lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Sanitize data

Browse Source
This commit is contained in:
simnandez 2012-03-29 17:04:10 +01:00
parent d8ea1526b3
commit f2e7afafd3
4 changed files with 24 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
htdocs/admin/barcode.php
View File

@ -2,6 +2,7 @@
/* Copyright (C) 2003-2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2003-2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis@dolibarr.fr> * Copyright (C) 2005-2009 Regis Houssin <regis@dolibarr.fr>
* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -31,7 +32,7 @@ $langs->load("admin");
if (!$user->admin) accessforbidden(); if (!$user->admin) accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','alpha');
/* /*
@ -40,8 +41,8 @@ $action = GETPOST("action");
if ($action == 'setcoder') if ($action == 'setcoder')
{ {
$coder = GETPOST("coder"); $coder = GETPOST('coder','alpha');
$code_id = GETPOST("code_id"); $code_id = GETPOST('code_id','alpha');
$sqlp = "UPDATE ".MAIN_DB_PREFIX."c_barcode_type"; $sqlp = "UPDATE ".MAIN_DB_PREFIX."c_barcode_type";
$sqlp.= " SET coder = '" . $coder."'"; $sqlp.= " SET coder = '" . $coder."'";
$sqlp.= " WHERE rowid = ". $code_id; $sqlp.= " WHERE rowid = ". $code_id;
@ -52,17 +53,17 @@ if ($action == 'setcoder')
} }
else if ($action == 'setgenbarcodelocation') else if ($action == 'setgenbarcodelocation')
{ {
$location = GETPOST("genbarcodelocation"); $location = GETPOST('genbarcodelocation','alpha');
$res = dolibarr_set_const($db, "GENBARCODE_LOCATION",$location,'chaine',0,'',$conf->entity); $res = dolibarr_set_const($db, "GENBARCODE_LOCATION",$location,'chaine',0,'',$conf->entity);
} }
else if ($action == 'setdefaultbarcodetype') else if ($action == 'setdefaultbarcodetype')
{ {
$coder_id = GETPOST("coder_id"); $coder_id = GETPOST('coder_id','alpha');
$res = dolibarr_set_const($db, "PRODUIT_DEFAULT_BARCODE_TYPE", $coder_id,'chaine',0,'',$conf->entity); $res = dolibarr_set_const($db, "PRODUIT_DEFAULT_BARCODE_TYPE", $coder_id,'chaine',0,'',$conf->entity);
} }
else if ($action == 'GENBARCODE_BARCODETYPE_THIRDPARTY') else if ($action == 'GENBARCODE_BARCODETYPE_THIRDPARTY')
{ {
$coder_id = GETPOST("coder_id"); $coder_id = GETPOST('coder_id','alpha');
$res = dolibarr_set_const($db, "GENBARCODE_BARCODETYPE_THIRDPARTY", $coder_id,'chaine',0,'',$conf->entity); $res = dolibarr_set_const($db, "GENBARCODE_BARCODETYPE_THIRDPARTY", $coder_id,'chaine',0,'',$conf->entity);
} }
/* /*

