lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: ajout d'un jeton alatoire dans les requetes POST

Browse Source
This commit is contained in:
Regis Houssin 2009-05-15 14:41:19 +00:00
parent 8efffebe2e
commit b1e630a3fa
29 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/commande/fiche.php
View File

@ -921,6 +921,7 @@ if ($_GET['action'] == 'create' && $user->rights->commande->creer)
$nbrow=10; $nbrow=10;
print '<form name="crea_commande" action="fiche.php" method="post">'; print '<form name="crea_commande" action="fiche.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="socid" value="'.$soc->id.'">' ."\n"; print '<input type="hidden" name="socid" value="'.$soc->id.'">' ."\n";
print '<input type="hidden" name="remise_percent" value="'.$soc->remise_client.'">'; print '<input type="hidden" name="remise_percent" value="'.$soc->remise_client.'">';
@ -1293,6 +1294,7 @@ else
if ($user->rights->commande->creer && $_GET['action'] == 'RefCustomerOrder') if ($user->rights->commande->creer && $_GET['action'] == 'RefCustomerOrder')
{ {
print '<form action="fiche.php?id='.$id.'" method="post">'; print '<form action="fiche.php?id='.$id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="set_ref_client">'; print '<input type="hidden" name="action" value="set_ref_client">';
print '<input type="text" class="flat" size="20" name="ref_client" value="'.$commande->ref_client.'">'; print '<input type="text" class="flat" size="20" name="ref_client" value="'.$commande->ref_client.'">';
print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">'; print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@ -1367,6 +1369,7 @@ else
if ($_GET['action'] == 'editdate_livraison') if ($_GET['action'] == 'editdate_livraison')
{ {
print '<form name="setdate_livraison" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'" method="post">'; print '<form name="setdate_livraison" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="setdate_livraison">'; print '<input type="hidden" name="action" value="setdate_livraison">';
$html->select_date($commande->date_livraison,'liv_','','','',"setdate_livraison"); $html->select_date($commande->date_livraison,'liv_','','','',"setdate_livraison");
print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">'; print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@ -1669,6 +1672,7 @@ else
if ($_GET['action'] == 'editline' && $user->rights->commande->creer && $_GET['rowid'] == $objp->rowid) if ($_GET['action'] == 'editline' && $user->rights->commande->creer && $_GET['rowid'] == $objp->rowid)
{ {
print '<form action="'.$_SERVER["PHP_SELF"].'#'.$objp->rowid.'" method="post">'; print '<form action="'.$_SERVER["PHP_SELF"].'#'.$objp->rowid.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="updateligne">'; print '<input type="hidden" name="action" value="updateligne">';
print '<input type="hidden" name="id" value="'.$id.'">'; print '<input type="hidden" name="id" value="'.$id.'">';
print '<input type="hidden" name="elrowid" value="'.$_GET['rowid'].'">'; print '<input type="hidden" name="elrowid" value="'.$_GET['rowid'].'">';
@ -1779,6 +1783,7 @@ else
// Add free products/services form // Add free products/services form
print '<form action="fiche.php?id='.$id.'#add" method="post">'; print '<form action="fiche.php?id='.$id.'#add" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="id" value="'.$id.'">'; print '<input type="hidden" name="id" value="'.$id.'">';
print '<input type="hidden" name="action" value="addligne">'; print '<input type="hidden" name="action" value="addligne">';
@ -1848,6 +1853,7 @@ else
print '</tr>'; print '</tr>';
print '<form id="addpredefinedproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$id.'#add" method="post">'; print '<form id="addpredefinedproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$id.'#add" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="id" value="'.$id.'">'; print '<input type="hidden" name="id" value="'.$id.'">';
print '<input type="hidden" name="action" value="addligne">'; print '<input type="hidden" name="action" value="addligne">';

