$objMod->dictionaries = $objMod->{"dictionnaries"}; // For backward compatibility if (empty($objMod->dictionaries) && !empty($objMod->{"dictionnaries"})) { print 'id.'&token='.newToken().'">'; $reponsesadd = str_split($obj->reponses); $sql .= " SET reponses = '".$db->escape($reponsesadd)."'"; $sql .= " SET reponses = '0".$db->escape($obj->reponses)."'"; $tmpfiles = dol_dir_list($tmpdir, 'files', 0, '\.od(s|t)$', '', 'name', SORT_ASC, 0); print ''; $dateemail = dol_stringtotime((string) $overview[0]->udate, 'gmt'); $pice = ''; $typea = ($data[$j]->typea == 'birth') ? $picb : $pice; GETPOSTINT("mouvement"), dol_syslog("msgid=".$overview[0]->message_id." date=".dol_print_date($overview[0]->udate, 'dayrfc', 'gmt')." from=".$overview[0]->from." to=".$overview[0]->to." subject=".$overview[0]->subject); jQuery("#mouvement option").removeAttr("selected").change(); jQuery("#mouvement option[value=0]").attr("selected","selected").trigger("change"); jQuery("#mouvement option[value=1]").attr("selected","selected").trigger("change"); jQuery("#mouvement").trigger("change"); $action = 'transfert'; $currentpos = ftell($infp); $date_liv = dol_mktime(GETPOSTINT('rehour'), GETPOSTINT('remin'), GETPOSTINT('resec'), GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $newfiletmp = preg_replace('/\.od(s|t)/i', '', $newfile); $newfiletmp = preg_replace('/\.od[ts]/i', '', $newfile); $this->category->childs[] = $this->_cleanObjectDatas($cat); $this->periode = $this->db->jdate($obj->period); $tmp = array('id_users' => $obj->id_users, 'nom' => $obj->name, 'reponses' => $obj->reponses); $tmpfiles = dol_dir_list($tmpdir, 'files', 0, '\.od(s|t)$', '', 'name', SORT_ASC, 0, 1); // Disable hook for the moment //si les reponses ne concerne pas la colonne effacée, on concatenate GETPOST("mouvement", 'alpha'), GETPOSTINT("mouvement"), if (jQuery("#mouvement").val() == \'0\') jQuery("#unitprice").removeAttr("disabled"); print ''.$langs->trans("TransferStock").''; $action = 'transfert'; $currentpos = ftell($infp); $date_com = dol_mktime(GETPOSTINT('rehour'), GETPOSTINT('remin'), GETPOSTINT('resec'), GETPOSTINT('remonth'), GETPOSTINT('reday'), GETPOSTINT('reyear')); $date_next_execution = dol_mktime($rehour, $remin, 0, $remonth, $reday, $reyear); $datesubscription = dol_mktime(12, 0, 0, GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $ensemblereponses = $obj->reponses; $field = preg_replace('/(:[!<>=\s]+:|:in:|:notin:|:like:|:notlike:).*$/', '', $tmpcrit); // the name of the field $newcrit = preg_replace('/(:[!<>=\s]+:|:in:|:notin:|:like:|:notlike:)/', '', $tmpcrit); $object->periode = $dateperiod; $return .= '
'.$langs->trans("Payement").' : '.$this->type_payment.''; $sql .= " '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.date_ech as date, t.periode as date_due, 'SocialContributions' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, ".PAY_DEBIT." as sens"; $sql = 'INSERT INTO '.MAIN_DB_PREFIX.'opensurvey_user_studs (nom, id_sondage, reponses, date_creation)'; $sql = 'INSERT INTO '.MAIN_DB_PREFIX.'opensurvey_user_studs (nom, id_sondage, reponses, ip, date_creation)'; $sql = 'SELECT s.reponses'; $sql2 .= " SET reponses = '".$db->escape($newcar)."'"; $this->category->childs = array(); $tmpcrit = preg_replace('/^.*(:[!<>=\s]+:|:in:|:notin:|:like:|:notlike:)/', '\1', $tmpcrit); // the condition after the name of the field // mise a jour des reponses utilisateurs dans la base if ($user->hasRight('stock', 'mouvement', 'lire')) { if (empty($reyear) || empty($remonth) || empty($reday)) { jQuery("#mouvement").change(function() { preg_match('/:([!<>=\s]+|in|notin|like|notlike):/', $tmpcrit, $reg); print ''.$langs->trans("TransferStock").''; print ''.$langs->trans("ClinkOnALinkOfColumn", $langs->transnoentitiesnoconv("Referers")).''; "sme", $action = 'transfert'; $cle_rib = strtolower(checkES($rib, $CCC)); $date_com = dol_mktime(GETPOSTINT('rehour'), GETPOSTINT('remin'), GETPOSTINT('resec'), GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $date_next_execution = isset($date_next_execution) ? $date_next_execution : (GETPOST('remonth') ? dol_mktime(12, 0, 0, GETPOST('remonth'), GETPOST('reday'), GETPOST('reyear')) : -1); $date_next_execution = isset($date_next_execution) ? $date_next_execution : (GETPOSTINT('remonth') ? dol_mktime(12, 0, 0, GETPOSTINT('remonth'), GETPOSTINT('reday'), GETPOSTINT('reyear')) : -1); $datefrom = dol_mktime(0, 0, 0, GETPOSTINT('remonth'), GETPOSTINT('reday'), GETPOSTINT('reyear')); $datesubscription = dol_mktime(0, 0, 0, GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $ensemblereponses = $obj->reponses; $head[$h][1] = $langs->trans("Referers"); $head[$tab][1] = $langs->trans("Referers"); $out .= "".$langs->trans("Referer").": ".(isset($_SERVER["HTTP_REFERER"]) ? dol_htmlentities($_SERVER["HTTP_REFERER"], ENT_COMPAT) : '')."
