lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: check only POST

Browse Source
This commit is contained in:
Regis Houssin 2012-03-18 15:20:25 +01:00
parent 05a5a0fc9a
commit f66236af81
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
htdocs/core/ajax/saveinplace.php
View File

@ -30,10 +30,10 @@ if (! defined('NOREQUIRESOC')) define('NOREQUIRESOC','1');
require('../../main.inc.php'); require('../../main.inc.php');
require_once(DOL_DOCUMENT_ROOT."/core/class/genericobject.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/genericobject.class.php");
$field = GETPOST('field','alpha'); $field = GETPOST('field','alpha',2);
$element = GETPOST('element','alpha'); $element = GETPOST('element','alpha',2);
$table_element = GETPOST('table_element','alpha'); $table_element = GETPOST('table_element','alpha',2);
$fk_element = GETPOST('fk_element','alpha'); $fk_element = GETPOST('fk_element','alpha',2);
/* /*
* View * View
@ -47,11 +47,11 @@ top_httphead();
// Load original field value // Load original field value
if (! empty($field) && ! empty($element) && ! empty($table_element) && ! empty($fk_element)) if (! empty($field) && ! empty($element) && ! empty($table_element) && ! empty($fk_element))
{ {
$ext_element = GETPOST('ext_element','alpha'); $ext_element = GETPOST('ext_element','alpha',2);
$field = substr($field, 8); // remove prefix val_ $field = substr($field, 8); // remove prefix val_
$type = GETPOST('type','alpha'); $type = GETPOST('type','alpha',2);
$value = ($type == 'ckeditor' ? GETPOST('value') : GETPOST('value','alpha')); $value = ($type == 'ckeditor' ? GETPOST('value',2) : GETPOST('value','alpha',2));
$savemethod = GETPOST('savemethod','alpha'); $savemethod = GETPOST('savemethod','alpha',2);
$savemethodname = (! empty($savemethod) ? $savemethod : 'setValueFrom'); $savemethodname = (! empty($savemethod) ? $savemethod : 'setValueFrom');
$view=''; $view='';
@ -98,7 +98,7 @@ if (! empty($field) && ! empty($element) && ! empty($table_element) && ! empty($
} }
else if ($type == 'datepicker') else if ($type == 'datepicker')
{ {
$timestamp = GETPOST('timestamp','int'); $timestamp = GETPOST('timestamp','int',2);
$format = 'date'; $format = 'date';
$newvalue = ($timestamp / 1000); $newvalue = ($timestamp / 1000);
} }