POST['origin'], $origin_id);
+ $object->add_object_linked(GETPOST('origin'), $origin_id);
}
while ( $ii < $nn ) {
@@ -321,7 +321,7 @@ if ($action == 'create' && !$error) {
print '| ' . $langs->trans('Ref') . ' | ' . $langs->trans('Draft') . ' |
';
// Ref supplier
- print '| ' . $langs->trans('RefSupplier') . ' | | ';
+ print '
| ' . $langs->trans('RefSupplier') . ' | | ';
print '
';
// Third party
@@ -387,7 +387,7 @@ if ($action == 'create' && !$error) {
print '';
print '| ' . $langs->trans('NotePublic') . ' | ';
print '';
- print ' |