lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Removed urldecode used on superglobal _GET and _POST and _REQUEST... since they are already decoded by PHP.

Browse Source
This commit is contained in:
Laurent Destailleur 2009-07-22 17:13:59 +00:00
parent 8906d988ed
commit d222a78c62
9 changed files with 21 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/admin/modules.php
View File

@ -30,7 +30,7 @@ require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/lib/admin.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/admin.lib.php");
$mode=isset($_GET["mode"])?$_GET["mode"]:(isset($_SESSION['mode'])?$_SESSION['mode']:0); $mode=isset($_GET["mode"])?$_GET["mode"]:(isset($_SESSION['mode'])?$_SESSION['mode']:0);
$mesg=isset($_GET["mesg"])?urldecode($_GET["mesg"]):""; $mesg=isset($_GET["mesg"])?$_GET["mesg"]:"";
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();

4
htdocs/bookmarks/fiche.php
View File

@ -45,7 +45,7 @@ if ($action == 'add' || $action == 'addproduct' || $action == 'update')
{ {
if ($_POST["cancel"]) if ($_POST["cancel"])
{ {
$urlsource=(! empty($_REQUEST["urlsource"]))?urldecode($_REQUEST["urlsource"]):((! empty($url))?urldecode($url):DOL_URL_ROOT.'/bookmarks/liste.php'); $urlsource=(! empty($_REQUEST["urlsource"]))?$_REQUEST["urlsource"]:((! empty($url))?$url:DOL_URL_ROOT.'/bookmarks/liste.php');
header("Location: ".$urlsource); header("Location: ".$urlsource);
exit; exit;
} }
@ -71,7 +71,7 @@ if ($action == 'add' || $action == 'addproduct' || $action == 'update')
if ($res > 0) if ($res > 0)
{ {
$urlsource=isset($_REQUEST["urlsource"])?urldecode($_REQUEST["urlsource"]):DOL_URL_ROOT.'/bookmarks/liste.php'; $urlsource=isset($_REQUEST["urlsource"])?$_REQUEST["urlsource"]:DOL_URL_ROOT.'/bookmarks/liste.php';
header("Location: ".$urlsource); header("Location: ".$urlsource);
exit; exit;
} }

4
htdocs/comm/propal.php
View File

@ -47,11 +47,11 @@ require_once(DOL_DOCUMENT_ROOT.'/propal.class.php');
require_once(DOL_DOCUMENT_ROOT.'/actioncomm.class.php'); require_once(DOL_DOCUMENT_ROOT.'/actioncomm.class.php');
$sall=isset($_GET["sall"])?$_GET["sall"]:$_POST["sall"]; $sall=isset($_GET["sall"])?$_GET["sall"]:$_POST["sall"];
if (isset($_GET["msg"])) { $mesg=urldecode($_GET["mesg"]); } if (isset($_GET["msg"])) { $mesg=$_GET["mesg"]; }
$year=isset($_GET["year"])?$_GET["year"]:""; $year=isset($_GET["year"])?$_GET["year"]:"";
$month=isset($_GET["month"])?$_GET["month"]:""; $month=isset($_GET["month"])?$_GET["month"]:"";
$socid=isset($_GET['socid'])?$_GET['socid']:$_POST['socid']; $socid=isset($_GET['socid'])?$_GET['socid']:$_POST['socid'];
$mesg=isset($_GET['mesg'])?urldecode($_GET['mesg']):''; $mesg=isset($_GET['mesg'])?$_GET['mesg']:'';
// Security check // Security check
$module='propale'; $module='propale';

