Fixed record selection on pages using non-numeric selectors with simple_page_mode...

diff --git a/includes/ui/ui_controls.inc b/includes/ui/ui_controls.inc
index 217be194c3642061fa15fc7b5085deac3fda3106..c9bae54f55133455af9b2abbbdee89584545512f 100644 (file)
--- a/includes/ui/ui_controls.inc
+++ b/includes/ui/ui_controls.inc
@@ -165,8 +165,13 @@ function delete_link_cell($param, $title=false)
 
 function edit_button_cell($name, $value, $title=false)
 {
-    label_cell("<input type=\"submit\" class=\"editbutton\" name=\"$name\" value=\"$value\""
-       .($title ? " title='$title'":'')." />\n");
+// php silently changes dots,spaces,'[' and characters 128-159
+// to underscore in POST names, to maintain compatibility with register_globals
+
+    label_cell("<input type=\"submit\" class=\"editbutton\" name=\""
+               .htmlentities(strtr($name, array('.'=>'=2E',' '=>'=20','='=>'=3D','['=>'=5B')))
+               ."\" value=\"$value\""
+               .($title ? " title='$title'":'')." />\n");
 }
 
 //-----------------------------------------------------------------------------------

diff --git a/includes/ui/ui_input.inc b/includes/ui/ui_input.inc
index 65ac068fd5acea5f2850e137973a53e05057a085..f1fb3691c1d6d45914a4b602ac49e6e0f0001e99 100644 (file)
--- a/includes/ui/ui_input.inc
+++ b/includes/ui/ui_input.inc
@@ -53,7 +53,9 @@ function simple_page_mode($numeric_id = true)
        foreach (array('Edit', 'Delete') as $m) {
                foreach ($_POST as $p => $pvar) {
                        if (strpos($p, $m) === 0) {
-                               $selected_id = substr($p, strlen($m));
+//                             $selected_id = strtr(substr($p, strlen($m)), array('%2E'=>'.'));
+                               unset($_POST['_focus']); // focus on first form entry
+                               $selected_id = quoted_printable_decode(substr($p, strlen($m)));
                                $Ajax->activate('_page_body');
                                $Mode = $m;
                                return;

diff --git a/inventory/manage/item_units.php b/inventory/manage/item_units.php
index 61e4e685d6de346f3a37e5b3e4ab819556f8a46f..d06828e067250c6ef16b263096d9ba704eae43e7 100644 (file)
--- a/inventory/manage/item_units.php
+++ b/inventory/manage/item_units.php
@@ -1,5 +1,4 @@
 <?php
-
 $page_security = 11;
 $path_to_root="../..";
 include($path_to_root . "/includes/session.inc");
@@ -33,7 +32,7 @@ if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
        }
 
        if ($input_error !=1) {
-       write_item_unit($selected_id, $_POST['abbr'], $_POST['description'], $_POST['decimals'] );
+       write_item_unit(htmlentities($selected_id), $_POST['abbr'], $_POST['description'], $_POST['decimals'] );
                if($selected_id != '')
                        display_notification(_('Selected unit has been updated'));
                else
@@ -115,7 +114,6 @@ if ($selected_id != '')
        }
        hidden('selected_id', $selected_id);
 }
-
 if ($selected_id != '' && item_unit_used($selected_id)) {
     label_row(_("Unit Abbreviation:"), $_POST['abbr']);
     hidden('abbr', $_POST['abbr']);