diff --git a/application/controllers/Reports.php b/application/controllers/Reports.php
index 73fcefa5d..343b9062f 100644
--- a/application/controllers/Reports.php
+++ b/application/controllers/Reports.php
@@ -422,6 +422,7 @@ class Reports extends Secure_area
$this->load->view("reports/graphical", $data);
}
+ // escape js text to avoid any issue with php strings having only one \ where js requires \\
private function _escapeJavaScriptText($string)
{
return str_replace("\n", '\n', str_replace('"', '\"', addcslashes(str_replace("\r", '', (string)$string), "\0..\37'\\")));
@@ -469,7 +470,7 @@ class Reports extends Secure_area
$series = '';
foreach($report_data as $row)
{
- $labels .= "'" . $row['category'] . "', ";
+ $labels .= "'" . $this->_escapeJavaScriptText($row['category']) . "', ";
$series .= $row['total'] . ", ";
}
@@ -497,7 +498,7 @@ class Reports extends Secure_area
$series = '';
foreach($report_data as $row)
{
- $labels .= "'" . $row['supplier'] . "', ";
+ $labels .= "'" . $this->_escapeJavaScriptText($row['supplier']) . "', ";
$series .= $row['total'] . ", ";
}
@@ -525,7 +526,7 @@ class Reports extends Secure_area
$series = '';
foreach($report_data as $row)
{
- $labels .= "'" . $row['employee'] . "', ";
+ $labels .= "'" . $this->_escapeJavaScriptText($row['employee']) . "', ";
$series .= $row['total'] . ", ";
}
@@ -581,7 +582,7 @@ class Reports extends Secure_area
$series = '';
foreach($report_data as $row)
{
- $labels .= "'" . $row['customer'] . "', ";
+ $labels .= "'" . $this->_escapeJavaScriptText($row['customer']) . "', ";
$series .= $row['total'] . ", ";
}
diff --git a/application/views/partial/header.php b/application/views/partial/header.php
index 2f5c45240..4b1f78f27 100644
--- a/application/views/partial/header.php
+++ b/application/views/partial/header.php
@@ -64,7 +64,7 @@
-
+
diff --git a/application/views/reports/graphs/bar.php b/application/views/reports/graphs/bar.php
index 9f5f01c57..587796927 100644
--- a/application/views/reports/graphs/bar.php
+++ b/application/views/reports/graphs/bar.php
@@ -1,30 +1,3 @@
-
-