Fixed a couple of obvious errors.

[fa-stable.git] / reporting / prn_redirect.php

diff --git a/reporting/prn_redirect.php b/reporting/prn_redirect.php
index 8a64ea397e65dc13c98720d5bd63ae42adfc1cb7..d7147a7f5c89c50097dc0c3639b84378c8c0394d 100644 (file)
--- a/reporting/prn_redirect.php
+++ b/reporting/prn_redirect.php
@@ -14,11 +14,12 @@
        print button in reporting module. 
 */
 $path_to_root = "..";
+global $page_security, $save_report_selections;
 $page_security = 'SA_OPEN';    // this level is later overriden in rep file
 include_once($path_to_root . "/includes/session.inc");
 
 if (isset($save_report_selections) && $save_report_selections > 0 && isset($_POST['REP_ID'])) {        // save parameters from Report Center
-       for($i=0; $i<10; $i++) { // 2010-10-06 Joe Hunt
+       for($i=0; $i<12; $i++) { // 2013-01-16 Joe Hunt
                if (isset($_POST['PARAM_'.$i]) && !is_array($_POST['PARAM_'.$i])) {
                        $rep = $_POST['REP_ID'];
                        setcookie("select[$rep][$i]", $_POST['PARAM_'.$i], time()+60*60*24*$save_report_selections); // days from $save_report_selections
@@ -29,7 +30,7 @@ if (isset($save_report_selections) && $save_report_selections > 0 && isset($_POS
 if (isset($_GET['xls']))
 {
        $filename = $_GET['filename'];
-       $unique_name = $_GET['unique'];
+       $unique_name = preg_replace('/[^0-9a-z.]/i', '', $_GET['unique']);
        $path =  company_path(). '/pdf_files/';
        header("Content-type: application/vnd.ms-excel");
        header("Content-Disposition: attachment; filename=$filename" );
@@ -42,7 +43,7 @@ if (isset($_GET['xls']))
 elseif (isset($_GET['xml']))
 {
        $filename = $_GET['filename'];
-       $unique_name = $_GET['unique'];
+       $unique_name = preg_replace('/[^0-9a-z.]/i', '', $_GET['unique']);
        $path =  company_path(). '/pdf_files/';
        header("content-type: text/xml");
        header("Content-Disposition: attachment; filename=$filename");
@@ -61,7 +62,8 @@ if (!isset($_POST['REP_ID'])) {       // print link clicked
                        ? $_GET['PARAM_'.$i] : $def_pars[$i];
        }
 }
-$rep = $_POST['REP_ID'];
+
+$rep = preg_replace('/[^a-z_0-9]/i', '', $_POST['REP_ID']);
 
 $rep_file = find_custom_file("/reporting/rep$rep.php");