[0000313] Fixed multiply vulnerabilities.

[fa-stable.git] / reporting / includes / header2.inc

diff --git a/reporting/includes/header2.inc b/reporting/includes/header2.inc
index 481fd16092bdc2cca05d8c6d558f807460815e73..cb40430a04050e3a2d6cd6263eba9c4ee2d5f3cc 100644 (file)
--- a/reporting/includes/header2.inc
+++ b/reporting/includes/header2.inc
@@ -186,9 +186,9 @@
                        $this->NewLine();
                        $this->TextWrapLines($ccol, $icol - $ccol, $addr);
                }
+               $this->row = $temp;
                if (isset($this->formData['deliver_to']))
                {
-                       $this->row = $temp;
                        if ($doctype == ST_PURCHORDER)
                                $this->Text($mcol, $this->company['coy_name']);
                        elseif ($doctype != ST_SUPPAYMENT && isset($this->formData['deliver_to']))
@@ -196,10 +196,11 @@
                                $this->Text($mcol, $this->formData['deliver_to']);
                                $this->NewLine();
                        }       
-                       // if you need the company name in purchase order then write it as first line in location addresss.     
                        if ($doctype != ST_SUPPAYMENT && isset($this->formData['delivery_address']))
                                $this->TextWrapLines($mcol, $this->rightMargin - $mcol, $this->formData['delivery_address']);
-               }
+               }       // if you need the company name in purchase order then write it as first line in location addresss.     
+               elseif ($doctype == ST_PURCHORDER && isset($this->formData['delivery_address']))
+                       $this->TextWrapLines($mcol, $this->rightMargin - $mcol, $this->formData['delivery_address']);
                $this->row = $iline2 - $this->lineHeight - 1;
                $col = $this->leftMargin;
                $this->TextWrap($col, $this->row, $width, $doc_Customers_Ref, 'C');
@@ -286,7 +287,7 @@
                        else
                        {
                                $id = $this->formData['payment_terms'];
-                               $sql = "SELECT terms FROM ".TB_PREF."payment_terms WHERE terms_indicator='$id'";
+                               $sql = "SELECT terms FROM ".TB_PREF."payment_terms WHERE terms_indicator=".db_escape($id);
                                $result = db_query($sql,"could not get paymentterms");
                                $row = db_fetch($result);
                                $str = $row["terms"];