lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix var not sanitized

Browse Source
This commit is contained in:
Laurent Destailleur 2017-05-16 13:27:32 +02:00
parent cc16bb0bef
commit 68e333879f
150 changed files with 261 additions and 248 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/accountancy/admin/account.php
View File

@ -37,7 +37,7 @@ $langs->load("accountancy");
$langs->load("salaries"); $langs->load("salaries");
$mesg = ''; $mesg = '';
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$cancel = GETPOST('cancel'); $cancel = GETPOST('cancel');
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');
$rowid = GETPOST('rowid', 'int'); $rowid = GETPOST('rowid', 'int');

2
htdocs/accountancy/admin/card.php
View File

@ -37,7 +37,7 @@ $langs->load("bills");
$langs->load("accountancy"); $langs->load("accountancy");
$mesg = ''; $mesg = '';
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$backtopage = GETPOST('backtopage'); $backtopage = GETPOST('backtopage');
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');
$rowid = GETPOST('rowid', 'int'); $rowid = GETPOST('rowid', 'int');

2
htdocs/accountancy/admin/categories.php
View File

@ -36,7 +36,7 @@ $mesg = '';
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');
$rowid = GETPOST('rowid', 'int'); $rowid = GETPOST('rowid', 'int');
$cancel = GETPOST('cancel'); $cancel = GETPOST('cancel');
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$cat_id = GETPOST('account_category'); $cat_id = GETPOST('account_category');
$selectcpt = GETPOST('cpt_bk', 'array'); $selectcpt = GETPOST('cpt_bk', 'array');
$cpt_id = GETPOST('cptid'); $cpt_id = GETPOST('cptid');

2
htdocs/accountancy/admin/fiscalyear.php
View File

@ -25,7 +25,7 @@ require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT . '/core/lib/date.lib.php'; require_once DOL_DOCUMENT_ROOT . '/core/lib/date.lib.php';
require_once DOL_DOCUMENT_ROOT . '/core/class/fiscalyear.class.php'; require_once DOL_DOCUMENT_ROOT . '/core/class/fiscalyear.class.php';
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
// Load variable for pagination // Load variable for pagination
$limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit; $limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit;

2
htdocs/accountancy/bookkeeping/card.php
View File

@ -43,7 +43,7 @@ if ($user->societe_id > 0) {
accessforbidden(); accessforbidden();
} }
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$piece_num = GETPOST("piece_num"); $piece_num = GETPOST("piece_num");
$mesg = ''; $mesg = '';

2
htdocs/accountancy/expensereport/index.php
View File

@ -55,7 +55,7 @@ if ($year == 0) {
} }
// Validate History // Validate History
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/accountancy/journal/bankjournal.php
View File

@ -71,7 +71,7 @@ $date_startyear = GETPOST('date_startyear');
$date_endmonth = GETPOST('date_endmonth'); $date_endmonth = GETPOST('date_endmonth');
$date_endday = GETPOST('date_endday'); $date_endday = GETPOST('date_endday');
$date_endyear = GETPOST('date_endyear'); $date_endyear = GETPOST('date_endyear');
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$now = dol_now(); $now = dol_now();

2
htdocs/accountancy/journal/expensereportsjournal.php
View File

@ -58,7 +58,7 @@ $now = dol_now();
if ($user->societe_id > 0) if ($user->societe_id > 0)
accessforbidden(); accessforbidden();
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/accountancy/journal/purchasesjournal.php
View File

@ -57,7 +57,7 @@ $now = dol_now();
if ($user->societe_id > 0) if ($user->societe_id > 0)
accessforbidden(); accessforbidden();
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/accountancy/journal/sellsjournal.php
View File

@ -60,7 +60,7 @@ $now = dol_now();
if ($user->societe_id > 0) if ($user->societe_id > 0)
accessforbidden(); accessforbidden();
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/accountancy/report/result.php
View File

@ -35,7 +35,7 @@ $langs->load("accountancy");
$langs->load("compta"); $langs->load("compta");
$mesg = ''; $mesg = '';
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$cat_id = GETPOST('account_category'); $cat_id = GETPOST('account_category');
$selectcpt = GETPOST('cpt_bk'); $selectcpt = GETPOST('cpt_bk');
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');

2
htdocs/adherents/ldap.php
View File

@ -35,7 +35,7 @@ $langs->load("ldap");
$langs->load("admin"); $langs->load("admin");
$rowid = GETPOST('id','int'); $rowid = GETPOST('id','int');
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
// Protection // Protection
$socid=0; $socid=0;

2
htdocs/adherents/list.php
View File

@ -37,7 +37,7 @@ $langs->load("companies");
// Security check // Security check
$result=restrictedArea($user,'adherent'); $result=restrictedArea($user,'adherent');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$filter=GETPOST("filter"); $filter=GETPOST("filter");
$statut=GETPOST("statut"); $statut=GETPOST("statut");
$search=GETPOST("search"); $search=GETPOST("search");

2
htdocs/admin/clicktodial.php
View File

@ -30,7 +30,7 @@ $langs->load("admin");
if (!$user->admin) accessforbidden(); if (!$user->admin) accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/admin/company.php
View File

@ -36,7 +36,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$langs->load("admin"); $langs->load("admin");
$langs->load("companies"); $langs->load("companies");

2
htdocs/admin/events.php
View File

@ -35,7 +35,7 @@ $langs->load("users");
$langs->load("admin"); $langs->load("admin");
$langs->load("other"); $langs->load("other");
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$securityevent=new Events($db); $securityevent=new Events($db);

2
htdocs/admin/external_rss.php
View File

@ -38,7 +38,7 @@ if (!$user->admin) accessforbidden();
$def = array(); $def = array();
$lastexternalrss=0; $lastexternalrss=0;
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
/* /*

2
htdocs/admin/geoipmaxmind.php
View File

@ -33,7 +33,7 @@ accessforbidden();
$langs->load("admin"); $langs->load("admin");
$langs->load("errors"); $langs->load("errors");
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/admin/ihm.php
View File

@ -45,7 +45,7 @@ $langs->load("agenda");
if (! $user->admin) accessforbidden(); if (! $user->admin) accessforbidden();
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
if (! defined("MAIN_MOTD")) define("MAIN_MOTD",""); if (! defined("MAIN_MOTD")) define("MAIN_MOTD","");

2
htdocs/admin/ldap.php
View File

@ -36,7 +36,7 @@ $langs->load("admin");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/admin/ldap_contacts.php
View File

@ -38,7 +38,7 @@ $langs->load("errors");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/admin/ldap_groups.php
View File

