XSS clean Reports (#39)

This commit is contained in:
FrancescoUK
2016-06-06 22:36:07 +01:00
parent da96edf304
commit 9248ffd044
4 changed files with 276 additions and 216 deletions

View File

File diff suppressed because it is too large Load Diff

View File

@@ -4,7 +4,7 @@
* Currency locale
*/
function to_currency($number, $escape=FALSE)
function to_currency($number, $escape = FALSE)
{
$CI =& get_instance();
@@ -14,26 +14,40 @@ function to_currency($number, $escape=FALSE)
$decimal_point = $CI->config->item('decimal_point') ? $CI->config->item('decimal_point') : '.';
$decimals = $CI->config->item('currency_decimals') ? $CI->config->item('currency_decimals') : 0;
// the conversion function needs a non null var, so if the number is null set it to 0
if(empty($number))
{
$number = 0;
}
if($number >= 0)
{
if(!$CI->config->item('currency_side'))
{
return $currency_symbol.number_format($number, $decimals, $decimal_point, $thousands_separator);
}
else
{
return number_format($number, $decimals, $decimal_point, $thousands_separator).$currency_symbol;
}
}
else
{
if(!$CI->config->item('currency_side'))
{
return '-'.$currency_symbol.number_format(abs($number), $decimals, $decimal_point, $thousands_separator);
}
else
{
return '-'.number_format(abs($number), $decimals, $decimal_point, $thousands_separator).$currency_symbol;
}
}
}
function to_currency_no_money($number)
{
// ignore empty strings as they are just for empty input
if( empty($number) )
if(empty($number))
{
return $number;
}

View File

@@ -20,8 +20,8 @@ class Inventory_low extends Report
public function getData(array $inputs)
{
$this->db->from('items');
$this->db->join('item_quantities','items.item_id=item_quantities.item_id');
$this->db->join('stock_locations','item_quantities.location_id=stock_locations.location_id');
$this->db->join('item_quantities', 'items.item_id=item_quantities.item_id');
$this->db->join('stock_locations', 'item_quantities.location_id=stock_locations.location_id');
$this->db->select('name, item_number, reorder_level, item_quantities.quantity, description, location_name');
$this->db->where('item_quantities.quantity <= reorder_level');
$this->db->where('items.deleted', 0);

View File

@@ -23,15 +23,15 @@ class Inventory_summary extends Report
public function getData(array $inputs)
{
$this->db->from('items');
$this->db->join('item_quantities','items.item_id=item_quantities.item_id');
$this->db->join('stock_locations','item_quantities.location_id=stock_locations.location_id');
$this->db->join('item_quantities', 'items.item_id=item_quantities.item_id');
$this->db->join('stock_locations', 'item_quantities.location_id=stock_locations.location_id');
$this->db->select('name, item_number, reorder_level, item_quantities.quantity, description, location_name, cost_price, unit_price, (cost_price*quantity) AS sub_total_value');
$this->db->where('items.deleted', 0);
// should be corresponding to values Inventory_summary::getItemCountDropdownArray() returns...
if($inputs['item_count'] == 'zero_and_less')
{
$this->db->where('quantity <= ');
$this->db->where('quantity <= 0');
}
elseif($inputs['item_count'] == 'more_than_zero')
{
@@ -71,8 +71,7 @@ class Inventory_summary extends Report
*/
public function getItemCountDropdownArray()
{
return array(
'all' => $this->lang->line('reports_all'),
return array('all' => $this->lang->line('reports_all'),
'zero_and_less' => $this->lang->line('reports_zero_and_less'),
'more_than_zero' => $this->lang->line('reports_more_than_zero'));
}