\n"; $reday = GETPOSTINT('reday'); $sql .= " (cs.periode IS NOT NULL AND cs.periode between '".$db->idate(dol_get_first_day($year))."' AND '".$db->idate(dol_get_last_day($year))."')"; $sql .= " OR (cs.periode IS NULL AND cs.date_ech between '".$db->idate(dol_get_first_day($year))."' AND '".$db->idate(dol_get_last_day($year))."')"; $sql .= ", cs.libelle as label, cs.fk_type, cs.amount, cs.fk_projet as fk_project, cs.paye, cs.periode as period, cs.import_key"; $sql .= ", periode = '".$this->db->idate($this->period ? $this->period : $this->periode)."'"; $sql = "INSERT INTO ".MAIN_DB_PREFIX."chargesociales (fk_type, fk_account, fk_mode_reglement, libelle, date_ech, periode, amount, fk_projet, entity, fk_user_author, fk_user, date_creation)"; $sql = "SELECT id_users, nom as name, id_sondage, reponses"; $sql = "SELECT id_users, nom as name, reponses"; $test = ""; // Same $test = '/javas:cript/google.com'; $this->periode = $this->date_creation + 3600 * 24 * 30; $title = $langs->trans('Product')." ".$shortlabel." - ".$langs->trans('Referers'); $title = $langs->trans('Service')." ".$shortlabel." - ".$langs->trans('Referers'); if (!empty($arrayfields['cs.periode']['checked'])) { if ($newamount == 0 || empty($this->date_ech) || (empty($this->period) && empty($this->periode))) { if ($user->hasRight('stock', 'mouvement', 'creer')) { if (GETPOSTISSET("reday") && GETPOSTISSET("remonth") && GETPOSTISSET("reyear")) { * @param float|string $selectedrate Force preselected vat rate. Can be '8.5' or '8.5 (NOO)' for example. Use '' for no forcing. $datepaid = dol_mktime(12, 0, 0, GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $datepaye = dol_mktime(12, 0, 0, GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $datepaye = dol_mktime(GETPOSTINT("rehour"), GETPOSTINT("remin"), GETPOSTINT("resec"), GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear")); $datepaye = dol_mktime(GETPOSTINT("rehour"), GETPOSTINT("remin"), GETPOSTINT("resec"), GETPOSTINT("remonth"), GETPOSTINT("reday"), GETPOSTINT("reyear"), 'tzuserrel'); $ensemblereponses = $obj->reponses; $head[$h][1] = $langs->trans('Referers'); $infp = fopen($infilename, "rt"); $inj += preg_match('/on(dblclick|drag|drop|durationchange|emptied|end|ended|error|focus|focusin|focusout|formdata|gotpointercapture|hashchange|input|invalid)[a-z]*\s*=/i', $val); $opensurveysondage->mail_admin = $_SESSION['adresse']; $pdf->SetXY($savx, $savy); $savy = $pdf->getY(); $somethingshown = $formactions->showactions($object, 'mouvement', 0, 1, '', $MAXEVENT, '', $morehtmlcenter); // Show all action for product $sql .= " (cs.periode IS NOT NULL AND cs.periode between '".$db->idate(dol_get_first_day($year))."' AND '".$db->idate(dol_get_last_day($year))."')"; $sql .= " AND cs.periode <= '".$db->idate($search_date_limit_end)."'"; $sql .= " AND cs.periode >= '".$db->idate($search_date_limit_start)."'"; $sql .= " OR (cs.periode IS NULL AND cs.date_ech between '".$db->idate(dol_get_first_day($year))."' AND '".$db->idate(dol_get_last_day($year))."')"; $sql .= " SET reponses = '".$db->escape($nouveauchoix)."'"; $sql .= " cs.rowid, cs.libelle as label, cs.fk_type as type, cs.periode as period, cs.date_ech, cs.amount as total,"; $sql.= " ".MAIN_DB_PREFIX."notify_def as nd,"; $sql.= " AND nd.fk_action = ad.rowid"; $sql.= " WHERE u.rowid = nd.fk_user"; $sql.= " nd.rowid, ad.code, ad.label"; $title = $langs->trans('Batch')." ".$shortlabel." - ".$langs->trans('Referers'); $value = preg_replace('/([a-z\.]+)\s*([!<>=]+|in|notin|like|notlike)\s*/', '\1:\2:', $value); // Clean string 'x < 10' into 'x:<:10' so we can then explode on space to get all AND tests to do 'cs.periode' => array('label' => "PeriodEndDate", 'checked' => 1, 'position' => 50), // Ligne de la periode d'analyse du rapport // ceci afin d'etre compatible avec les cas ou la periode n'etait pas obligatoire TaskItem(pID, pName, pStart, pEnd, pColor, pLink, pMile, pRes, pComp, pGroup, pParent, pOpen, pDepend, pCaption, pNotes, pGantt)

Issue summary: If a victim had access to a spoofed version of ckeditor.com via HTTP (e.g. due to DNS spoofing, using a hacked public network or mailicious hotspot), then when using a link to the ckeditor.com website it was possible for the attacker to change the current URL of the opening page, even if the opening page was protected with SSL. fclose($infp); if ($action == "transfert") { if (GETPOST('reday')) { if (GETPOSTINT("reyear") && GETPOSTINT("remonth") && GETPOSTINT("reday")) { if (empty($infp)) { print ''; print '