@ -39,7 +39,7 @@ $langs->load("errors");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/admin/ldap_members.php
View File

@ -39,7 +39,7 @@ $langs->load("errors");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/admin/ldap_users.php
View File

@ -39,7 +39,7 @@ $langs->load("errors");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/admin/mailman.php
View File

@ -41,7 +41,7 @@ if (! $user->admin) accessforbidden();
$type=array('yesno','texte','chaine'); $type=array('yesno','texte','chaine');
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
$testsubscribeemail = GETPOST("testsubscribeemail"); $testsubscribeemail = GETPOST("testsubscribeemail");
$testunsubscribeemail = GETPOST("testunsubscribeemail"); $testunsubscribeemail = GETPOST("testunsubscribeemail");

2
htdocs/admin/menus.php
View File

@ -27,7 +27,7 @@ require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$langs->load("companies"); $langs->load("companies");
$langs->load("products"); $langs->load("products");

2
htdocs/admin/menus/edit.php
View File

@ -43,7 +43,7 @@ foreach($dirmenus as $dirmenu)
$dirsmartphone[]=$dirmenu.'smartphone'; $dirsmartphone[]=$dirmenu.'smartphone';
} }
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$menu_handler_top=$conf->global->MAIN_MENU_STANDARD; $menu_handler_top=$conf->global->MAIN_MENU_STANDARD;
$menu_handler_smartphone=$conf->global->MAIN_MENU_SMARTPHONE; $menu_handler_smartphone=$conf->global->MAIN_MENU_SMARTPHONE;

2
htdocs/admin/notification.php
View File

@ -41,7 +41,7 @@ $langs->load("mails");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/admin/perms.php
View File

@ -32,7 +32,7 @@ $langs->load("admin");
$langs->load("users"); $langs->load("users");
$langs->load("other"); $langs->load("other");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
if (!$user->admin) accessforbidden(); if (!$user->admin) accessforbidden();

2
htdocs/admin/proxy.php
View File

@ -40,7 +40,7 @@ $upload_dir=$conf->admin->dir_temp;
* Actions * Actions
*/ */
if (GETPOST("action") == 'set_proxy') if (GETPOST('action','aZ09') == 'set_proxy')
{ {
if (GETPOST("MAIN_USE_CONNECT_TIMEOUT") && ! is_numeric(GETPOST("MAIN_USE_CONNECT_TIMEOUT"))) if (GETPOST("MAIN_USE_CONNECT_TIMEOUT") && ! is_numeric(GETPOST("MAIN_USE_CONNECT_TIMEOUT")))
{ {

2
htdocs/admin/security.php
View File

@ -27,7 +27,7 @@ require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$langs->load("users"); $langs->load("users");
$langs->load("admin"); $langs->load("admin");

2
htdocs/admin/sms.php
View File

@ -43,7 +43,7 @@ $substitutionarrayfortest=array(
'__FIRSTNAME__' => 'TESTFirstname' '__FIRSTNAME__' => 'TESTFirstname'
); );
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
/* /*

2
htdocs/admin/spip.php
View File

@ -41,7 +41,7 @@ if (! $user->admin) accessforbidden();
$type=array('yesno','texte','chaine'); $type=array('yesno','texte','chaine');
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
/* /*

2
htdocs/admin/syslog.php
View File

@ -35,7 +35,7 @@ $langs->load("admin");
$langs->load("other"); $langs->load("other");
$error=0; $error=0;
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
$syslogModules = array(); $syslogModules = array();
$activeModules = array(); $activeModules = array();

2
htdocs/admin/system/perf.php
View File

@ -33,7 +33,7 @@ $langs->load("other");
if (! $user->admin) if (! $user->admin)
accessforbidden(); accessforbidden();
if (GETPOST('action') == 'donothing') if (GETPOST('action','aZ09') == 'donothing')
{ {
exit; exit;
} }

2
htdocs/admin/system/xcache.php
View File

@ -26,7 +26,7 @@ $langs->load("admin");
if (!$user->admin) accessforbidden(); if (!$user->admin) accessforbidden();
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
/* /*

2
htdocs/api/admin/index.php
View File

@ -34,7 +34,7 @@ $langs->load("admin");
if (! $user->admin) if (! $user->admin)
accessforbidden(); accessforbidden();
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
//Activate ProfId //Activate ProfId
if ($action == 'setproductionmode') if ($action == 'setproductionmode')

2
htdocs/barcode/codeinit.php
View File

@ -38,7 +38,7 @@ $forbarcode=GETPOST('forbarcode');
$fk_barcode_type=GETPOST('fk_barcode_type'); $fk_barcode_type=GETPOST('fk_barcode_type');
$eraseallbarcode=GETPOST('eraseallbarcode'); $eraseallbarcode=GETPOST('eraseallbarcode');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$producttmp=new Product($db); $producttmp=new Product($db);
$thirdpartytmp=new Societe($db); $thirdpartytmp=new Societe($db);

2
htdocs/barcode/printsheet.php
View File

@ -45,7 +45,7 @@ $numberofsticker=GETPOST('numberofsticker','int');
$mesg=''; $mesg='';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$producttmp=new Product($db); $producttmp=new Product($db);
$thirdpartytmp=new Societe($db); $thirdpartytmp=new Societe($db);

2
htdocs/cashdesk/validation_verif.php
View File

@ -34,7 +34,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
$obj_facturation = unserialize($_SESSION['serObjFacturation']); $obj_facturation = unserialize($_SESSION['serObjFacturation']);
unset ($_SESSION['serObjFacturation']); unset ($_SESSION['serObjFacturation']);
$action =GETPOST('action'); $action =GETPOST('action','aZ09');
$bankaccountid=GETPOST('cashdeskbank'); $bankaccountid=GETPOST('cashdeskbank');
switch ($action) switch ($action)

2
htdocs/categories/admin/categorie.php
View File

@ -32,7 +32,7 @@ accessforbidden();
$langs->load("categories"); $langs->load("categories");
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
/* /*
* Actions * Actions

2
htdocs/categories/edit.php
View File

@ -34,7 +34,7 @@ $langs->load("categories");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$ref=GETPOST('ref'); $ref=GETPOST('ref');
$type=GETPOST('type'); $type=GETPOST('type');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
$cancel=GETPOST('cancel'); $cancel=GETPOST('cancel');

2
htdocs/categories/photos.php
View File

@ -39,7 +39,7 @@ $langs->load("bills");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$ref=GETPOST('ref'); $ref=GETPOST('ref');
$type=GETPOST('type'); $type=GETPOST('type');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
if ($id == "") if ($id == "")

