X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=admin%2Fattachments.php;h=dafa3e022fb1ea592e93b3415269b6aa5ced7ffc;hb=204e03f5e1658c9c7ba2b13580ecb3290b624ba7;hp=fca578674cb948799f04b882ac5f97e54182215f;hpb=869e336c7335d984c9ae87d0b810f5c1b3744798;p=fa-stable.git

diff --git a/admin/attachments.php b/admin/attachments.php
index fca57867..dafa3e02 100644
--- a/admin/attachments.php
+++ b/admin/attachments.php
@@ -10,7 +10,7 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 $path_to_root="..";
-$page_security = 8;
+$page_security = 'SA_ATTACHDOCUMENT';
 
 include_once($path_to_root . "/includes/session.inc");
 
@@ -68,7 +68,7 @@ if ($download_id != -1)
 $js = "";
 if ($use_popup_windows)
 	$js .= get_js_open_window(800, 500);
-page(_("Attach Documents"), false, false, "", $js);
+page(_($help_context = "Attach Documents"), false, false, "", $js);
 
 simple_page_mode(true);
 //----------------------------------------------------------------------------------------
@@ -112,25 +112,27 @@ if ($Mode == 'ADD_ITEM' || $Mode == 'UPDATE_ITEM')
 	if ($Mode == 'ADD_ITEM')
 	{
 		$sql = "INSERT INTO ".TB_PREF."attachments (type_no, trans_no, description, filename, unique_name,
-			filesize, filetype, tran_date) VALUES (".$_POST['filterType'].",".$_POST['trans_no'].",".
-			db_escape($_POST['description']).", '$filename', '$unique_name', '$filesize', '$filetype', '$date')";
+			filesize, filetype, tran_date) VALUES (".db_escape($_POST['filterType']).","
+			.db_escape($_POST['trans_no']).",".db_escape($_POST['description']).", "
+			.db_escape($filename).", ".db_escape($unique_name).", ".db_escape($filesize)
+			.", ".db_escape($filetype).", '$date')";
 		db_query($sql, "Attachment could not be inserted");		
 		display_notification(_("Attachment has been inserted.")); 
 	}
 	else
 	{
 		$sql = "UPDATE ".TB_PREF."attachments SET
-			type_no=".$_POST['filterType'].",
-			trans_no=".$_POST['trans_no'].",
+			type_no=".db_escape($_POST['filterType']).",
+			trans_no=".db_escape($_POST['trans_no']).",
 			description=".db_escape($_POST['description']).", ";
 		if ($filename != "")
 		{
-			$sql .= "filename='$filename',
-			unique_name='$unique_name',
-			filesize='$filesize',
-			filetype='$filetype', ";
+			$sql .= "filename=".db_escape($filename).",
+			unique_name=".db_escape($unique_name).",
+			filesize=".db_escape($filesize).",
+			filetype=".db_escape($filetype);
 		}	
-		$sql .= "tran_date='$date' WHERE id=$selected_id";
+		$sql .= "tran_date='$date' WHERE id=".db_escape($selected_id);
 		db_query($sql, "Attachment could not be updated");		
 		display_notification(_("Attachment has been updated.")); 
 	}
@@ -143,7 +145,7 @@ if ($Mode == 'Delete')
 	$dir =  $comp_path."/".user_company(). "/attachments";
 	if (file_exists($dir."/".$row['unique_name']))
 		unlink($dir."/".$row['unique_name']);
-	$sql = "DELETE FROM ".TB_PREF."attachments WHERE id = $selected_id";
+	$sql = "DELETE FROM ".TB_PREF."attachments WHERE id = ".db_escape($selected_id);
 	db_query($sql, "Could not delete attachment");
 	display_notification(_("Attachment has been deleted.")); 
 	$Mode = 'RESET';
@@ -158,7 +160,7 @@ if ($Mode == 'RESET')
 
 function viewing_controls()
 {
-    start_form(false, true);
+    start_form();
 
     start_table("class='tablestyle_noborder'");
 
@@ -173,13 +175,14 @@ function viewing_controls()
 
 function get_attached_documents($type)
 {
-	$sql = "SELECT * FROM ".TB_PREF."attachments WHERE type_no=$type ORDER BY trans_no";
+	$sql = "SELECT * FROM ".TB_PREF."attachments WHERE type_no=".db_escape($type)
+	." ORDER BY trans_no";
 	return db_query($sql, "Could not retrieve attachments");
 }
 
 function get_attachment($id)
 {
-	$sql = "SELECT * FROM ".TB_PREF."attachments WHERE id=$id";
+	$sql = "SELECT * FROM ".TB_PREF."attachments WHERE id=".db_escape($id);
 	$result = db_query($sql, "Could not retrieve attachments");
 	return db_fetch($result);
 }
@@ -253,7 +256,7 @@ end_table(1);
 if (isset($_POST['filterType']))
 	hidden('filterType', $_POST['filterType']);
 
-submit_add_or_update_center($selected_id == -1, '', true);
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();