Fixed input sanitization.

[fa-stable.git] / reporting / includes / reports_classes.inc

diff --git a/reporting/includes/reports_classes.inc b/reporting/includes/reports_classes.inc
index c824ddc311dd3e036fd7fee7dadd9837b5d5e92f..9aad89c586be0292fc8910109b1ae9abf65d51ce 100644 (file)
--- a/reporting/includes/reports_classes.inc
+++ b/reporting/includes/reports_classes.inc
@@ -47,7 +47,7 @@ class BoxReports
 
        function getDisplay($class=null)
        {
-               global $table_style, $path_to_root, $pdf_debug, $Ajax;
+               global $path_to_root, $pdf_debug, $Ajax;
 
 
                $temp = array_values($this->ar_classes);
@@ -57,6 +57,8 @@ class BoxReports
                $st_classes = "<b>" . _("Report Classes:") . "</b><br>";
                foreach($this->ar_classes as $class_id => $name)
                {
+                       if (!isset($this->ar_reports[$class_id]))
+                               continue; // e.g. no dimensions
                        $style = $class_id==$_REQUEST['Class'] ? '' : "style='display:none'";
 //                     $cname = access_string($key, true);
 //                     $style = $_REQUEST['Class']==$cname ? '' : "style='display:none'";
@@ -81,8 +83,8 @@ class BoxReports
                                                . "<form method='POST' action='$action' target='_blank'>\n";
                                        $st_params .= submit('Rep'.$report->id,  
                                                _("Display: ") . access_string($report->name, true),
-                                               false, '', $pdf_debug ? false : 'default') . hidden('REP_ID', $report->id, false).'<br><br>';
-                                       $st_params .= $this->getOptions($report->get_controls());
+                                               false, '', $pdf_debug ? false : 'default process') . hidden('REP_ID', $report->id, false).'<br><br>';
+                                       $st_params .= $this->getOptions($report->get_controls(), $report->id);
                                        $st_params .= "\n</form></td></tr></table>\n";
                                        set_focus('Rep'.$report->id);
                                        $Ajax->addUpdate(true, 'rep_form', $st_params);
@@ -124,7 +126,7 @@ class BoxReports
                return $st;
        }
 
-       function getOptions($controls)
+       function getOptions($controls, $id = 0)
        {
                $st = '';
                if ($controls == null)
@@ -139,6 +141,8 @@ class BoxReports
                                if ($ctrl) break;
                        }
                        if ($ctrl == '') {
+                               if (isset($_COOKIE['select'][$id][$cnt])) // saved parameters 2010-10-06 Joe Hunt
+                                       $_POST['PARAM_'.$cnt] = $_COOKIE['select'][$id][$cnt];
                                $ctrl = $this->get_ctrl('PARAM_'.$cnt, $type);
                        }
                        if ($ctrl != '')  {
@@ -164,7 +168,7 @@ class BoxReports
        //
        function get_ctrl($name, $type)
        {
-               global $path_to_root, $use_date_picker, $pdf_debug, $print_invoice_no;
+               global $path_to_root, $use_date_picker, $pdf_debug, $print_invoice_no, $def_print_destination;
 
                $st = '';
                        switch ($type)
@@ -180,31 +184,35 @@ class BoxReports
                                case 'DATEENDM':
                                case 'DATEBEGINTAX':
                                case 'DATEENDTAX':
-                                       if ($type == 'DATEBEGIN')
-                                               $date = begin_fiscalyear();
-                                       elseif ($type == 'DATEEND')
-                                               $date = end_fiscalyear();
-                                       else
-                                               $date = Today();
-                                       if ($type == 'DATEBEGINM')
-                                               $date = begin_month($date);
-                                       elseif ($type == 'DATEENDM')
-                                               $date = end_month($date);
-                                       elseif ($type == 'DATEBEGINTAX' || $type == 'DATEENDTAX')
+                                       if (!isset($_POST[$name]))
                                        {
-                                               $row = get_company_prefs();
-                                               $edate = add_months($date, -$row['tax_last']);
-                                               $edate = end_month($edate);
-                                               if ($type == 'DATEENDTAX')
-                                                       $date = $edate;
+                                               if ($type == 'DATEBEGIN')
+                                                       $date = begin_fiscalyear();
+                                               elseif ($type == 'DATEEND')
+                                                       $date = end_fiscalyear();
                                                else
+                                                       $date = Today();
+                                               if ($type == 'DATEBEGINM')
+                                                       $date = begin_month($date);
+                                               elseif ($type == 'DATEENDM')
+                                                       $date = end_month($date);
+                                               elseif ($type == 'DATEBEGINTAX' || $type == 'DATEENDTAX')
                                                {
-                                                       $bdate = begin_month($edate);
-                                                       $bdate = add_months($bdate, -$row['tax_prd'] + 1);
-                                                       $date = $bdate;
+                                                       $row = get_company_prefs();
+                                                       $edate = add_months($date, -$row['tax_last']);
+                                                       $edate = end_month($edate);
+                                                       if ($type == 'DATEENDTAX')
+                                                               $date = $edate;
+                                                       else
+                                                       {
+                                                               $bdate = begin_month($edate);
+                                                               $bdate = add_months($bdate, -$row['tax_prd'] + 1);
+                                                               $date = $bdate;
+                                                       }
                                                }
                                        }
-
+                                       else // saved parameters 2010-10-16 Joe Hunt
+                                               $date = $_POST[$name];
                                        $st = "<input type='text' name='$name' value='$date'>";
                                        if ($use_date_picker)
                                                $st .= "<a href=\"javascript:date_picker(document.forms[0].$name);\">"
@@ -221,7 +229,10 @@ class BoxReports
 
                                case 'DESTINATION':
                                        $sel = array(_("PDF/Printer"), "Excel");
-                                       return array_selector($name, null, $sel);
+                                       $def = 0;
+                                       if (isset($def_print_destination) && $def_print_destination == 1)
+                                               $def = 1;
+                                       return array_selector($name, $def, $sel);
 
                                case 'COMPARE':
                                        $sel = array(_("Accumulated"), _("Period Y-1"), _("Budget"));
@@ -242,7 +253,8 @@ class BoxReports
                                        return "<input type='text' name='$name'>";
 
                                case 'TEXTBOX':
-                                       return "<textarea rows=4 cols=30 name='$name'></textarea>";
+                                       $value = (isset($_POST[$name]) ? $_POST[$name] : "");
+                                       return "<textarea rows=4 cols=30 name='$name'>$value</textarea>";
 
                                case 'ACCOUNTS': // not used
                                        return gl_account_types_list($name, null, _("No Account Group Filter"), true);
@@ -395,7 +407,8 @@ class BoxReports
                                                $tag_type = TAG_ACCOUNT;
                                        else
                                                $tag_type = TAG_DIMENSION;
-                                       return tag_list($name, 5, $tag_type, true, _("No tags"));
+                                       //return tag_list($name, 5, $tag_type, true, false, _("No tags"));
+                                       return tag_list($name, 5, $tag_type, true);
 
                        }
                return '';
@@ -459,8 +472,11 @@ function add_custom_reports(&$reports)
                foreach ($extensions as $ext)
                        if (($ext['active'] && $ext['type'] == 'extension')) {
                                $file = $path_to_root.'/'.$ext['path']."/reporting/reports_custom.php";
-                               if (file_exists($file))
+                               if (file_exists($file)) {
+                                       set_ext_domain($ext['path']);
                                        include_once($file);
+                                       set_ext_domain();
+                               }
                        }
        }
        $file = company_path()."/reporting/reports_custom.php";