2
htdocs/categories/viewcat.php
View File

@ -37,7 +37,7 @@ $langs->load("categories");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$ref=GETPOST('ref'); $ref=GETPOST('ref');
$type=GETPOST('type'); $type=GETPOST('type');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
$removeelem = GETPOST('removeelem','int'); $removeelem = GETPOST('removeelem','int');
$elemid=GETPOST('elemid'); $elemid=GETPOST('elemid');

2
htdocs/collab/index.php
View File

@ -77,7 +77,7 @@ $langs->load("website");
if (! $user->admin) accessforbidden(); if (! $user->admin) accessforbidden();
if (! ((GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))) if (! ((GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)))
{ {
$conf->dol_hide_leftmenu = 1; // Force hide of left menu. $conf->dol_hide_leftmenu = 1; // Force hide of left menu.
} }

2
htdocs/comm/card.php
View File

@ -60,7 +60,7 @@ $id = (GETPOST('socid','int') ? GETPOST('socid','int') : GETPOST('id','int'));
if ($user->societe_id > 0) $id=$user->societe_id; if ($user->societe_id > 0) $id=$user->societe_id;
$result = restrictedArea($user,'societe',$id,'&societe'); $result = restrictedArea($user,'societe',$id,'&societe');
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$mode = GETPOST("mode"); $mode = GETPOST("mode");
$sortfield = GETPOST("sortfield",'alpha'); $sortfield = GETPOST("sortfield",'alpha');

2
htdocs/comm/mailing/advtargetemailing.php
View File

@ -59,7 +59,7 @@ if (! $sortfield)
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');
$rowid = GETPOST('rowid', 'int'); $rowid = GETPOST('rowid', 'int');
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
$search_nom = GETPOST("search_nom"); $search_nom = GETPOST("search_nom");
$search_prenom = GETPOST("search_prenom"); $search_prenom = GETPOST("search_prenom");
$search_email = GETPOST("search_email"); $search_email = GETPOST("search_email");

2
htdocs/comm/mailing/cibles.php
View File

@ -52,7 +52,7 @@ if (! $sortorder) $sortorder="ASC";
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$rowid=GETPOST('rowid','int'); $rowid=GETPOST('rowid','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$search_lastname=GETPOST("search_lastname"); $search_lastname=GETPOST("search_lastname");
$search_firstname=GETPOST("search_firstname"); $search_firstname=GETPOST("search_firstname");
$search_email=GETPOST("search_email"); $search_email=GETPOST("search_email");

2
htdocs/comm/remise.php
View File

@ -52,7 +52,7 @@ if (GETPOST('cancel') && ! empty($backtopage))
exit; exit;
} }
if (GETPOST("action") == 'setremise') if (GETPOST('action','aZ09') == 'setremise')
{ {
$object = new Societe($db); $object = new Societe($db);
$object->fetch($id); $object->fetch($id);

2
htdocs/comm/remx.php
View File

@ -185,7 +185,7 @@ if ($action == 'setremise' && $user->rights->societe->creer)
} }
} }
if (GETPOST("action") == 'confirm_remove' && GETPOST("confirm")=='yes') if (GETPOST('action','aZ09') == 'confirm_remove' && GETPOST("confirm")=='yes')
{ {
//if ($user->rights->societe->creer) //if ($user->rights->societe->creer)
//if ($user->rights->facture->creer) //if ($user->rights->facture->creer)

2
htdocs/commande/customer.php
View File

@ -30,7 +30,7 @@ require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php'; require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php'; require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
// Secrutiy check // Secrutiy check
if ($user->societe_id > 0) if ($user->societe_id > 0)

2
htdocs/commande/document.php
View File

@ -36,7 +36,7 @@ require_once DOL_DOCUMENT_ROOT .'/commande/class/commande.class.php';
$langs->load('companies'); $langs->load('companies');
$langs->load('other'); $langs->load('other');
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$confirm = GETPOST('confirm'); $confirm = GETPOST('confirm');
$id = GETPOST('id','int'); $id = GETPOST('id','int');
$ref = GETPOST('ref'); $ref = GETPOST('ref');

2
htdocs/compta/bank/card.php
View File

@ -46,7 +46,7 @@ $langs->load("categories");
$langs->load("companies"); $langs->load("companies");
$langs->load("compta"); $langs->load("compta");
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$cancel = GETPOST('cancel', 'alpha'); $cancel = GETPOST('cancel', 'alpha');
// Security check // Security check

4
htdocs/compta/bank/categ.php
View File

@ -33,7 +33,7 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/bankcateg.class.php';
$langs->load("banks"); $langs->load("banks");
$langs->load("categories"); $langs->load("categories");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
if (!$user->rights->banque->configurer) if (!$user->rights->banque->configurer)
accessforbidden(); accessforbidden();
@ -108,7 +108,7 @@ if ($result)
print '<tr class="oddeven">'; print '<tr class="oddeven">';
print '<td><a href="'.DOL_URL_ROOT.'/compta/bank/budget.php?bid='.$objp->rowid.'">'.$objp->rowid.'</a></td>'; print '<td><a href="'.DOL_URL_ROOT.'/compta/bank/budget.php?bid='.$objp->rowid.'">'.$objp->rowid.'</a></td>';
if (GETPOST("action") == 'edit' && GETPOST("categid")== $objp->rowid) if (GETPOST('action','aZ09') == 'edit' && GETPOST("categid")== $objp->rowid)
{ {
print "<td colspan=2>"; print "<td colspan=2>";
print '<input type="hidden" name="categid" value="'.$objp->rowid.'">'; print '<input type="hidden" name="categid" value="'.$objp->rowid.'">';

2
htdocs/compta/bank/various_payment/info.php
View File

@ -31,7 +31,7 @@ $langs->load("bills");
$langs->load("salaries"); $langs->load("salaries");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
// Security check // Security check
$socid = GETPOST('socid','int'); $socid = GETPOST('socid','int');

2
htdocs/compta/clients.php
View File

@ -27,7 +27,7 @@ require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php'; require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php'; require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
// Secrutiy check // Secrutiy check
if ($user->societe_id > 0) if ($user->societe_id > 0)

2
htdocs/compta/paiement.php
View File

@ -817,7 +817,7 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie
/** /**
* Show list of payments * Show list of payments
*/ */
if (! GETPOST('action')) if (! GETPOST('action','aZ09'))
{ {
if ($page == -1) $page = 0 ; if ($page == -1) $page = 0 ;
$limit = GETPOST('limit')?GETPOST('limit','int'):$conf->liste_limit; $limit = GETPOST('limit')?GETPOST('limit','int'):$conf->liste_limit;

