From 54b153049c67318cecd1754e936d83936881dbc5 Mon Sep 17 00:00:00 2001
From: Paul Simon <paul@zhservices.com>
Date: Thu, 20 Jan 2011 23:08:24 +0530
Subject: [PATCH] The issue of error coming when magic quotes is on is dealt
 with.We have coded in such a way that it works, irrespective of the magic
 quotes settings.

Signed-off-by: Paul Simon <paul@zhservices.com>
---
 interface/billing/billing_report.php | 8 ++++++++
 interface/reports/report.inc.php     | 9 +++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/interface/billing/billing_report.php b/interface/billing/billing_report.php
index 307bbf8dd..73b4c5a89 100644
--- a/interface/billing/billing_report.php
+++ b/interface/billing/billing_report.php
@@ -4,6 +4,13 @@
 // as published by the Free Software Foundation; either version 2
 // of the License, or (at your option) any later version.
 
+
+// WHEN CONVERT THIS TO NEW SECURITY MODEL, NEED TO REMOVE FOLLOWING
+//   AT APPROXIMATELY LINE 377:
+//     $_REQUEST = stripslashes_deep($_REQUEST);
+// http://www.openmedsoftware.org/wiki/Active_Projects#PLAN
+
+
 require_once("../globals.php");
 require_once("../../library/acl.inc");
 require_once("../../custom/code_types.inc.php");
@@ -369,6 +376,7 @@ document.onclick=TakeActionOnHide;
 //$ThisPageSearchCriteriaDisplayMaster ==>It is the display on screen for the set of criteria.
 //$ThisPageSearchCriteriaKeyMaster ==>Corresponding database fields in the same order.
 //$ThisPageSearchCriteriaDataTypeMaster ==>Corresponding data type in the same order.
+$_REQUEST = stripslashes_deep($_REQUEST);//To deal with magic quotes on.
 $ThisPageSearchCriteriaDisplayRadioMaster=array();
 $ThisPageSearchCriteriaRadioKeyMaster=array();
 $ThisPageSearchCriteriaQueryDropDownMaster=array();
diff --git a/interface/reports/report.inc.php b/interface/reports/report.inc.php
index 6b69991c7..10529e617 100644
--- a/interface/reports/report.inc.php
+++ b/interface/reports/report.inc.php
@@ -27,6 +27,11 @@
 ?>
 <!-- Common php functions are stored in this page.  -->
 <?php
+function stripslashes_deep($value)
+{
+    $value = is_array($value) ? array_map('stripslashes_deep', $value) : strip_escape_custom($value);
+    return $value;
+}
 function PrepareSearchItem($SearchItem)
  {//Parses the search value part of the criteria and prepares for sql.
   $SplitArray=split(' like ',$SearchItem);
@@ -34,7 +39,7 @@ function PrepareSearchItem($SearchItem)
    {
     $SplitArray[1] = substr($SplitArray[1], 0, -1); 
     $SplitArray[1] = substr($SplitArray[1], 1); 
-    $SearchItem=$SplitArray[0].' like '."'".formDataCore($SplitArray[1])."'";
+    $SearchItem=$SplitArray[0].' like '."'".add_escape_custom($SplitArray[1])."'";
    }
   else
    {
@@ -43,7 +48,7 @@ function PrepareSearchItem($SearchItem)
        {
         $SplitArray[1] = substr($SplitArray[1], 0, -1); 
         $SplitArray[1] = substr($SplitArray[1], 1); 
-        $SearchItem=$SplitArray[0].' = '."'".formDataCore($SplitArray[1])."'";
+        $SearchItem=$SplitArray[0].' = '."'".add_escape_custom($SplitArray[1])."'";
        }
    }
   return($SearchItem);
-- 
2.11.4.GIT