[Noalyss-commit] [noalyss] 25/39: Code : not direct access to $_GET Bug : javascript didn't work

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 376aab00b2b490dec471bac65f72a051dc89e16f
Author: Dany De Bontridder <danydb@noalyss.eu>
AuthorDate: Wed Jun 10 10:45:43 2020 +0200

    Code : not direct access to $_GET
    Bug : javascript didn't work
---
 html/recherche.php | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/html/recherche.php b/html/recherche.php
index f9f47c1..f34549a 100644
--- a/html/recherche.php
+++ b/html/recherche.php
@@ -74,7 +74,7 @@ window.onload=function ()
 {
     create_anchor_up();
     init_scroll();
-    sorttable.init
+    sorttable.init();
 }
 </script>
 <?php
@@ -123,10 +123,17 @@ if ( isset ($_GET['viewsearch']))
     /*
      * Export to csv
      */
-    
$r=HtmlInput::get_to_hidden(array('l','date_start','date_end','desc','amount_min','amount_max','qcode','accounting','unpaid','gDossier','ledger_type'));
+    
$r=HtmlInput::get_to_hidden(array('l','date_start','date_end','desc','amount_min','amount_max',
+        'qcode','accounting','unpaid','gDossier','ledger_type'));
     if (isset($_GET['r_jrn'])) {
-      foreach ($_GET['r_jrn'] as $k=>$v)
-       $r.=HtmlInput::hidden('r_jrn['.$k.']',$v);
+        $http=new HttpInput();
+        $a_rjrn=$http->get("r_jrn","array");
+      foreach ($a_rjrn as $k=>$v) {
+          // Protect : check that $k and $v are numeric
+        if (isNumber($k)&&isNumber($v)) {
+            $r.=HtmlInput::hidden('r_jrn['.$k.']',$v);
+        }
+      }
     }
     echo '<form action="export.php" method="get">';
     echo $r;