11
htdocs/admin/fckeditor.php
View File

@ -1,6 +1,7 @@
<?php <?php
/* Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net> /* Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2011 Regis Houssin <regis@dolibarr.fr> * Copyright (C) 2005-2011 Regis Houssin <regis@dolibarr.fr>
* Copyright (C) 2012 Juanjo Menent <jmenent@2byte.es>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -30,6 +31,8 @@ require_once(DOL_DOCUMENT_ROOT."/core/class/doleditor.class.php");
$langs->load("admin"); $langs->load("admin");
$langs->load("fckeditor"); $langs->load("fckeditor");
$action = GETPOST('action','alpha');
if (!$user->admin) accessforbidden(); if (!$user->admin) accessforbidden();
// Constante et traduction de la description du module // Constante et traduction de la description du module
@ -62,7 +65,7 @@ $picto = array(
foreach($modules as $const => $desc) foreach($modules as $const => $desc)
{ {
if ($_GET["action"] == 'activate_'.strtolower($const)) if ($action == 'activate_'.strtolower($const))
{ {
dolibarr_set_const($db, "FCKEDITOR_ENABLE_".$const, "1",'chaine',0,'',$conf->entity); dolibarr_set_const($db, "FCKEDITOR_ENABLE_".$const, "1",'chaine',0,'',$conf->entity);
// Si fckeditor est active dans la description produit/service, on l'active dans les formulaires // Si fckeditor est active dans la description produit/service, on l'active dans les formulaires
@ -73,7 +76,7 @@ foreach($modules as $const => $desc)
Header("Location: ".$_SERVER["PHP_SELF"]); Header("Location: ".$_SERVER["PHP_SELF"]);
exit; exit;
} }
if ($_GET["action"] == 'disable_'.strtolower($const)) if ($action == 'disable_'.strtolower($const))
{ {
dolibarr_del_const($db, "FCKEDITOR_ENABLE_".$const,$conf->entity); dolibarr_del_const($db, "FCKEDITOR_ENABLE_".$const,$conf->entity);
Header("Location: ".$_SERVER["PHP_SELF"]); Header("Location: ".$_SERVER["PHP_SELF"]);
@ -81,9 +84,9 @@ foreach($modules as $const => $desc)
} }
} }
if ($_POST["save"]) if (GETPOST('save','alpha'))
{ {
dolibarr_set_const($db, "FCKEDITOR_TEST", $_POST["formtestfield"],'chaine',0,'',$conf->entity); dolibarr_set_const($db, "FCKEDITOR_TEST", GETPOST('formtestfield','alpha'),'chaine',0,'',$conf->entity);
} }

12
htdocs/admin/mailing.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2005-2011 Laurent Destailleur <eldy@users.sourceforge.org> * Copyright (C) 2005-2011 Laurent Destailleur <eldy@users.sourceforge.org>
* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es> * Copyright (C) 2011-2012 Juanjo Menent <jmenent@2byte.es>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -32,7 +32,7 @@ $langs->load("mails");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action = GETPOST("action"); $action = GETPOST('action','alpha');
/* /*
* Actions * Actions
@ -42,8 +42,8 @@ if ($action == 'setvalue' && $user->admin)
{ {
$db->begin(); $db->begin();
$mailfrom = GETPOST("MAILING_EMAIL_FROM"); $mailfrom = GETPOST('MAILING_EMAIL_FROM','alpha');
$mailerror = GETPOST("MAILING_EMAIL_ERRORSTO"); $mailerror = GETPOST('MAILING_EMAIL_ERRORSTO','alpha');
$res=dolibarr_set_const($db, "MAILING_EMAIL_FROM",$mailfrom,'chaine',0,'',$conf->entity); $res=dolibarr_set_const($db, "MAILING_EMAIL_FROM",$mailfrom,'chaine',0,'',$conf->entity);
if (! $res > 0) $error++; if (! $res > 0) $error++;

9
htdocs/bookmarks/admin/bookmark.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2005-2009 Laurent Destailleur <eldy@users.sourceforge.org> * Copyright (C) 2005-2009 Laurent Destailleur <eldy@users.sourceforge.org>
* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es> * Copyright (C) 2011-2012 Juanjo Menent <jmenent@2byte.es>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -30,11 +30,11 @@ $langs->load("admin");
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
$action=GETPOST("action"); $action=GETPOST('action','alpha');
if ($action == 'setvalue') if ($action == 'setvalue')
{ {
$showmenu = GETPOST("BOOKMARKS_SHOW_IN_MENU"); $showmenu = GETPOST('BOOKMARKS_SHOW_IN_MENU','alpha');
$res = dolibarr_set_const($db, "BOOKMARKS_SHOW_IN_MENU",$showmenu,'chaine',0,'',$conf->entity); $res = dolibarr_set_const($db, "BOOKMARKS_SHOW_IN_MENU",$showmenu,'chaine',0,'',$conf->entity);
if (! $res > 0) $error++; if (! $res > 0) $error++;
@ -53,8 +53,7 @@ if ($action == 'setvalue')
/* /*
* * View
*
*/ */
llxHeader(); llxHeader();