1
htdocs/commande/index.php
View File

@ -66,6 +66,7 @@ print '<tr><td valign="top" width="30%" class="notopnoleft">';
$var=false; $var=false;
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<form method="post" action="liste.php">'; print '<form method="post" action="liste.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchOrder").'</td></tr>'; print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchOrder").'</td></tr>';
print '<tr '.$bc[$var].'><td>'; print '<tr '.$bc[$var].'><td>';
print $langs->trans("Ref").':</td><td><input type="text" class="flat" name="sf_ref" size=18></td><td rowspan="2"><input type="submit" value="'.$langs->trans("Search").'" class="button"></td></tr>'; print $langs->trans("Ref").':</td><td><input type="text" class="flat" name="sf_ref" size=18></td><td rowspan="2"><input type="submit" value="'.$langs->trans("Search").'" class="button"></td></tr>';

1
htdocs/commande/note.php
View File

@ -121,6 +121,7 @@ if ($id > 0 || ! empty($ref))
if ($_GET["action"] == 'edit') if ($_GET["action"] == 'edit')
{ {
print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'">'; print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="update">'; print '<input type="hidden" name="action" value="update">';
print '<textarea name="note_public" cols="80" rows="8">'.$commande->note_public."</textarea><br>"; print '<textarea name="note_public" cols="80" rows="8">'.$commande->note_public."</textarea><br>";
} }

2
htdocs/compta/bank/account.php
View File

@ -331,6 +331,7 @@ if ($account || $_GET["ref"])
if ($user->rights->banque->modifier && $_GET["action"]=='addline') if ($user->rights->banque->modifier && $_GET["action"]=='addline')
{ {
print '<form method="post" action="'.$_SERVER["PHP_SELF"].'">'; print '<form method="post" action="'.$_SERVER["PHP_SELF"].'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="vline" value="' . $vline . '">'; print '<input type="hidden" name="vline" value="' . $vline . '">';
print '<input type="hidden" name="account" value="' . $acct->id . '">'; print '<input type="hidden" name="account" value="' . $acct->id . '">';
@ -395,6 +396,7 @@ if ($account || $_GET["ref"])
print '</td></tr>'; print '</td></tr>';
print '<form action="'.$_SERVER["PHP_SELF"].'" name="search" method="POST">'; print '<form action="'.$_SERVER["PHP_SELF"].'" name="search" method="POST">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="search">'; print '<input type="hidden" name="action" value="search">';
print '<input type="hidden" name="account" value="' . $acct->id . '">'; print '<input type="hidden" name="account" value="' . $acct->id . '">';

1
htdocs/compta/bank/bankid_fr.php
View File

@ -238,6 +238,7 @@ if ($_GET["id"] && $_GET["action"] == 'edit' && $user->rights->banque->configure
if ($message) { print "$message<br>\n"; } if ($message) { print "$message<br>\n"; }
print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$account->id.'" method="post">'; print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$account->id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="update">'; print '<input type="hidden" name="action" value="update">';
print '<input type="hidden" name="id" value="'.$_GET["id"].'">'."\n\n"; print '<input type="hidden" name="id" value="'.$_GET["id"].'">'."\n\n";

1
htdocs/compta/bank/categ.php
View File

@ -89,6 +89,7 @@ print_fiche_titre($langs->trans("Rubriques"));
print '<form method="post" action="categ.php">'; print '<form method="post" action="categ.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print "<input type=\"hidden\" name=\"action\" value=\"add\">"; print "<input type=\"hidden\" name=\"action\" value=\"add\">";
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';

2
htdocs/compta/bank/fiche.php
View File

@ -166,6 +166,7 @@ if ($_GET["action"] == 'create')
if ($message) { print "$message<br>\n"; } if ($message) { print "$message<br>\n"; }
print '<form action="'.$_SERVER["PHP_SELF"].'" name="createbankaccount" method="post">'; print '<form action="'.$_SERVER["PHP_SELF"].'" name="createbankaccount" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="clos" value="0">'; print '<input type="hidden" name="clos" value="0">';
@ -393,6 +394,7 @@ else
if ($message) { print "$message<br>\n"; } if ($message) { print "$message<br>\n"; }
print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$account->id.'" method="post">'; print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$account->id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="update">'; print '<input type="hidden" name="action" value="update">';
print '<input type="hidden" name="id" value="'.$_GET["id"].'">'."\n\n"; print '<input type="hidden" name="id" value="'.$_GET["id"].'">'."\n\n";