2
htdocs/compta/paiement/rapport.php
View File

@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
// Security check // Security check
if (! $user->rights->facture->lire) accessforbidden(); if (! $user->rights->facture->lire) accessforbidden();
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$socid=0; $socid=0;
if ($user->societe_id > 0) if ($user->societe_id > 0)

2
htdocs/compta/payment_sc/card.php
View File

@ -38,7 +38,7 @@ $langs->load('companies');
// Security check // Security check
$id=GETPOST("id",'int'); $id=GETPOST("id",'int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
// TODO ajouter regle pour restreindre acces paiement // TODO ajouter regle pour restreindre acces paiement

2
htdocs/compta/salaries/card.php
View File

@ -39,7 +39,7 @@ $langs->load("salaries");
$langs->load('hrm'); $langs->load('hrm');
$id=GETPOST("id",'int'); $id=GETPOST("id",'int');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
// Security check // Security check
$socid = GETPOST("socid","int"); $socid = GETPOST("socid","int");

2
htdocs/compta/salaries/info.php
View File

@ -32,7 +32,7 @@ $langs->load("bills");
$langs->load("salaries"); $langs->load("salaries");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
// Security check // Security check
$socid = GETPOST('socid','int'); $socid = GETPOST('socid','int');

2
htdocs/compta/sociales/card.php
View File

@ -38,7 +38,7 @@ $langs->load("compta");
$langs->load("bills"); $langs->load("bills");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
$projectid = (GETPOST('projectid') ? GETPOST('projectid', 'int') : 0); $projectid = (GETPOST('projectid') ? GETPOST('projectid', 'int') : 0);

2
htdocs/compta/sociales/document.php
View File

@ -40,7 +40,7 @@ $langs->load("compta");
$langs->load("bills"); $langs->load("bills");
$id = GETPOST('id','int'); $id = GETPOST('id','int');
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
$confirm = GETPOST('confirm', 'alpha'); $confirm = GETPOST('confirm', 'alpha');
// Security check // Security check

2
htdocs/compta/sociales/info.php
View File

@ -30,7 +30,7 @@ $langs->load("compta");
$langs->load("bills"); $langs->load("bills");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
// Security check // Security check
$socid = GETPOST('socid','int'); $socid = GETPOST('socid','int');

2
htdocs/compta/tva/info.php
View File

@ -30,7 +30,7 @@ $langs->load("compta");
$langs->load("bills"); $langs->load("bills");
$id=GETPOST('id','int'); $id=GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
// Security check // Security check
$socid = GETPOST('socid','int'); $socid = GETPOST('socid','int');

2
htdocs/contact/document.php
View File

@ -34,7 +34,7 @@ $langs->load("companies");
$langs->load("contact"); $langs->load("contact");
$id = GETPOST('id','int'); $id = GETPOST('id','int');
$action = GETPOST("action"); $action = GETPOST('action','aZ09');
$confirm = GETPOST('confirm', 'alpha'); $confirm = GETPOST('confirm', 'alpha');
$object = new Contact($db); $object = new Contact($db);

2
htdocs/contact/ldap.php
View File

@ -32,7 +32,7 @@ $langs->load("companies");
$langs->load("ldap"); $langs->load("ldap");
$langs->load("admin"); $langs->load("admin");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
// Security check // Security check
$id = GETPOST('id', 'int'); $id = GETPOST('id', 'int');

2
htdocs/contact/note.php
View File

@ -29,7 +29,7 @@ require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/contact.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/contact.lib.php';
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php'; require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
$action = GETPOST('action'); $action = GETPOST('action','aZ09');
$langs->load("companies"); $langs->load("companies");

2
htdocs/core/ajax/ajaxdirpreview.php
View File

@ -40,7 +40,7 @@ if (! isset($mode) || $mode != 'noajax') // For ajax call
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php'; require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$file=urldecode(GETPOST('file')); $file=urldecode(GETPOST('file'));
$section=GETPOST("section"); $section=GETPOST("section");
$module=GETPOST("module"); $module=GETPOST("module");

2
htdocs/core/ajax/bankconciliate.php
View File

@ -31,7 +31,7 @@ require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php'; require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
/* /*

4
htdocs/core/boxes/box_graph_invoices_permonth.php
View File

@ -122,7 +122,7 @@ class box_graph_invoices_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($shownb) if ($shownb)
{ {
$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."invoicesnbinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."invoicesnbinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$endyear.'.png';
@ -162,7 +162,7 @@ class box_graph_invoices_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($showtot) if ($showtot)
{ {
$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."invoicesamountinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."invoicesamountinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$endyear.'.png';

4
htdocs/core/boxes/box_graph_invoices_supplier_permonth.php
View File

@ -121,7 +121,7 @@ class box_graph_invoices_supplier_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($shownb) if ($shownb)
{ {
$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."invoicessuppliernbinyear-".$year.".png"; $filenamenb = $dir."/".$prefix."invoicessuppliernbinyear-".$year.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$year.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$year.'.png';
@ -161,7 +161,7 @@ class box_graph_invoices_supplier_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($showtot) if ($showtot)
{ {
$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."invoicessupplieramountinyear-".$year.".png"; $filenamenb = $dir."/".$prefix."invoicessupplieramountinyear-".$year.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$year.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$year.'.png';

4
htdocs/core/boxes/box_graph_orders_permonth.php
View File

@ -124,7 +124,7 @@ class box_graph_orders_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($shownb) if ($shownb)
{ {
$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."ordersnbinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."ordersnbinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png';
@ -162,7 +162,7 @@ class box_graph_orders_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($showtot) if ($showtot)
{ {
$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."ordersamountinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."ordersamountinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png';

4
htdocs/core/boxes/box_graph_orders_supplier_permonth.php
View File

@ -123,7 +123,7 @@ class box_graph_orders_supplier_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($shownb) if ($shownb)
{ {
$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."orderssuppliernbinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."orderssuppliernbinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png';
@ -161,7 +161,7 @@ class box_graph_orders_supplier_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($showtot) if ($showtot)
{ {
$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$filenamenb = $dir."/".$prefix."orderssupplieramountinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."orderssupplieramountinyear-".$endyear.".png";
if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png'; if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png';

