← All changes | admin/views/orders/tmpl/default.php +12 -12 1.8.13 → 1.8.16 View file →

		@@ -246,9 +246,9 @@
246	246	<option value="-1"<?php echo $pchannel == '-1' ? ' selected="selected"' : ''; ?>>- <?php echo JText::translate('VBORDFROMSITE'); ?></option>
247	247	<?php
248	248	foreach ($all_channels as $o_channel) {
249	249	?>
250		- <option value="<?php echo $o_channel; ?>"<?php echo $pchannel == $o_channel ? ' selected="selected"' : ''; ?>>- <?php echo ucwords($o_channel); ?></option>
	250	+ <option value="<?php echo JHtml::fetch('esc_attr', $o_channel); ?>"<?php echo $pchannel == $o_channel ? ' selected="selected"' : ''; ?>>- <?php echo ucwords($o_channel); ?></option>
251	251	<?php
252	252	}
253	253	}
254	254	?>
		@@ -278,9 +278,9 @@
278	278	<option value=""><?php echo JText::translate('VBOCATEGORYFILTER'); ?></option>
279	279	<?php
280	280	foreach ($this->categories as $catid => $catname) {
281	281	?>
282		- <option value="<?php echo $catid; ?>"<?php echo $catid == $pcategory_id ? ' selected="selected"' : ''; ?>><?php echo $catname; ?></option>
	282	+ <option value="<?php echo JHtml::fetch('esc_attr', $catid); ?>"<?php echo $catid == $pcategory_id ? ' selected="selected"' : ''; ?>><?php echo $catname; ?></option>
283	283	<?php
284	284	}
285	285	?>
286	286	</select>
		@@ -302,9 +302,9 @@
302	302	$dbo->setQuery($q);
303	303	$allpayments = $dbo->loadAssocList();
304	304	foreach ($allpayments as $paym) {
305	305	?>
306		- <option value="<?php echo $paym['id']; ?>"<?php echo $paym['id'] == $pidpayment ? ' selected="selected"' : ''; ?>><?php echo $paym['name']; ?></option>
	306	+ <option value="<?php echo (int) $paym['id']; ?>"<?php echo $paym['id'] == $pidpayment ? ' selected="selected"' : ''; ?>><?php echo $paym['name']; ?></option>
307	307	<?php
308	308	}
309	309	?>
310	310	</select>
		@@ -345,9 +345,9 @@
345	345	$pdatefiltfrom = $app->getUserStateFromRequest("vbo.orders.datefiltfrom", 'datefiltfrom', '', 'string');
346	346	$pdatefiltto = $app->getUserStateFromRequest("vbo.orders.datefiltto", 'datefiltto', '', 'string');
347	347	if (!empty($pdatefilt) && (!empty($pdatefiltfrom) || !empty($pdatefiltto))) {
348	348	$filters_set = true;
349		- $dates_filter = '&amp;datefilt='.$pdatefilt.(!empty($pdatefiltfrom) ? '&amp;datefiltfrom='.$pdatefiltfrom : '').(!empty($pdatefiltto) ? '&amp;datefiltto='.$pdatefiltto : '');
	349	+ $dates_filter = JHtml::fetch('esc_attr', '&amp;datefilt='.$pdatefilt.(!empty($pdatefiltfrom) ? '&amp;datefiltfrom='.$pdatefiltfrom : '').(!empty($pdatefiltto) ? '&amp;datefiltto='.$pdatefiltto : ''));
350	350	}
351	351	$datesel = '<select name="datefilt" onchange="vboToggleDateFilt(this.value);"><option value="">'.JText::translate('VBOFILTERBYDATES').'</option>';
352	352	$datesel .= '<option value="1"'.(!empty($pdatefilt) && $pdatefilt == 1 ? ' selected="selected"' : '').'>'.JText::translate('VBOFILTERDATEBOOK').'</option>';
353	353	$datesel .= '<option value="2"'.(!empty($pdatefilt) && $pdatefilt == 2 ? ' selected="selected"' : '').'>'.JText::translate('VBOFILTERDATEIN').'</option>';
		@@ -356,9 +356,9 @@
356	356	echo $datesel;
357	357	?>
358	358	</div>
359	359	<div class="btn-group pull-left" id="vbo-dates-cont" style="display: <?php echo (!empty($pdatefilt) && (!empty($pdatefiltfrom) || !empty($pdatefiltto)) ? 'inline-block' : 'none'); ?>;">
360		- <input type="text" id="vbo-date-from" placeholder="<?php echo JText::translate('VBNEWSEASONONE'); ?>" value="<?php echo $pdatefiltfrom; ?>" size="10" name="datefiltfrom" autocomplete="off" />&nbsp;-&nbsp;<input type="text" id="vbo-date-to" placeholder="<?php echo JText::translate('VBNEWSEASONTWO'); ?>" value="<?php echo $pdatefiltto; ?>" size="10" name="datefiltto" autocomplete="off" />
	360	+ <input type="text" id="vbo-date-from" placeholder="<?php echo JText::translate('VBNEWSEASONONE'); ?>" value="<?php echo JHtml::fetch('esc_attr', $pdatefiltfrom); ?>" size="10" name="datefiltfrom" autocomplete="off" />&nbsp;-&nbsp;<input type="text" id="vbo-date-to" placeholder="<?php echo JText::translate('VBNEWSEASONTWO'); ?>" value="<?php echo JHtml::fetch('esc_attr', $pdatefiltto); ?>" size="10" name="datefiltto" autocomplete="off" />