1
htdocs/compta/bank/rappro.php
View File

@ -197,6 +197,7 @@ if ($resql)
$var=!$var; $var=!$var;
print "<tr $bc[$var]>"; print "<tr $bc[$var]>";
print '<form method="post" action="rappro.php?account='.$_GET["account"].'">'; print '<form method="post" action="rappro.php?account='.$_GET["account"].'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print "<input type=\"hidden\" name=\"action\" value=\"rappro\">"; print "<input type=\"hidden\" name=\"action\" value=\"rappro\">";
print "<input type=\"hidden\" name=\"account\" value=\"".$_GET["account"]."\">"; print "<input type=\"hidden\" name=\"account\" value=\"".$_GET["account"]."\">";
print "<input type=\"hidden\" name=\"rowid\" value=\"".$objp->rowid."\">"; print "<input type=\"hidden\" name=\"rowid\" value=\"".$objp->rowid."\">";

1
htdocs/compta/bank/search.php
View File

@ -146,6 +146,7 @@ if ($resql)
print "</tr>\n"; print "</tr>\n";
print '<form method="post" action="search.php">'; print '<form method="post" action="search.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';

2
htdocs/compta/commande/fiche.php
View File

@ -161,6 +161,7 @@ if ($id > 0 || ! empty($ref))
if ($user->rights->commande->creer && $_GET['action'] == 'RefCustomerOrder') if ($user->rights->commande->creer && $_GET['action'] == 'RefCustomerOrder')
{ {
print '<form action="fiche.php?id='.$id.'" method="post">'; print '<form action="fiche.php?id='.$id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="set_ref_client">'; print '<input type="hidden" name="action" value="set_ref_client">';
print '<input type="text" class="flat" size="20" name="ref_client" value="'.$commande->ref_client.'">'; print '<input type="text" class="flat" size="20" name="ref_client" value="'.$commande->ref_client.'">';
print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">'; print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@ -235,6 +236,7 @@ if ($id > 0 || ! empty($ref))
if ($_GET['action'] == 'editdate_livraison') if ($_GET['action'] == 'editdate_livraison')
{ {
print '<form name="setdate_livraison" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'" method="post">'; print '<form name="setdate_livraison" action="'.$_SERVER["PHP_SELF"].'?id='.$commande->id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="setdate_livraison">'; print '<input type="hidden" name="action" value="setdate_livraison">';
$html->select_date($commande->date_livraison,'liv_','','','',"setdate_livraison"); $html->select_date($commande->date_livraison,'liv_','','','',"setdate_livraison");
print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">'; print '<input type="submit" class="button" value="'.$langs->trans('Modify').'">';

2
htdocs/compta/dons/fiche.php
View File

@ -212,6 +212,7 @@ if ($_GET["action"] == 'create')
if ($mesg) print '<div class="error">'.$mesg.'</div>'; if ($mesg) print '<div class="error">'.$mesg.'</div>';
print '<form name="add" action="fiche.php" method="post">'; print '<form name="add" action="fiche.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
@ -278,6 +279,7 @@ if ($_GET["rowid"] && $_GET["action"] == 'edit')
dol_fiche_head($head, $hselected, $langs->trans("Ref")); dol_fiche_head($head, $hselected, $langs->trans("Ref"));
print '<form name="update" action="fiche.php" method="post">'; print '<form name="update" action="fiche.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
print '<input type="hidden" name="action" value="update">'; print '<input type="hidden" name="action" value="update">';

