| @@ -49,9 +49,10 @@ | ||
| 49 | 49 | |
| 50 | 50 | $cid = VikRequest::getVar('cid', array()); |
| 51 | 51 | $pcust_id = $app->getUserStateFromRequest("vbo.orders.cust_id", 'cust_id', 0, 'int'); |
| 52 | 52 | $pconfirmnumber = VikRequest::getString('confirmnumber', '', 'request'); |
| 53 | -//Color tags | |
| 53 | + | |
| 54 | +// color tags | |
| 54 | 55 | $colortags = VikBooking::loadBookingsColorTags(); |
| 55 | 56 | $bctags_tip = ''; |
| 56 | 57 | if (count($colortags) > 0) { |
| 57 | 58 | $bctags_tip = '<div class=\"vbo-blist-tip-bctag-subtip-inner\">'; |
| @@ -59,9 +60,8 @@ | ||
| 59 | 60 | $bctags_tip .= '<div class=\"vbo-blist-tip-bctag-subtip-circle hasTooltip\" data-ctagkey=\"'.$ctagk.'\" data-ctagcolor=\"'.$ctagv['color'].'\" title=\"'.addslashes(JText::translate($ctagv['name'])).'\"><div class=\"vbo-blist-tip-bctag-subtip-circlecont\" style=\"background-color: '.$ctagv['color'].';\"></div></div>'; |
| 60 | 61 | } |
| 61 | 62 | $bctags_tip .= '</div>'; |
| 62 | 63 | } |
| 63 | -// | |
| 64 | 64 | |
| 65 | 65 | if (empty($rows)) { |
| 66 | 66 | $rows = array(); |
| 67 | 67 | ?> |
| @@ -246,9 +246,9 @@ | ||
| 246 | 246 | <option value="-1"<?php echo $pchannel == '-1' ? ' selected="selected"' : ''; ?>>- <?php echo JText::translate('VBORDFROMSITE'); ?></option> |
| 247 | 247 | <?php |
| 248 | 248 | foreach ($all_channels as $o_channel) { |
| 249 | 249 | ?> |
| 250 | - <option value="<?php echo $o_channel; ?>"<?php echo $pchannel == $o_channel ? ' selected="selected"' : ''; ?>>- <?php echo ucwords($o_channel); ?></option> | |
| 250 | + <option value="<?php echo JHtml::fetch('esc_attr', $o_channel); ?>"<?php echo $pchannel == $o_channel ? ' selected="selected"' : ''; ?>>- <?php echo ucwords($o_channel); ?></option> | |
| 251 | 251 | <?php |
| 252 | 252 | } |
| 253 | 253 | } |
| 254 | 254 | ?> |
| @@ -263,10 +263,10 @@ | ||
| 263 | 263 | foreach ($allrooms as $room) { |
| 264 | 264 | $rsel .= '<option value="'.$room['id'].'"'.(!empty($pidroom) && $pidroom == $room['id'] ? ' selected="selected"' : '').'>'.$room['name'].'</option>'; |
| 265 | 265 | } |
| 266 | 266 | $rsel .= '</select>'; |
| 267 | + echo $rsel; | |
| 267 | 268 | } |
| 268 | - echo $rsel; | |
| 269 | 269 | ?> |
| 270 | 270 | </div> |
| 271 | 271 | <?php |
| 272 | 272 | $pcategory_id = $app->getUserStateFromRequest("vbo.orders.category_id", 'category_id', 0, 'int'); |
| @@ -278,9 +278,9 @@ | ||
| 278 | 278 | <option value=""><?php echo JText::translate('VBOCATEGORYFILTER'); ?></option> |
| 279 | 279 | <?php |
| 280 | 280 | foreach ($this->categories as $catid => $catname) { |
| 281 | 281 | ?> |
| 282 | - <option value="<?php echo $catid; ?>"<?php echo $catid == $pcategory_id ? ' selected="selected"' : ''; ?>><?php echo $catname; ?></option> | |
| 282 | + <option value="<?php echo JHtml::fetch('esc_attr', $catid); ?>"<?php echo $catid == $pcategory_id ? ' selected="selected"' : ''; ?>><?php echo $catname; ?></option> | |
| 283 | 283 | <?php |
| 284 | 284 | } |
| 285 | 285 | ?> |