6
htdocs/core/boxes/box_graph_product_distribution.php
View File

@ -139,7 +139,7 @@ class box_graph_product_distribution extends ModeleBoxes
$showpointvalue = 1; $nocolor = 0; $showpointvalue = 1; $nocolor = 0;
$mode='customer'; $mode='customer';
$stats_invoice = new FactureStats($this->db, $socid, $mode, ($userid>0?$userid:0)); $stats_invoice = new FactureStats($this->db, $socid, $mode, ($userid>0?$userid:0));
$data1 = $stats_invoice->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats_invoice->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
if (empty($data1)) if (empty($data1))
{ {
$showpointvalue=0; $showpointvalue=0;
@ -197,7 +197,7 @@ class box_graph_product_distribution extends ModeleBoxes
$showpointvalue = 1; $nocolor = 0; $showpointvalue = 1; $nocolor = 0;
$stats_proposal = new PropaleStats($this->db, $socid, ($userid>0?$userid:0)); $stats_proposal = new PropaleStats($this->db, $socid, ($userid>0?$userid:0));
$data2 = $stats_proposal->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats_proposal->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
if (empty($data2)) if (empty($data2))
{ {
$showpointvalue = 0; $showpointvalue = 0;
@ -259,7 +259,7 @@ class box_graph_product_distribution extends ModeleBoxes
$showpointvalue = 1; $nocolor = 0; $showpointvalue = 1; $nocolor = 0;
$mode='customer'; $mode='customer';
$stats_order = new CommandeStats($this->db, $socid, $mode, ($userid>0?$userid:0)); $stats_order = new CommandeStats($this->db, $socid, $mode, ($userid>0?$userid:0));
$data3 = $stats_order->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data3 = $stats_order->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
if (empty($data3)) if (empty($data3))
{ {
$showpointvalue = 0; $showpointvalue = 0;

4
htdocs/core/boxes/box_graph_propales_permonth.php
View File

@ -121,7 +121,7 @@ class box_graph_propales_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($shownb) if ($shownb)
{ {
$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$datatype1 = array_pad(array(), ($endyear-$startyear+1), 'bars'); $datatype1 = array_pad(array(), ($endyear-$startyear+1), 'bars');
$filenamenb = $dir."/".$prefix."propalsnbinyear-".$endyear.".png"; $filenamenb = $dir."/".$prefix."propalsnbinyear-".$endyear.".png";
@ -160,7 +160,7 @@ class box_graph_propales_permonth extends ModeleBoxes
// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...) // Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
if ($showtot) if ($showtot)
{ {
$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24))); $data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
$datatype2 = array_pad(array(), ($endyear-$startyear+1), 'bars'); $datatype2 = array_pad(array(), ($endyear-$startyear+1), 'bars');
//$datatype2 = array('lines','bars'); //$datatype2 = array('lines','bars');

14
htdocs/core/class/html.form.class.php
View File

@ -110,18 +110,18 @@ class Form
} }
else else
{ {
if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<table class="nobordernopadding" width="100%"><tr><td class="nowrap">'; if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<table class="nobordernopadding" width="100%"><tr><td class="nowrap">';
if ($fieldrequired) $ret.='<span class="fieldrequired">'; if ($fieldrequired) $ret.='<span class="fieldrequired">';
$ret.=$langs->trans($text); $ret.=$langs->trans($text);
if ($fieldrequired) $ret.='</span>'; if ($fieldrequired) $ret.='</span>';
if (! empty($notabletag)) $ret.=' '; if (! empty($notabletag)) $ret.=' ';
if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</td>'; if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</td>';
if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<td align="right">'; if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<td align="right">';
if ($htmlname && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<a href="'.$_SERVER["PHP_SELF"].'?action=edit'.$htmlname.'&amp;id='.$object->id.$moreparam.'">'.img_edit($langs->trans('Edit'), ($notabletag ? 0 : 1)).'</a>'; if ($htmlname && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<a href="'.$_SERVER["PHP_SELF"].'?action=edit'.$htmlname.'&amp;id='.$object->id.$moreparam.'">'.img_edit($langs->trans('Edit'), ($notabletag ? 0 : 1)).'</a>';
if (! empty($notabletag) && $notabletag == 1) $ret.=' : '; if (! empty($notabletag) && $notabletag == 1) $ret.=' : ';
if (! empty($notabletag) && $notabletag == 3) $ret.=' '; if (! empty($notabletag) && $notabletag == 3) $ret.=' ';
if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</td>'; if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</td>';
if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</tr></table>'; if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</tr></table>';
} }
return $ret; return $ret;
@ -159,7 +159,7 @@ class Form
} }
else else
{ {
if (GETPOST('action') == 'edit'.$htmlname) if (GETPOST('action','aZ09') == 'edit'.$htmlname)
{ {
$ret.="\n"; $ret.="\n";
$ret.='<form method="post" action="'.$_SERVER["PHP_SELF"].($moreparam?'?'.$moreparam:'').'">'; $ret.='<form method="post" action="'.$_SERVER["PHP_SELF"].($moreparam?'?'.$moreparam:'').'">';

6
htdocs/core/class/html.formfile.class.php
View File

@ -994,7 +994,7 @@ class FormFile
if (empty($url)) $url=$_SERVER["PHP_SELF"]; if (empty($url)) $url=$_SERVER["PHP_SELF"];
print '<!-- html.formfile::list_of_documents -->'."\n"; print '<!-- html.formfile::list_of_documents -->'."\n";
if (GETPOST('action') == 'editfile' && $permtoeditline) if (GETPOST('action','aZ09') == 'editfile' && $permtoeditline)
{ {
print '<form action="'.$_SERVER["PHP_SELF"].'?'.$param.'" method="POST">'; print '<form action="'.$_SERVER["PHP_SELF"].'?'.$param.'" method="POST">';
print '<input type="hidden" name="action" value="renamefile">'; print '<input type="hidden" name="action" value="renamefile">';
@ -1131,7 +1131,7 @@ class FormFile
print img_mime($file['name'],$file['name'].' ('.dol_print_size($file['size'],0,0).')').' '; print img_mime($file['name'],$file['name'].' ('.dol_print_size($file['size'],0,0).')').' ';
if ($showrelpart == 1) print $relativepath; if ($showrelpart == 1) print $relativepath;
//print dol_trunc($file['name'],$maxlength,'middle'); //print dol_trunc($file['name'],$maxlength,'middle');
if (GETPOST('action') == 'editfile' && $file['name'] == basename(GETPOST('urlfile'))) if (GETPOST('action','aZ09') == 'editfile' && $file['name'] == basename(GETPOST('urlfile')))
{ {
print '</a>'; print '</a>';
print '<input type="hidden" name="renamefilefrom" value="'.dol_escape_htmltag($file['name']).'">'; print '<input type="hidden" name="renamefilefrom" value="'.dol_escape_htmltag($file['name']).'">';
@ -1268,7 +1268,7 @@ class FormFile
} }
} }
if (GETPOST('action') == 'editfile' && $permtoeditline) if (GETPOST('action','aZ09') == 'editfile' && $permtoeditline)
{ {
print '</form>'; print '</form>';
} }