5
htdocs/compta/facture.php
View File

@ -1424,6 +1424,7 @@ if ($_GET['action'] == 'create')
if (empty($cond_reglement_id)) $cond_reglement_id=1; if (empty($cond_reglement_id)) $cond_reglement_id=1;
print '<form name="add" action="'.$_SERVER["PHP_SELF"].'" method="post">'; print '<form name="add" action="'.$_SERVER["PHP_SELF"].'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="socid" value="'.$soc->id.'">' ."\n"; print '<input type="hidden" name="socid" value="'.$soc->id.'">' ."\n";
print '<input name="facnumber" type="hidden" value="provisoire">'; print '<input name="facnumber" type="hidden" value="provisoire">';
@ -2193,6 +2194,7 @@ else
if ($user->rights->facture->creer && $_GET['action'] == 'RefCustomerOrder') if ($user->rights->facture->creer && $_GET['action'] == 'RefCustomerOrder')
{ {
print '<form action="facture.php?facid='.$id.'" method="post">'; print '<form action="facture.php?facid='.$id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="set_ref_client">'; print '<input type="hidden" name="action" value="set_ref_client">';
print '<input type="text" class="flat" size="20" name="ref_client" value="'.$fac->ref_client.'">'; print '<input type="text" class="flat" size="20" name="ref_client" value="'.$fac->ref_client.'">';
print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">'; print ' <input type="submit" class="button" value="'.$langs->trans('Modify').'">';
@ -2890,6 +2892,7 @@ else
if ($_GET['action'] == 'editline' && $user->rights->facture->creer && $_GET['rowid'] == $objp->rowid) if ($_GET['action'] == 'editline' && $user->rights->facture->creer && $_GET['rowid'] == $objp->rowid)
{ {
print '<form name="updateligne" action="'.$_SERVER["PHP_SELF"].'#'.$objp->rowid.'" method="post">'; print '<form name="updateligne" action="'.$_SERVER["PHP_SELF"].'#'.$objp->rowid.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="updateligne">'; print '<input type="hidden" name="action" value="updateligne">';
print '<input type="hidden" name="facid" value="'.$fac->id.'">'; print '<input type="hidden" name="facid" value="'.$fac->id.'">';
print '<input type="hidden" name="rowid" value="'.$_GET['rowid'].'">'; print '<input type="hidden" name="rowid" value="'.$_GET['rowid'].'">';
@ -3003,6 +3006,7 @@ else
// Add free products/services form // Add free products/services form
print '<form name="addligne" action="'.$_SERVER['PHP_SELF'].'#add" method="post">'; print '<form name="addligne" action="'.$_SERVER['PHP_SELF'].'#add" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="facid" value="'.$fac->id.'">'; print '<input type="hidden" name="facid" value="'.$fac->id.'">';
print '<input type="hidden" name="action" value="addligne">'; print '<input type="hidden" name="action" value="addligne">';
@ -3071,6 +3075,7 @@ else
print '</tr>'; print '</tr>';
print '<form id="addpredefinedproduct" action="'.$_SERVER['PHP_SELF'].'#add" method="post">'; print '<form id="addpredefinedproduct" action="'.$_SERVER['PHP_SELF'].'#add" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="facid" value="'.$fac->id.'">'; print '<input type="hidden" name="facid" value="'.$fac->id.'">';
print '<input type="hidden" name="action" value="addligne_predef">'; print '<input type="hidden" name="action" value="addligne_predef">';

1
htdocs/compta/facture/apercu.php
View File

@ -117,6 +117,7 @@ if ($_GET["facid"] > 0)
if ($fac->brouillon == 1 && $user->rights->facture->creer) if ($fac->brouillon == 1 && $user->rights->facture->creer)
{ {
print '<form action="facture.php?facid='.$fac->id.'" method="post">'; print '<form action="facture.php?facid='.$fac->id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="setremise">'; print '<input type="hidden" name="action" value="setremise">';
print '<td colspan="3"><input type="text" name="remise" size="1" value="'.$fac->remise_percent.'">% '; print '<td colspan="3"><input type="text" name="remise" size="1" value="'.$fac->remise_percent.'">% ';
print '<input type="submit" class="button" value="'.$langs->trans('Modify').'"></td>'; print '<input type="submit" class="button" value="'.$langs->trans('Modify').'"></td>';