| 286 | 286 | </select> |
| @@ -302,9 +302,9 @@ | ||
| 302 | 302 | $dbo->setQuery($q); |
| 303 | 303 | $allpayments = $dbo->loadAssocList(); |
| 304 | 304 | foreach ($allpayments as $paym) { |
| 305 | 305 | ?> |
| 306 | - <option value="<?php echo $paym['id']; ?>"<?php echo $paym['id'] == $pidpayment ? ' selected="selected"' : ''; ?>><?php echo $paym['name']; ?></option> | |
| 306 | + <option value="<?php echo (int) $paym['id']; ?>"<?php echo $paym['id'] == $pidpayment ? ' selected="selected"' : ''; ?>><?php echo $paym['name']; ?></option> | |
| 307 | 307 | <?php |
| 308 | 308 | } |
| 309 | 309 | ?> |
| 310 | 310 | </select> |
| @@ -316,19 +316,22 @@ | ||
| 316 | 316 | $pstatus = $app->getUserStateFromRequest("vbo.orders.status", 'status', '', 'string'); |
| 317 | 317 | $filters_set = !empty($pstatus) || $filters_set; |
| 318 | 318 | $status_filter = !empty($pstatus) ? '&status='.$pstatus : ''; |
| 319 | 319 | ?> |
| 320 | - <optgroup label="<?php echo JText::translate('VBSTATUS'); ?>"> | |
| 320 | + <optgroup label="<?php echo JHtml::fetch('esc_attr', JText::translate('VBSTATUS')); ?>"> | |
| 321 | 321 | <option value="confirmed"<?php echo $pstatus == 'confirmed' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBCONFIRMED'); ?></option> |
| 322 | 322 | <option value="standby"<?php echo $pstatus == 'standby' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBSTANDBY'); ?></option> |
| 323 | 323 | <option value="cancelled"<?php echo $pstatus == 'cancelled' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBCANCELLED'); ?></option> |
| 324 | - <option value="closure"<?php echo $pstatus == 'closure' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBDBTEXTROOMCLOSED'); ?></option> | |
| 324 | + </optgroup> | |
| 325 | + <optgroup label="<?php echo JHtml::fetch('esc_attr', JText::translate('VBPSHOWSEASONSTHREE')); ?>"> | |
| 325 | 326 | <option value="inquiry"<?php echo $pstatus == 'inquiry' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_BTYPE_INQUIRY'); ?></option> |
| 326 | 327 | <option value="request"<?php echo $pstatus == 'request' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_BTYPE_REQUEST'); ?></option> |
| 328 | + <option value="quote"<?php echo $pstatus == 'quote' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_BTYPE_QUOTE'); ?></option> | |
| 329 | + <option value="overbooking"<?php echo $pstatus == 'overbooking' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_BTYPE_OVERBOOKING'); ?></option> | |
| 327 | 330 | <option value="split_stay"<?php echo $pstatus == 'split_stay' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_SPLIT_STAY'); ?></option> |
| 328 | - <option value="overbooking"<?php echo $pstatus == 'overbooking' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBO_BTYPE_OVERBOOKING'); ?></option> | |
| 331 | + <option value="closure"<?php echo $pstatus == 'closure' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBDBTEXTROOMCLOSED'); ?></option> | |
| 329 | 332 | </optgroup> |
