[Noalyss-commit] [noalyss] 05/27: Security : avoid direct call to Http Variable

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 4a637a0e87c9d9b847aaea285695d1ba102771fa
Author: Dany De Bontridder <address@hidden>
Date:   Tue Aug 27 18:53:31 2019 +0200

    Security : avoid direct call to Http Variable
---
 include/history_operation.inc.php | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/include/history_operation.inc.php 
b/include/history_operation.inc.php
index 3a0ceb7..420a324 100644
--- a/include/history_operation.inc.php
+++ b/include/history_operation.inc.php
@@ -142,13 +142,16 @@ $r = HtmlInput::get_to_hidden(array('search_opnb_jrn',
     'search_opr_jrn'));
 if (isset($_GET['r_jrn']))
 {
-    foreach ($_GET['r_jrn'] as $k => $v)
-        $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
+    $a_rjn=$http->get('r_jrn','array');
+    foreach ($a_rjn as $k => $v) {
+      if (isNumber($v))  $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
+    }
 }
 if (isset($_GET['search_opr_jrn']))
 {
-    foreach ($_GET['search_opr_jrn'] as $k => $v)
-        $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
+     $a_search_opr_jrn=$http->get('search_opr_jrn','array');
+    foreach ($a_search_opr_jrn as $k => $v)
+          if (isNumber($v)) $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
 }
 echo $r;
 
@@ -164,13 +167,13 @@ $r = HtmlInput::get_to_hidden(array('l', 
'date_paid_start','date_paid_end',
     'accounting', 'unpaid', 'gDossier', 'ledger_type', 'p_action'));
 if (isset($_GET['search_opr_jrn']))
 {
-    foreach ($_GET['search_opr_jrn'] as $k => $v)
-        $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
+    foreach ($a_search_opr_jrn as $k => $v)
+       if (isNumber($v))  $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
 }
 if (isset($_GET['r_jrn']))
 {
-       foreach ($_GET['r_jrn'] as $k => $v)
-               $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
+       foreach ($a_rjn as $k => $v)
+       if (isNumber($v))       $r.=HtmlInput::hidden('r_jrn[' . $k . ']', $v);
 }
 echo '<form action="export.php" method="get">';
 echo $r;