1
htdocs/core/datepicker.php
View File

@ -39,7 +39,6 @@ if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$langs->load("agenda"); $langs->load("agenda");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');

1
htdocs/core/get_menudiv.php
View File

@ -47,7 +47,6 @@ if (! defined('DISABLE_SELECT2')) define('DISABLE_SELECT2',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
$left=($langs->trans("DIRECTION")=='rtl'?'right':'left'); $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');

22
htdocs/core/lib/functions.lib.php
View File

@ -240,7 +240,17 @@ function dol_shutdown()
* Return value of a param into GET or POST supervariable * Return value of a param into GET or POST supervariable
* *
* @param string $paramname Name of parameter to found * @param string $paramname Name of parameter to found
* @param string $check Type of check (''=no check, 'none'=no check, 'int'=check it's numeric, 'alpha'=check it's text and sign, 'aZ'=check it's a-z only, 'array'=check it's array, 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string), 'day', 'month', 'year', 'custom'= custom filter specify $filter and $options) * @param string $check Type of check
* ''=no check (deprecated)
* 'none'=no check (only for param that should have very rich content)
* 'int'=check it's numeric
* 'alpha'=check it's text and sign
* 'aZ'=check it's a-z only
* 'aZ09'=check it's simple alpha string (recommended for keys)
* 'array'=check it's array
* 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string)
* 'nohtml', 'alphanohtml'=check there is no html content
* 'custom'= custom filter specify $filter and $options)
* @param int $method Type of method (0 = get then post, 1 = only get, 2 = only post, 3 = post then get, 4 = post then get then cookie) * @param int $method Type of method (0 = get then post, 1 = only get, 2 = only post, 3 = post then get, 4 = post then get then cookie)
* @param int $filter Filter to apply when $check is set to 'custom'. (See http://php.net/manual/en/filter.filters.php for détails) * @param int $filter Filter to apply when $check is set to 'custom'. (See http://php.net/manual/en/filter.filters.php for détails)
* @param mixed $options Options to pass to filter_var when $check is set to 'custom'. * @param mixed $options Options to pass to filter_var when $check is set to 'custom'.
@ -317,9 +327,14 @@ function GETPOST($paramname, $check='', $method=0, $filter=NULL, $options=NULL)
} }
} }
if (empty($check) && $conf->global->MAIN_FEATURES_LEVEL > 0)
{
dol_syslog("A GETPOST is called with 1st param = ".$paramname." and 2nd param not defined, when calling page ".$_SERVER["PHP_SELF"], LOG_WARNING);
}
if (! empty($check)) if (! empty($check))
{ {
// Replace vars like __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__ // Replace vars like __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__, ...
if (! is_array($out)) if (! is_array($out))
{ {
$maxloop=20; $loopnb=0; // Protection against infinite loop $maxloop=20; $loopnb=0; // Protection against infinite loop
@ -358,8 +373,11 @@ function GETPOST($paramname, $check='', $method=0, $filter=NULL, $options=NULL)
} }
} }
// Check is done after replacement
switch ($check) switch ($check)
{ {
case 'none':
break;
case 'int': case 'int':
if (! is_numeric($out)) { $out=''; } if (! is_numeric($out)) { $out=''; }
break; break;

8
htdocs/core/lib/security.lib.php
View File

@ -98,7 +98,7 @@ function dol_hash($chain,$type=0)
/** /**
* Check permissions of a user to show a page and an object. Check read permission. * Check permissions of a user to show a page and an object. Check read permission.
* If GETPOST('action') defined, we also check write and delete permission. * If GETPOST('action','aZ09') defined, we also check write and delete permission.
* *
* @param User $user User to check * @param User $user User to check
* @param string $features Features to check (it must be module name. Examples: 'societe', 'contact', 'produit&service', 'produit|service', ...) * @param string $features Features to check (it must be module name. Examples: 'societe', 'contact', 'produit&service', 'produit|service', ...)
@ -207,7 +207,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
// Check write permission from module // Check write permission from module
$createok=1; $nbko=0; $createok=1; $nbko=0;
if (GETPOST("action") == 'create') if (GETPOST('action','aZ09') == 'create')
{ {
foreach ($featuresarray as $feature) foreach ($featuresarray as $feature)
{ {
@ -262,7 +262,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
// Check create user permission // Check create user permission
$createuserok=1; $createuserok=1;
if (GETPOST("action") == 'confirm_create_user' && GETPOST("confirm") == 'yes') if (GETPOST('action','aZ09') == 'confirm_create_user' && GETPOST("confirm") == 'yes')
{ {
if (! $user->rights->user->user->creer) $createuserok=0; if (! $user->rights->user->user->creer) $createuserok=0;
@ -272,7 +272,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
// Check delete permission from module // Check delete permission from module
$deleteok=1; $nbko=0; $deleteok=1; $nbko=0;
if ((GETPOST("action") == 'confirm_delete' && GETPOST("confirm") == 'yes') || GETPOST("action") == 'delete') if ((GETPOST('action','aZ09') == 'confirm_delete' && GETPOST("confirm") == 'yes') || GETPOST('action','aZ09') == 'delete')
{ {
foreach ($featuresarray as $feature) foreach ($featuresarray as $feature)
{ {

2
htdocs/core/lib/security2.lib.php
View File

@ -155,7 +155,7 @@ function dol_loginfunction($langs,$conf,$mysoc)
$titletruedolibarrversion=constant('DOL_VERSION'); // $title used by login template after the @ to inform of true Dolibarr version $titletruedolibarrversion=constant('DOL_VERSION'); // $title used by login template after the @ to inform of true Dolibarr version
// Note: $conf->css looks like '/theme/eldy/style.css.php' // Note: $conf->css looks like '/theme/eldy/style.css.php'
$conf->css = "/theme/".(GETPOST('theme')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php"; $conf->css = "/theme/".(GETPOST('theme','alpha')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php";
//$themepath=dol_buildpath((empty($conf->global->MAIN_FORCETHEMEDIR)?'':$conf->global->MAIN_FORCETHEMEDIR).$conf->css,1); //$themepath=dol_buildpath((empty($conf->global->MAIN_FORCETHEMEDIR)?'':$conf->global->MAIN_FORCETHEMEDIR).$conf->css,1);
$themepath=dol_buildpath($conf->css,1); $themepath=dol_buildpath($conf->css,1);
if (! empty($conf->modules_parts['theme'])) // Using this feature slow down application if (! empty($conf->modules_parts['theme'])) // Using this feature slow down application