| 330 | - <optgroup label="<?php echo JText::translate('VBOCHECKEDSTATUS'); ?>"> | |
| 333 | + <optgroup label="<?php echo JHtml::fetch('esc_attr', JText::translate('VBOCHECKEDSTATUS')); ?>"> | |
| 331 | 334 | <option value="checkedin"<?php echo $pstatus == 'checkedin' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBOCHECKEDSTATUSIN'); ?></option> |
| 332 | 335 | <option value="checkedout"<?php echo $pstatus == 'checkedout' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBOCHECKEDSTATUSOUT'); ?></option> |
| 333 | 336 | <option value="noshow"<?php echo $pstatus == 'noshow' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBOCHECKEDSTATUSNOS'); ?></option> |
| 334 | 337 | <option value="none"<?php echo $pstatus == 'none' ? ' selected="selected"' : ''; ?>><?php echo JText::translate('VBOCHECKEDSTATUSZERO'); ?></option> |
| @@ -342,9 +345,9 @@ | ||
| 342 | 345 | $pdatefiltfrom = $app->getUserStateFromRequest("vbo.orders.datefiltfrom", 'datefiltfrom', '', 'string'); |
| 343 | 346 | $pdatefiltto = $app->getUserStateFromRequest("vbo.orders.datefiltto", 'datefiltto', '', 'string'); |
| 344 | 347 | if (!empty($pdatefilt) && (!empty($pdatefiltfrom) || !empty($pdatefiltto))) { |
| 345 | 348 | $filters_set = true; |
| 346 | - $dates_filter = '&datefilt='.$pdatefilt.(!empty($pdatefiltfrom) ? '&datefiltfrom='.$pdatefiltfrom : '').(!empty($pdatefiltto) ? '&datefiltto='.$pdatefiltto : ''); | |
| 349 | + $dates_filter = JHtml::fetch('esc_attr', '&datefilt='.$pdatefilt.(!empty($pdatefiltfrom) ? '&datefiltfrom='.$pdatefiltfrom : '').(!empty($pdatefiltto) ? '&datefiltto='.$pdatefiltto : '')); | |
| 347 | 350 | } |
| 348 | 351 | $datesel = '<select name="datefilt" onchange="vboToggleDateFilt(this.value);"><option value="">'.JText::translate('VBOFILTERBYDATES').'</option>'; |
| 349 | 352 | $datesel .= '<option value="1"'.(!empty($pdatefilt) && $pdatefilt == 1 ? ' selected="selected"' : '').'>'.JText::translate('VBOFILTERDATEBOOK').'</option>'; |
| 350 | 353 | $datesel .= '<option value="2"'.(!empty($pdatefilt) && $pdatefilt == 2 ? ' selected="selected"' : '').'>'.JText::translate('VBOFILTERDATEIN').'</option>'; |
| @@ -353,9 +356,9 @@ | ||
| 353 | 356 | echo $datesel; |
| 354 | 357 | ?> |
| 355 | 358 | </div> |
| 356 | 359 | <div class="btn-group pull-left" id="vbo-dates-cont" style="display: <?php echo (!empty($pdatefilt) && (!empty($pdatefiltfrom) || !empty($pdatefiltto)) ? 'inline-block' : 'none'); ?>;"> |
| 357 | - <input type="text" id="vbo-date-from" placeholder="<?php echo JText::translate('VBNEWSEASONONE'); ?>" value="<?php echo $pdatefiltfrom; ?>" size="10" name="datefiltfrom" autocomplete="off" /> - <input type="text" id="vbo-date-to" placeholder="<?php echo JText::translate('VBNEWSEASONTWO'); ?>" value="<?php echo $pdatefiltto; ?>" size="10" name="datefiltto" autocomplete="off" /> | |