2
htdocs/compta/facture/contact.php
View File

@ -207,6 +207,7 @@ if ($id > 0)
$var = false; $var = false;
print '<form action="contact.php?facid='.$id.'" method="post">'; print '<form action="contact.php?facid='.$id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="addcontact">'; print '<input type="hidden" name="action" value="addcontact">';
print '<input type="hidden" name="source" value="internal">'; print '<input type="hidden" name="source" value="internal">';
print '<input type="hidden" name="id" value="'.$id.'">'; print '<input type="hidden" name="id" value="'.$id.'">';
@ -236,6 +237,7 @@ if ($id > 0)
print '</form>'; print '</form>';
print '<form action="contact.php?facid='.$id.'" method="post">'; print '<form action="contact.php?facid='.$id.'" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="addcontact">'; print '<input type="hidden" name="action" value="addcontact">';
print '<input type="hidden" name="source" value="external">'; print '<input type="hidden" name="source" value="external">';
print '<input type="hidden" name="id" value="'.$id.'">'; print '<input type="hidden" name="id" value="'.$id.'">';

1
htdocs/compta/facture/fiche-rec.php
View File

@ -110,6 +110,7 @@ if ($_GET["action"] == 'create')
if ($facture->fetch($_GET["facid"]) > 0) if ($facture->fetch($_GET["facid"]) > 0)
{ {
print '<form action="fiche-rec.php" method="post">'; print '<form action="fiche-rec.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="facid" value="'.$facture->id.'">'; print '<input type="hidden" name="facid" value="'.$facture->id.'">';

1
htdocs/compta/facture/impayees.php
View File

@ -308,6 +308,7 @@ if ($result)
$total_payed=0; $total_payed=0;
print '<form id="form_generate_pdf" method="post" action="'.$_SERVER["PHP_SELF"].'?sortfield='. $_GET['sortfield'] .'&sortorder='. $_GET['sortorder'] .'">'; print '<form id="form_generate_pdf" method="post" action="'.$_SERVER["PHP_SELF"].'?sortfield='. $_GET['sortfield'] .'&sortorder='. $_GET['sortorder'] .'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
while ($i < $num) while ($i < $num)
{ {

2
htdocs/compta/facture/note.php
View File

@ -117,6 +117,7 @@ if ($_GET["facid"])
if ($_GET["action"] == 'edit') if ($_GET["action"] == 'edit')
{ {
print '<form method="post" action="note.php?facid='.$fac->id.'">'; print '<form method="post" action="note.php?facid='.$fac->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="update_public">'; print '<input type="hidden" name="action" value="update_public">';
print '<textarea name="note_public" cols="80" rows="8">'.$fac->note_public."</textarea><br>"; print '<textarea name="note_public" cols="80" rows="8">'.$fac->note_public."</textarea><br>";
print '<input type="submit" class="button" value="'.$langs->trans("Save").'">'; print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
@ -136,6 +137,7 @@ if ($_GET["facid"])
if ($_GET["action"] == 'edit') if ($_GET["action"] == 'edit')
{ {
print '<form method="post" action="note.php?facid='.$fac->id.'">'; print '<form method="post" action="note.php?facid='.$fac->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="update">'; print '<input type="hidden" name="action" value="update">';
print '<textarea name="note" cols="80" rows="8">'.$fac->note."</textarea><br>"; print '<textarea name="note" cols="80" rows="8">'.$fac->note."</textarea><br>";
print '<input type="submit" class="button" value="'.$langs->trans("Save").'">'; print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';