2
htdocs/commande/fiche.php
View File

@ -681,7 +681,7 @@ if ($_REQUEST['action'] == 'remove_file')
if ($com->fetch($id)) if ($com->fetch($id))
{ {
$upload_dir = $conf->commande->dir_output . "/"; $upload_dir = $conf->commande->dir_output . "/";
$file = $upload_dir . '/' . urldecode($_GET['file']); $file = $upload_dir . '/' . $_GET['file'];
dol_delete_file($file); dol_delete_file($file);
$mesg = '<div class="ok">'.$langs->trans("FileWasRemoved").'</div>'; $mesg = '<div class="ok">'.$langs->trans("FileWasRemoved").'</div>';
} }

2
htdocs/compta/facture.php
View File

@ -48,7 +48,7 @@ $langs->load('products');
$langs->load('main'); $langs->load('main');
$sall=isset($_GET['sall'])?trim($_GET['sall']):trim($_POST['sall']); $sall=isset($_GET['sall'])?trim($_GET['sall']):trim($_POST['sall']);
$mesg=isset($_GET['mesg'])?urldecode($_GET['mesg']):''; $mesg=isset($_GET['mesg'])?$_GET['mesg']:'';
$projetid=isset($_GET['projetid'])?$_GET['projetid']:0; $projetid=isset($_GET['projetid'])?$_GET['projetid']:0;
// Security check // Security check

2
htdocs/compta/prelevement/liste.php
View File

@ -76,7 +76,7 @@ if ($_GET["search_code"])
if ($_GET["search_societe"]) if ($_GET["search_societe"])
{ {
$sel =urldecode($_GET["search_societe"]); $sel = $_GET["search_societe"];
$sql .= " AND s.nom LIKE '%".$sel."%'"; $sql .= " AND s.nom LIKE '%".$sel."%'";
} }

2
htdocs/contrat/fiche.php
View File

@ -55,7 +55,7 @@ if ($_REQUEST["action"] == 'confirm_active' && $_REQUEST["confirm"] == 'yes' &&
{ {
$contrat = new Contrat($db); $contrat = new Contrat($db);
$contrat->fetch($_GET["id"]); $contrat->fetch($_GET["id"]);
$result = $contrat->active_line($user, $_GET["ligne"], $_GET["date"], $_GET["dateend"], urldecode($_GET["comment"])); $result = $contrat->active_line($user, $_GET["ligne"], $_GET["date"], $_GET["dateend"], $_GET["comment"]);
if ($result > 0) if ($result > 0)
{ {

2
htdocs/fourn/commande/fiche.php
View File

@ -426,7 +426,7 @@ if ($action=='remove_file')
if ($commande->fetch($id)) if ($commande->fetch($id))
{ {
$upload_dir = $conf->commande->dir_output . "/"; $upload_dir = $conf->commande->dir_output . "/";
$file = $upload_dir . '/' . urldecode($_GET['file']); $file = $upload_dir . '/' . $_GET['file'];
dol_delete_file($file); dol_delete_file($file);
$mesg = '<div class="ok">'.$langs->trans("FileWasRemoved").'</div>'; $mesg = '<div class="ok">'.$langs->trans("FileWasRemoved").'</div>';
} }

2
htdocs/includes/modules/expedition/pdf/pdf_expedition_merou.modules.php
View File

@ -483,7 +483,7 @@ Class pdf_expedition_merou extends ModelePdfExpedition
$Out=split("\n",$outputlangs->convToOutputCharset($this->expediteur->adresse)); $Out=split("\n",$outputlangs->convToOutputCharset($this->expediteur->adresse));
for ($i=0;$i<count($Out);$i++) { for ($i=0;$i<count($Out);$i++) {
$pdf->SetXY($blExpX,$Yoff+$blSocY); $pdf->SetXY($blExpX,$Yoff+$blSocY);
$pdf->MultiCell($blW,5,urldecode($Out[$i]), 0, 'L'); $pdf->MultiCell($blW,5,$Out[$i], 0, 'L');
$blSocY+=3; $blSocY+=3;
} }
$pdf->SetXY($blExpX,$Yoff+$blSocY); $pdf->SetXY($blExpX,$Yoff+$blSocY);