| 360 | + <input type="text" id="vbo-date-from" placeholder="<?php echo JText::translate('VBNEWSEASONONE'); ?>" value="<?php echo JHtml::fetch('esc_attr', $pdatefiltfrom); ?>" size="10" name="datefiltfrom" autocomplete="off" /> - <input type="text" id="vbo-date-to" placeholder="<?php echo JText::translate('VBNEWSEASONTWO'); ?>" value="<?php echo JHtml::fetch('esc_attr', $pdatefiltto); ?>" size="10" name="datefiltto" autocomplete="off" /> | |
| 358 | 361 | </div> |
| 359 | 362 | <div class="btn-group pull-left"> |
| 360 | 363 | <button type="submit" class="btn btn-primary"><i class="icon-search"></i> <?php echo JText::translate('VBPVIEWORDERSSEARCHSUBM'); ?></button> |
| 361 | 364 | </div> |
| @@ -762,9 +765,9 @@ | ||
| 762 | 765 | <?php |
| 763 | 766 | if (!empty($row['adminnotes'])) { |
| 764 | 767 | ?> |
| 765 | 768 | <span class="vbo-admin-tipsicon vbo-admin-notes-icn" data-bid="<?php echo $row['id']; ?>"><?php VikBookingIcons::e('sticky-note'); ?></span> |
| 766 | - <div class="vbo-order-admin-notes-cnt" data-bid="<?php echo $row['id']; ?>" style="display: none;"><?php echo nl2br($row['adminnotes']); ?></div> | |
| 769 | + <div class="vbo-order-admin-notes-cnt" data-bid="<?php echo $row['id']; ?>" style="display: none;"><?php echo nl2br(htmlspecialchars($row['adminnotes'])); ?></div> | |
| 767 | 770 | <?php |
| 768 | 771 | } |
| 769 | 772 | |
| 770 | 773 | // build the proper invoice SID for bc |
| @@ -816,9 +819,9 @@ | ||
| 816 | 819 | |
| 817 | 820 | </table> |
| 818 | 821 | </div> |
| 819 | 822 | <input type="hidden" name="option" value="com_vikbooking" /> |
| 820 | -<input type="hidden" name="cust_id" id="cust_id" value="<?php echo !empty($pcust_id) ? $pcust_id : ''; ?>" /> | |
| 823 | +<input type="hidden" name="cust_id" id="cust_id" value="<?php echo !empty($pcust_id) ? JHtml::fetch('esc_attr', $pcust_id) : ''; ?>" /> | |
| 821 | 824 | <input type="hidden" name="task" value="orders" /> |
| 822 | 825 | <input type="hidden" name="boxchecked" value="0" /> |
| 823 | 826 | <?php echo JHtml::fetch('form.token'); ?> |
| 824 | 827 | <?php echo $navbut; ?> |
| @@ -1173,9 +1176,9 @@ | ||
| 1173 | 1176 | tmpl: "component", |
| 1174 | 1177 | id_order: all_bids |
| 1175 | 1178 | }, |
| 1176 | 1179 | (res) => { |
| 1177 | - var counters = JSON.parse(res); | |
| 1180 | + var counters = typeof res === 'object' ? res : JSON.parse(res); | |
| 1178 | 1181 | for (var bid in all_bids) { |
| 1179 | 1182 | if (!all_bids.hasOwnProperty(bid)) { |
| 1180 | 1183 | continue; |
| 1181 | 1184 | } |
| @@ -1242,13 +1245,13 @@ | ||
| 1242 | 1245 | <div class="vbo-gen-invoices-helper" style="display: none;"> |
| 1243 | 1246 | <form action="index.php?option=com_vikbooking" method="post" id="vbo-geninv-form"> |
| 1244 | 1247 | <div class="vbo-calendar-cfield-entry"> |
| 1245 | 1248 | <label for="invoice_num"><?php echo JText::translate('VBINVSTARTNUM'); ?></label> |
| 1246 | - <span><input type="number" min="1" size="4" value="<?php echo $nextinvnum; ?>" id="invoice_num" name="invoice_num" /></span> | |
| 1249 | + <span><input type="number" min="1" size="4" value="<?php echo JHtml::fetch('esc_attr', $nextinvnum); ?>" id="invoice_num" name="invoice_num" /></span> | |