2
htdocs/compta/index.php
View File

@ -115,6 +115,7 @@ $max=3;
if ($conf->facture->enabled && $user->rights->facture->lire) if ($conf->facture->enabled && $user->rights->facture->lire)
{ {
print '<form method="post" action="'.DOL_URL_ROOT.'/compta/facture.php">'; print '<form method="post" action="'.DOL_URL_ROOT.'/compta/facture.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print "<tr class=\"liste_titre\">"; print "<tr class=\"liste_titre\">";
print '<td colspan="3">'.$langs->trans("SearchACustomerInvoice").'</td></tr>'; print '<td colspan="3">'.$langs->trans("SearchACustomerInvoice").'</td></tr>';
@ -128,6 +129,7 @@ if ($conf->facture->enabled && $user->rights->facture->lire)
if ($conf->fournisseur->enabled && $user->rights->fournisseur->lire) if ($conf->fournisseur->enabled && $user->rights->fournisseur->lire)
{ {
print '<form method="post" action="'.DOL_URL_ROOT.'/fourn/facture/index.php">'; print '<form method="post" action="'.DOL_URL_ROOT.'/fourn/facture/index.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchASupplierInvoice").'</td></tr>'; print '<tr class="liste_titre"><td colspan="3">'.$langs->trans("SearchASupplierInvoice").'</td></tr>';
print "<tr ".$bc[0].">"; print "<tr ".$bc[0].">";

1
htdocs/compta/paiement.php
View File

@ -266,6 +266,7 @@ if ($_GET['action'] == 'create' || $_POST['action'] == 'confirm_paiement' || $_P
} }
print '<form name="add_paiement" action="paiement.php" method="post">'; print '<form name="add_paiement" action="paiement.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add_paiement">'; print '<input type="hidden" name="action" value="add_paiement">';
print '<input type="hidden" name="facid" value="'.$facture->id.'">'; print '<input type="hidden" name="facid" value="'.$facture->id.'">';
print '<input type="hidden" name="socid" value="'.$facture->socid.'">'; print '<input type="hidden" name="socid" value="'.$facture->socid.'">';

1
htdocs/compta/paiement/rapport.php
View File

@ -89,6 +89,7 @@ print_fiche_titre($titre);
// Formulaire de génération // Formulaire de génération
print '<form method="post" action="rapport.php?year='.$year.'">'; print '<form method="post" action="rapport.php?year='.$year.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="gen">'; print '<input type="hidden" name="action" value="gen">';
$cmonth = date("n", time()); $cmonth = date("n", time());
$syear = date("Y", time()); $syear = date("Y", time());

1
htdocs/compta/paiement_charge.php
View File

@ -172,6 +172,7 @@ if ($_GET["action"] == 'create')
} }
print '<form name="add_paiement" action="paiement_charge.php" method="post">'; print '<form name="add_paiement" action="paiement_charge.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print "<input type=\"hidden\" name=\"id\" value=\"$charge->id\">"; print "<input type=\"hidden\" name=\"id\" value=\"$charge->id\">";
print '<input type="hidden" name="action" value="add_paiement">'; print '<input type="hidden" name="action" value="add_paiement">';

1
htdocs/compta/param/comptes/fiche.php
View File

@ -78,6 +78,7 @@ if ($_GET["action"] == 'create' && $user->rights->compta->ventilation->parametre
print_fiche_titre($langs->trans("NewAccount")); print_fiche_titre($langs->trans("NewAccount"));
print '<form action="fiche.php" method="post">'; print '<form action="fiche.php" method="post">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="type" value="'.$_GET["type"].'">'."\n"; print '<input type="hidden" name="type" value="'.$_GET["type"].'">'."\n";

1
htdocs/compta/param/comptes/index.php
View File

@ -57,6 +57,7 @@ print '<tr><td valign="top" width="30%" class="notopnoleft">';
* Zone recherche facture * Zone recherche facture
*/ */
print '<form method="post" action="facture.php">'; print '<form method="post" action="facture.php">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print "<tr class=\"liste_titre\">"; print "<tr class=\"liste_titre\">";