2
htdocs/core/lib/usergroups.lib.php
View File

@ -417,7 +417,7 @@ function show_theme($fuser,$edit=0,$foruserprofile=false)
$file=$dirtheme."/".$subdir."/thumb.png"; $file=$dirtheme."/".$subdir."/thumb.png";
$url=$urltheme."/".$subdir."/thumb.png"; $url=$urltheme."/".$subdir."/thumb.png";
if (! file_exists($file)) $url=DOL_URL_ROOT.'/public/theme/common/nophoto.png'; if (! file_exists($file)) $url=DOL_URL_ROOT.'/public/theme/common/nophoto.png';
print '<a href="'.$_SERVER["PHP_SELF"].($edit?'?action=edit&theme=':'?theme=').$subdir.(GETPOST("optioncss")?'&optioncss='.GETPOST("optioncss",'alpha',1):'').($fuser?'&id='.$fuser->id:'').'" style="font-weight: normal;" alt="'.$langs->trans("Preview").'">'; print '<a href="'.$_SERVER["PHP_SELF"].($edit?'?action=edit&theme=':'?theme=').$subdir.(GETPOST('optioncss','alpha',1)?'&optioncss='.GETPOST('optioncss','alpha',1):'').($fuser?'&id='.$fuser->id:'').'" style="font-weight: normal;" alt="'.$langs->trans("Preview").'">';
if ($subdir == $conf->global->MAIN_THEME) $title=$langs->trans("ThemeCurrentlyActive"); if ($subdir == $conf->global->MAIN_THEME) $title=$langs->trans("ThemeCurrentlyActive");
else $title=$langs->trans("ShowPreview"); else $title=$langs->trans("ShowPreview");
print '<img src="'.$url.'" border="0" width="80" height="60" alt="'.$title.'" title="'.$title.'" style="margin-bottom: 5px;">'; print '<img src="'.$url.'" border="0" width="80" height="60" alt="'.$title.'" title="'.$title.'" style="margin-bottom: 5px;">';

4
htdocs/core/menus/standard/auguria.lib.php
View File

@ -53,7 +53,7 @@ function print_auguria_menu($db,$atarget,$type_user,&$tabMenu,&$menu,$noout=0,$m
if (empty($noout)) print_start_menu_array_auguria(); if (empty($noout)) print_start_menu_array_auguria();
$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)); $usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
// Show/Hide vertical menu // Show/Hide vertical menu
if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
@ -248,7 +248,7 @@ function print_left_auguria_menu($db,$menu_array_before,$menu_array_after,&$tabM
$mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]); $mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]);
$leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"])); $leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"]));
$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)); $usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
global $usemenuhider; global $usemenuhider;
// Show logo company // Show logo company

4
htdocs/core/menus/standard/eldy.lib.php
View File

@ -51,7 +51,7 @@ function print_eldy_menu($db,$atarget,$type_user,&$tabMenu,&$menu,$noout=0,$mode
if (empty($noout)) print_start_menu_array(); if (empty($noout)) print_start_menu_array();
$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)); $usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
// Show/Hide vertical menu // Show/Hide vertical menu
if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
@ -458,7 +458,7 @@ function print_left_eldy_menu($db,$menu_array_before,$menu_array_after,&$tabMenu
$mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]); $mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]);
$leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"])); $leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"]));
$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)); $usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
// Show logo company // Show logo company
if (empty($conf->global->MAIN_MENU_INVERT) && empty($noout) && ! empty($conf->global->MAIN_SHOW_LOGO) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) if (empty($conf->global->MAIN_MENU_INVERT) && empty($noout) && ! empty($conf->global->MAIN_SHOW_LOGO) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))

2
htdocs/core/menus/standard/empty.php
View File

@ -93,7 +93,7 @@ class MenuManager
$classname='class="tmenusel"'; $classname='class="tmenusel"';
// Show/Hide vertical menu // Show/Hide vertical menu
if ($mode != 'jmobile' && $mode != 'topnb' && (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) if ($mode != 'jmobile' && $mode != 'topnb' && (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
{ {
$showmode=1; $showmode=1;
$classname = 'class="tmenu menuhider"'; $classname = 'class="tmenu menuhider"';

1
htdocs/core/search_page.php
View File

@ -35,7 +35,6 @@ if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
$left=($langs->trans("DIRECTION")=='rtl'?'right':'left'); $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');

2
htdocs/core/tpl/ajaxrow.tpl.php
View File

@ -31,7 +31,7 @@ $forcereloadpage=empty($conf->global->MAIN_FORCE_RELOAD_PAGE)?0:1;
$tagidfortablednd=(empty($tagidfortablednd)?'tablelines':$tagidfortablednd); $tagidfortablednd=(empty($tagidfortablednd)?'tablelines':$tagidfortablednd);
$filepath=(empty($filepath)?'':$filepath); $filepath=(empty($filepath)?'':$filepath);
if (GETPOST('action') != 'editline' && $nboflines > 1) { ?> if (GETPOST('action','aZ09') != 'editline' && $nboflines > 1) { ?>
<script type="text/javascript"> <script type="text/javascript">
$(document).ready(function(){ $(document).ready(function(){
$(".imgupforline").hide(); $(".imgupforline").hide();

4
htdocs/core/tpl/notes.tpl.php
View File

@ -31,7 +31,7 @@ $value_private=$object->note_private;
if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PUBLIC_NOTES)) if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PUBLIC_NOTES))
{ {
$stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --'; $stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --';
if (GETPOST('action') == 'edit'.$note_public) if (GETPOST('action','aZ09') == 'edit'.$note_public)
{ {
$value_public=dol_concatdesc($value_public, ($value_public?"\n":"")."-- ".$stringtoadd); $value_public=dol_concatdesc($value_public, ($value_public?"\n":"")."-- ".$stringtoadd);
if (dol_textishtml($value_public)) $value_public.="<br>\n"; if (dol_textishtml($value_public)) $value_public.="<br>\n";
@ -41,7 +41,7 @@ if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PUBLIC_NOTES))
if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PRIVATE_NOTES)) if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PRIVATE_NOTES))
{ {
$stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --'; $stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --';
if (GETPOST('action') == 'edit'.$note_private) if (GETPOST('action','aZ09') == 'edit'.$note_private)
{ {
$value_private=dol_concatdesc($value_private, ($value_private?"\n":"")."-- ".$stringtoadd); $value_private=dol_concatdesc($value_private, ($value_private?"\n":"")."-- ".$stringtoadd);
if (dol_textishtml($value_private)) $value_private.="<br>\n"; if (dol_textishtml($value_private)) $value_private.="<br>\n";