| 1247 | 1250 | </div> |
| 1248 | 1251 | <div class="vbo-calendar-cfield-entry"> |
| 1249 | 1252 | <label for="invoice_suff"><?php echo JText::translate('VBINVNUMSUFFIX'); ?></label> |
| 1250 | - <span><input type="text" size="7" value="<?php echo $invsuff; ?>" id="invoice_suff" name="invoice_suff" /></span> | |
| 1253 | + <span><input type="text" size="7" value="<?php echo JHtml::fetch('esc_attr', $invsuff); ?>" id="invoice_suff" name="invoice_suff" /></span> | |
| 1251 | 1254 | </div> |
| 1252 | 1255 | <div class="vbo-calendar-cfield-entry"> |
| 1253 | 1256 | <label for="invoice_date"><?php echo JText::translate('VBINVUSEDATE'); ?></label> |
| 1254 | 1257 | <span> |
| @@ -1255,9 +1258,9 @@ | ||
| 1255 | 1258 | <select id="invoice_date" name="invoice_date"> |
| 1256 | 1259 | <?php |
| 1257 | 1260 | if (!empty($oldinvdate)) { |
| 1258 | 1261 | ?> |
| 1259 | - <option value="<?php echo date($df, $oldinvdate); ?>"><?php echo date($df, $oldinvdate); ?></option> | |
| 1262 | + <option value="<?php echo JHtml::fetch('esc_attr', date($df, $oldinvdate)); ?>"><?php echo date($df, $oldinvdate); ?></option> | |
| 1260 | 1263 | <?php |
| 1261 | 1264 | } |
| 1262 | 1265 | ?> |
| 1263 | 1266 | <option value="<?php echo date($df, time()); ?>"><?php echo date($df, time()); ?></option> |
| @@ -1277,12 +1280,12 @@ | ||
| 1277 | 1280 | |
| 1278 | 1281 | </div> |
| 1279 | 1282 | <?php |
| 1280 | 1283 | foreach ($cid as $invid) { |
| 1281 | - echo '<input type="hidden" name="cid[]" value="'.$invid.'" />'; | |
| 1284 | + echo '<input type="hidden" name="cid[]" value="'. (int) $invid . '" />'; | |
| 1282 | 1285 | } |
| 1283 | 1286 | if ($pconfirmgen > 0) { |
| 1284 | - echo '<input type="hidden" name="confirmgen" value="'.$cid[0].'" />'; | |
| 1287 | + echo '<input type="hidden" name="confirmgen" value="' . (int) $cid[0] . '" />'; | |
| 1285 | 1288 | } |
| 1286 | 1289 | ?> |
| 1287 | 1290 | <input type="hidden" name="option" value="com_vikbooking" /> |
| 1288 | 1291 | <input type="hidden" name="task" value="geninvoices" /> |
| @@ -1300,9 +1303,9 @@ | ||
| 1300 | 1303 | footer_right: '<button type="button" class="btn btn-success" onclick="document.getElementById(\'vbo-geninv-form\').submit();"><i class="vboicn-file-text2"></i><?php echo addslashes(JText::translate('VBOGENINVOICES')); ?></button>', |
| 1301 | 1304 | <?php |
| 1302 | 1305 | if (count($cid) === 1) { |
| 1303 | 1306 | ?> |
| 1304 | - footer_left: '<a href="index.php?option=com_vikbooking&task=editbusy&cid[]=<?php echo $cid[0]; ?>&frominv=1" class="btn vbo-config-btn"><?php echo addslashes(JText::translate('VBINVEDITBINFO')); ?></a>', | |
| 1307 | + footer_left: '<a href="index.php?option=com_vikbooking&task=editbusy&cid[]=<?php echo (int) $cid[0]; ?>&frominv=1" class="btn vbo-config-btn"><?php echo addslashes(JText::translate('VBINVEDITBINFO')); ?></a>', | |
| 1305 | 1308 | <?php |
| 1306 | 1309 | } |
| 1307 | 1310 | ?> |
| 1308 | 1311 | onDismiss: () => { |
