Security update merged from 2.1.

[fa-stable.git] / admin / printers.php

diff --git a/admin/printers.php b/admin/printers.php
index 89d64476bfb455f4a8805d4675d74ce2f375a6d5..4c8ad144021e4b670a474469454ec81739dadcef 100644 (file)
--- a/admin/printers.php
+++ b/admin/printers.php
@@ -1,6 +1,15 @@
 <?php
-
-$page_security = 15;
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_PRINTERS';
 $path_to_root="..";
 include($path_to_root . "/includes/session.inc");
 
@@ -50,7 +59,7 @@ if ($Mode == 'Delete')
 {
        // PREVENT DELETES IF DEPENDENT RECORDS IN print_profiles
 
-       $sql= "SELECT COUNT(*) FROM ".TB_PREF."print_profiles WHERE printer = '$selected_id'";
+       $sql= "SELECT COUNT(*) FROM ".TB_PREF."print_profiles WHERE printer = ".db_escape($selected_id);
        $result = db_query($sql,"check printers relations failed");
        $myrow = db_fetch_row($result);
        if ($myrow[0] > 0) 
@@ -59,7 +68,7 @@ if ($Mode == 'Delete')
        } 
        else 
        {
-                       $sql="DELETE FROM ".TB_PREF."printers WHERE id='$selected_id'";
+                       $sql="DELETE FROM ".TB_PREF."printers WHERE id=".db_escape($selected_id);
                        db_query($sql,"could not delete printer definition");
                        display_notification(_('Selected printer definition has been deleted'));
        }
@@ -89,7 +98,7 @@ while ($myrow = db_fetch($result))
     label_cell($myrow['host']);
     label_cell($myrow['queue']);
        edit_button_cell("Edit".$myrow['id'], _("Edit"));
-       edit_button_cell("Delete".$myrow['id'], _("Delete"));
+       delete_button_cell("Delete".$myrow['id'], _("Delete"));
     end_row();
 
 
@@ -133,7 +142,7 @@ text_row(_("Timeout").':', 'tout', null, 5, 5);
 
 end_table(1);
 
-submit_add_or_update_center($selected_id == -1, '', true);
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();