361	361	</div>
362	362	<div class="btn-group pull-left">
363	363	<button type="submit" class="btn btn-primary"><i class="icon-search"></i> <?php echo JText::translate('VBPVIEWORDERSSEARCHSUBM'); ?></button>
364	364	</div>
		@@ -819,9 +819,9 @@
819	819
820	820	</table>
821	821	</div>
822	822	<input type="hidden" name="option" value="com_vikbooking" />
823		-<input type="hidden" name="cust_id" id="cust_id" value="<?php echo !empty($pcust_id) ? $pcust_id : ''; ?>" />
	823	+<input type="hidden" name="cust_id" id="cust_id" value="<?php echo !empty($pcust_id) ? JHtml::fetch('esc_attr', $pcust_id) : ''; ?>" />
824	824	<input type="hidden" name="task" value="orders" />
825	825	<input type="hidden" name="boxchecked" value="0" />
826	826	<?php echo JHtml::fetch('form.token'); ?>
827	827	<?php echo $navbut; ?>
		@@ -1245,13 +1245,13 @@
1245	1245	<div class="vbo-gen-invoices-helper" style="display: none;">
1246	1246	<form action="index.php?option=com_vikbooking" method="post" id="vbo-geninv-form">
1247	1247	<div class="vbo-calendar-cfield-entry">
1248	1248	<label for="invoice_num"><?php echo JText::translate('VBINVSTARTNUM'); ?></label>
1249		- <span><input type="number" min="1" size="4" value="<?php echo $nextinvnum; ?>" id="invoice_num" name="invoice_num" /></span>
	1249	+ <span><input type="number" min="1" size="4" value="<?php echo JHtml::fetch('esc_attr', $nextinvnum); ?>" id="invoice_num" name="invoice_num" /></span>
1250	1250	</div>
1251	1251	<div class="vbo-calendar-cfield-entry">
1252	1252	<label for="invoice_suff"><?php echo JText::translate('VBINVNUMSUFFIX'); ?></label>
1253		- <span><input type="text" size="7" value="<?php echo $invsuff; ?>" id="invoice_suff" name="invoice_suff" /></span>
	1253	+ <span><input type="text" size="7" value="<?php echo JHtml::fetch('esc_attr', $invsuff); ?>" id="invoice_suff" name="invoice_suff" /></span>
1254	1254	</div>
1255	1255	<div class="vbo-calendar-cfield-entry">
1256	1256	<label for="invoice_date"><?php echo JText::translate('VBINVUSEDATE'); ?></label>
1257	1257	<span>
		@@ -1258,9 +1258,9 @@
1258	1258	<select id="invoice_date" name="invoice_date">
1259	1259	<?php
1260	1260	if (!empty($oldinvdate)) {
1261	1261	?>
1262		- <option value="<?php echo date($df, $oldinvdate); ?>"><?php echo date($df, $oldinvdate); ?></option>
	1262	+ <option value="<?php echo JHtml::fetch('esc_attr', date($df, $oldinvdate)); ?>"><?php echo date($df, $oldinvdate); ?></option>
1263	1263	<?php
1264	1264	}
1265	1265	?>
1266	1266	<option value="<?php echo date($df, time()); ?>"><?php echo date($df, time()); ?></option>
		@@ -1280,12 +1280,12 @@
1280	1280
1281	1281	</div>
1282	1282	<?php
1283	1283	foreach ($cid as $invid) {
1284		- echo '<input type="hidden" name="cid[]" value="'.$invid.'" />';
	1284	+ echo '<input type="hidden" name="cid[]" value="'. (int) $invid . '" />';
1285	1285	}
1286	1286	if ($pconfirmgen > 0) {
1287		- echo '<input type="hidden" name="confirmgen" value="'.$cid[0].'" />';
	1287	+ echo '<input type="hidden" name="confirmgen" value="' . (int) $cid[0] . '" />';
1288	1288	}
1289	1289	?>
1290	1290	<input type="hidden" name="option" value="com_vikbooking" />
1291	1291	<input type="hidden" name="task" value="geninvoices" />
		@@ -1303,9 +1303,9 @@
1303	1303	footer_right: '<button type="button" class="btn btn-success" onclick="document.getElementById(\'vbo-geninv-form\').submit();"><i class="vboicn-file-text2"></i><?php echo addslashes(JText::translate('VBOGENINVOICES')); ?></button>',
1304	1304	<?php
1305	1305	if (count($cid) === 1) {
1306	1306	?>
1307		- footer_left: '<a href="index.php?option=com_vikbooking&task=editbusy&cid[]=<?php echo $cid[0]; ?>&frominv=1" class="btn vbo-config-btn"><?php echo addslashes(JText::translate('VBINVEDITBINFO')); ?></a>',
	1307	+ footer_left: '<a href="index.php?option=com_vikbooking&task=editbusy&cid[]=<?php echo (int) $cid[0]; ?>&frominv=1" class="btn vbo-config-btn"><?php echo addslashes(JText::translate('VBINVEDITBINFO')); ?></a>',
1308	1308	<?php
1309	1309	}
1310	1310	?>
1311	1311	onDismiss: () => {