// Merge -> revision 8800

modules/mondialrelay/AdminMondialRelay.php

@@ -68,7 +68,7 @@ class AdminMondialRelay extends AdminTab
 			$html.= '<h3 style="color:red;">' . $this->l('No orders with this state.') . '</h3>';
 		else
 		{
-			$html.= '<form method="post" action="'.$_SERVER['REQUEST_URI'].'">';
+			$html.= '<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">';
 			$html.= "\n<table class=\"table\" id='orders'>";
 			$html.= '<tr>';
 			$html.= '<th>'.$this->l('Order ID').'</th>';
@@ -152,7 +152,7 @@ class AdminMondialRelay extends AdminTab
 			<fieldset>
 				<legend>' . $this->l('History of labels creation') . '</legend>
 				<div style="overflow-x: auto;overflow-y: scroller; height: 300px; padding-top: 0.6em;" >
-					<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+					<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 						<table class="table" id="PS_MRHistoriqueTableList">
 							<tbody>
 								<tr>

modules/mondialrelay/classes/MRCreateTickets.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -228,7 +228,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 						'required'				=> false,
 						'value'						=> '',
 						'regexValidation' => '#^([^<>&\']{3,30})(\(cr\)[^<>&\']{0,30}){0,9}$#')));
-	
+
 	private $_orderListId = NULL;
 	private $_totalOrder = 0;
 	private $_weightList = NULL;
@@ -236,14 +236,14 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	private $_fieldsList = array();
 	private $_webServiceKey =	'';
 	private $_markCode = '';
-	
+
 	private $_resultList = array(
 		'error' => array(),
 		'success' => array());
-	
+
 	private $_webserviceURL = 'http://www.mondialrelay.fr/webservice/Web_Services.asmx?WSDL';
-	
-	public function __construct($params)	
+
+	public function __construct($params)
 	{
 		$this->_orderListId = $params['orderIdList'];
 		$this->_totalOrder = $params['totalOrder'];
@@ -251,12 +251,12 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		$this->_webServiceKey = Configuration::get('MR_KEY_WEBSERVICE');
 		$this->_markCode = Configuration::get('MR_CODE_MARQUE');
 	}
-	
+
 	public function __destruct()
 	{
 		 unset($this->_mondialRelay);
 	}
-	
+
 	/*
 	 * Build a correct weight format (NNNNN)
 	 */
@@ -266,13 +266,13 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$weight = '0'.$weight;
 		return $weight;
 	}
-	
+
 	/*
 	 * Set the default value to the order paramaters
 	 */
 	private function _setRequestDefaultValue()
 	{
-		
+
 		$this->_fields['list']['Enseigne']['value'] = Configuration::get('MR_ENSEIGNE_WEBSERVICE');
 		$this->_fields['list']['Expe_Langage']['value'] = Configuration::get('MR_LANGUAGE');
 		$this->_fields['list']['Expe_Ad1']['value'] = Configuration::get('PS_MR_SHOP_NAME');
@@ -282,19 +282,19 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		$this->_fields['list']['Expe_Ville']['value'] = Configuration::get('PS_SHOP_CITY');
 		$this->_fields['list']['Expe_CP']['value'] = Configuration::get('PS_SHOP_CODE');
 		$this->_fields['list']['Expe_CP']['params']['id_country'] = Configuration::get('PS_COUNTRY_DEFAULT');
-		
+
 		if (_PS_VERSION_ >= '1.4')
 		$this->_fields['list']['Expe_Pays']['value'] = Country::getIsoById(Configuration::get('PS_SHOP_COUNTRY_ID'));
 		else
 			$this->_fields['list']['Expe_Pays']['value'] = substr(Configuration::get('PS_SHOP_COUNTRY'), 0, 2);
-			
+
 		$this->_fields['list']['Expe_Tel1']['value'] = str_replace(array('.', ' ', '-'), '', Configuration::get('PS_SHOP_PHONE'));
 		$this->_fields['list']['Expe_Mail']['value'] = Configuration::get('PS_SHOP_EMAIL');
 		$this->_fields['list']['NbColis']['value'] = 1;
 		$this->_fields['list']['CRT_Valeur']['value'] = 0;
 		$this->_fields['list']['CRT_Devise']['value'] = 'EUR';
 	}
-	
+
 	/*
 	 * Initiate the data needed to be send properly
 	 * Can manage a list of data for multiple request
@@ -302,10 +302,10 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	public function init()
 	{