2
htdocs/compta/prelevement/config.php
View File

@ -74,6 +74,7 @@ print "<br>";
if ($user->rights->prelevement->bons->configurer) if ($user->rights->prelevement->bons->configurer)
print '<form method="post" action="config.php?action=set">'; print '<form method="post" action="config.php?action=set">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
@ -193,6 +194,7 @@ if ($conf->global->MAIN_MODULE_NOTIFICATION)
if ($user->rights->prelevement->bons->configurer) if ($user->rights->prelevement->bons->configurer)
print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?action=addnotif">'; print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?action=addnotif">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';

2
htdocs/compta/prelevement/fiche.php
View File

@ -195,6 +195,7 @@ if ($_GET["id"])
if($bon->date_trans == 0) if($bon->date_trans == 0)
{ {
print '<form method="post" name="userfile" action="fiche.php?id='.$bon->id.'" enctype="multipart/form-data">'; print '<form method="post" name="userfile" action="fiche.php?id='.$bon->id.'" enctype="multipart/form-data">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="infotrans">'; print '<input type="hidden" name="action" value="infotrans">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
print '<tr><td width="20%">Date Transmission</td><td>'; print '<tr><td width="20%">Date Transmission</td><td>';
@ -216,6 +217,7 @@ if ($_GET["id"])
if($bon->date_trans <> 0 && $bon->date_credit == 0) if($bon->date_trans <> 0 && $bon->date_credit == 0)
{ {
print '<form name="infocredit" method="post" action="fiche.php?id='.$bon->id.'">'; print '<form name="infocredit" method="post" action="fiche.php?id='.$bon->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="infocredit">'; print '<input type="hidden" name="action" value="infocredit">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
print '<tr><td width="20%">Crédité le</td><td>'; print '<tr><td width="20%">Crédité le</td><td>';

1
htdocs/compta/prelevement/ligne.php
View File

@ -148,6 +148,7 @@ if ($_GET["id"])
$rej = new RejetPrelevement($db, $user); $rej = new RejetPrelevement($db, $user);
print '<form name="confirm_rejet" method="post" action="ligne.php?id='.$_GET["id"].'">'; print '<form name="confirm_rejet" method="post" action="ligne.php?id='.$_GET["id"].'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="confirm_rejet">'; print '<input type="hidden" name="action" value="confirm_rejet">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
print '<tr><td colspan="3">Rejet de prélèvement</td></tr>'; print '<tr><td colspan="3">Rejet de prélèvement</td></tr>';

1
htdocs/compta/sociales/charges.php
View File

@ -181,6 +181,7 @@ if ($_GET["action"] == 'create')
$var=false; $var=false;
print '<form name="charge" method="post" action="'.$_SERVER["PHP_SELF"].'">'; print '<form name="charge" method="post" action="'.$_SERVER["PHP_SELF"].'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
print "<table class=\"noborder\" width=\"100%\">"; print "<table class=\"noborder\" width=\"100%\">";

1
htdocs/compta/ventilation/fiche.php
View File

@ -112,6 +112,7 @@ if($_GET["id"])
if($objp->fk_code_ventilation == 0) if($objp->fk_code_ventilation == 0)
{ {
print '<form action="fiche.php?id='.$_GET["id"].'" method="post">'."\n"; print '<form action="fiche.php?id='.$_GET["id"].'" method="post">'."\n";
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="ventil">'; print '<input type="hidden" name="action" value="ventil">';
} }

1
htdocs/compta/ventilation/fournisseur/fiche.php
View File

@ -101,6 +101,7 @@ if($_GET["id"])
if($objp->fk_code_ventilation == 0) if($objp->fk_code_ventilation == 0)
{ {
print '<form action="fiche.php?id='.$_GET["id"].'" method="post">'."\n"; print '<form action="fiche.php?id='.$_GET["id"].'" method="post">'."\n";
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="ventil">'; print '<input type="hidden" name="action" value="ventil">';
} }