4
htdocs/document.php
View File

@ -61,7 +61,7 @@ $action=GETPOST('action','alpha');
$original_file=GETPOST('file','alpha'); // Do not use urldecode here ($_GET are already decoded by PHP). $original_file=GETPOST('file','alpha'); // Do not use urldecode here ($_GET are already decoded by PHP).
$modulepart=GETPOST('modulepart','alpha'); $modulepart=GETPOST('modulepart','alpha');
$urlsource=GETPOST('urlsource','alpha'); $urlsource=GETPOST('urlsource','alpha');
$entity=GETPOST('entity')?GETPOST('entity','int'):$conf->entity; $entity=GETPOST('entity','int')?GETPOST('entity','int'):$conf->entity;
// Security check // Security check
if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart'); if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
@ -95,7 +95,7 @@ else $type=dol_mimetype($original_file);
// Define attachment (attachment=true to force choice popup 'open'/'save as') // Define attachment (attachment=true to force choice popup 'open'/'save as')
$attachment = true; $attachment = true;
if (preg_match('/\.(html|htm)$/i',$original_file)) $attachment = false; if (preg_match('/\.(html|htm)$/i',$original_file)) $attachment = false;
if (isset($_GET["attachment"])) $attachment = GETPOST("attachment")?true:false; if (isset($_GET["attachment"])) $attachment = GETPOST("attachment",'alpha')?true:false;
if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false; if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
// Security: Delete string ../ into $original_file // Security: Delete string ../ into $original_file

2
htdocs/don/payment/card.php
View File

@ -34,7 +34,7 @@ $langs->load('companies');
// Security check // Security check
$id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int'); $id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
// TODO Add rule to restrict access payment // TODO Add rule to restrict access payment

4
htdocs/don/payment/payment.php
View File

@ -29,7 +29,7 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
$langs->load("bills"); $langs->load("bills");
$chid=GETPOST("rowid"); $chid=GETPOST("rowid");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$amounts = array(); $amounts = array();
// Security check // Security check
@ -154,7 +154,7 @@ $form=new Form($db);
// Form to create donation payment // Form to create donation payment
if (GETPOST("action") == 'create') if (GETPOST('action','aZ09') == 'create')
{ {
$don = new Don($db); $don = new Don($db);

4
htdocs/ecm/docfile.php
View File

@ -62,7 +62,7 @@ if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="label"; if (! $sortfield) $sortfield="label";
$cancel=GETPOST('cancel'); $cancel=GETPOST('cancel');
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$section=GETPOST("section"); $section=GETPOST("section");
if (! $section) if (! $section)
{ {
@ -221,7 +221,7 @@ while ($tmpecmdir && $result > 0)
print img_picto('','object_dir').' <a href="'.DOL_URL_ROOT.'/ecm/index.php">'.$langs->trans("ECMRoot").'</a> -> '; print img_picto('','object_dir').' <a href="'.DOL_URL_ROOT.'/ecm/index.php">'.$langs->trans("ECMRoot").'</a> -> ';
print $s; print $s;
print ' -> '; print ' -> ';
if (GETPOST('action') == 'edit') print '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfile.'">'; if (GETPOST('action','aZ09') == 'edit') print '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfile.'">';
else print $urlfile; else print $urlfile;
print '</td></tr>'; print '</td></tr>';
/*print '<tr><td class="tdtop">'.$langs->trans("Description").'</td><td>'; /*print '<tr><td class="tdtop">'.$langs->trans("Description").'</td><td>';

2
htdocs/ecm/index.php
View File

@ -49,7 +49,7 @@ $result = restrictedArea($user, 'ecm', 0);
// Get parameters // Get parameters
$socid=GETPOST('socid','int'); $socid=GETPOST('socid','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int"); $section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int");
$module=GETPOST("module"); $module=GETPOST("module");
if (! $section) $section=0; if (! $section) $section=0;

2
htdocs/ecm/index_auto.php
View File

@ -49,7 +49,7 @@ $result = restrictedArea($user, 'ecm', 0);
// Get parameters // Get parameters
$socid=GETPOST('socid','int'); $socid=GETPOST('socid','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int"); $section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int");
$module=GETPOST("module"); $module=GETPOST("module");
if (! $section) $section=0; if (! $section) $section=0;

2
htdocs/expensereport/card.php
View File

@ -45,7 +45,7 @@ $langs->load("trips");
$langs->load("bills"); $langs->load("bills");
$langs->load("mails"); $langs->load("mails");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$cancel=GETPOST('cancel'); $cancel=GETPOST('cancel');
$confirm = GETPOST('confirm', 'alpha'); $confirm = GETPOST('confirm', 'alpha');

2
htdocs/expensereport/payment/card.php
View File

@ -34,7 +34,7 @@ $langs->load('companies');
// Security check // Security check
$id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int'); $id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int');
$action=GETPOST("action"); $action=GETPOST('action','aZ09');
$confirm=GETPOST('confirm'); $confirm=GETPOST('confirm');
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
// TODO Add rule to restrict access payment // TODO Add rule to restrict access payment

4
htdocs/expensereport/payment/payment.php
View File

@ -31,7 +31,7 @@ $langs->load("bills");
$langs->load("banks"); $langs->load("banks");
$chid=GETPOST("id"); $chid=GETPOST("id");
$action=GETPOST('action'); $action=GETPOST('action','aZ09');
$amounts = array(); $amounts = array();
$accountid=GETPOST('accountid','int'); $accountid=GETPOST('accountid','int');
@ -174,7 +174,7 @@ $form=new Form($db);
// Form to create expense report payment // Form to create expense report payment
if (GETPOST("action") == 'create') if (GETPOST('action','aZ09') == 'create')
{ {
$expensereport = new ExpenseReport($db); $expensereport = new ExpenseReport($db);
$expensereport->fetch($chid); $expensereport->fetch($chid);

2
htdocs/externalsite/frames.php
View File

@ -38,7 +38,7 @@ $mainmenu=GETPOST('mainmenu', 'alpha');
$leftmenu=GETPOST('leftmenu', 'alpha'); $leftmenu=GETPOST('leftmenu', 'alpha');
$idmenu=GETPOST('idmenu', 'int'); $idmenu=GETPOST('idmenu', 'int');
$theme=GETPOST('theme', 'alpha'); $theme=GETPOST('theme', 'alpha');
$codelang=GETPOST('lang', 'alpha'); $codelang=GETPOST('lang', 'aZ09');
print " print "
<html> <html>

Some files were not shown because too many files have changed in this diff Show More