 		$this->_mondialRelay = new MondialRelay();
-		
+
 		if ($this->_totalOrder == 0)
 			throw new Exception($this->_mondialRelay->l('Please select at least one order'));
-		
+
 		$this->_setRequestDefaultValue();
 		if (count($orderListDetails = $this->_mondialRelay->getOrders($this->_orderListId)))
 		{
@@ -314,10 +314,10 @@ class MRCreateTickets implements IMondialRelayWSMethod
 				// Storage temporary
 				$base = $this->_fields;
 				$tmp = &$base['list'];
-				
+
 				$deliveriesAddress = new Address($orderDetail['id_address_delivery']);
 				$customer = new Customer($orderDetail['id_customer']);
-				
+
 				// Store the weight order set by the user
 				foreach($this->_weightList as $orderWeightInfos)
 				{
@@ -325,7 +325,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 					if (count($detail) == 2 && $detail[1] == $orderDetail['id_order'])
 						$tmp['Poids']['value'] = $this->_weightFormat($detail[0]);
 				}
-				
+
 				$destIsoCode = Country::getIsoById($deliveriesAddress->id_country);
 				$tmp['ModeCol']['value'] = $orderDetail['mr_ModeCol'];
 				$tmp['ModeLiv']['value'] = $orderDetail['mr_ModeLiv'];
@@ -343,16 +343,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 				$tmp['Dest_Tel2']['value'] = $deliveriesAddress->phone_mobile;
 				$tmp['Dest_Mail']['value'] = $customer->email;
 				$tmp['Assurance']['value'] = $orderDetail['mr_ModeAss'];
-				
+
 				if ($orderDetail['MR_Selected_Num'] != 'LD1' && $orderDetail['MR_Selected_Num'] != 'LDS')
 				{
 					$tmp['LIV_Rel_Pays']['value'] = $orderDetail['MR_Selected_Pays'];
 					$tmp['LIV_Rel']['value'] = $orderDetail['MR_Selected_Num'];
 				}
-				
+
 				// Store the necessary information to the root case table
 				$base['id_mr_selected'] = $orderDetail['id_mr_selected'];
-				
+
 				// Add the temporary values to a field list for multiple request
 				$this->_fieldsList[] = $base;
 				unset($deliveriesAddress);
@@ -361,7 +361,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$this->_generateMD5SecurityKey();
 		}
 	}
-	
+
 	/*
 	 * Generate the MD5 key for each param list
 	 */
@@ -379,24 +379,24 @@ class MRCreateTickets implements IMondialRelayWSMethod
 					// TODO : test on windows and linux server
 					$cleanedString = MRTools::replaceAccentedCharacters($valueDetailed['value']);
 					$valueDetailed['value'] = !empty($cleanedString) ? strtoupper($cleanedString) : strtoupper($valueDetailed['value']);
-					
+
 					// Call a pointer function if exist to do different test
 					if (isset($valueDetailed['methodValidation']) &&
-							method_exists('MRTools', $valueDetailed['methodValidation']) && 
-							isset($valueDetailed['params']) && 
+							method_exists('MRTools', $valueDetailed['methodValidation']) &&
+							isset($valueDetailed['params']) &&
 							MRTools::$valueDetailed['methodValidation']($valueDetailed['value'], $valueDetailed['params']))
 						$concatenationValue .= $valueDetailed['value'];
 					// Use simple Regex test given by MondialRelay
 					else if (isset($valueDetailed['regexValidation']) &&
 							preg_match($valueDetailed['regexValidation'], $valueDetailed['value'], $matches))
 						$concatenationValue .= $valueDetailed['value'];
-					// If the key is required, we set an error, else it's skipped 
+					// If the key is required, we set an error, else it's skipped
 					else if ((!strlen($valueDetailed['value']) && $valueDetailed['required']) || strlen($valueDetailed['value']))
 					{
 						if (empty($valueDetailed['value']))
 							$error = $this->_mondialRelay->l('This key').' ['.$paramName.'] '.$this->_mondialRelay->l('is empty and need to be filled');
 						else
-							$error = 'This key ['.$paramName.'] hasn\'t a valid value format : '.$valueDetailed['value']; 
+							$error = 'This key ['.$paramName.'] hasn\'t a valid value format : '.$valueDetailed['value'];
 						$this->_resultList['error'][$rootCase['list']['NDossier']['value']][] = $error;
 					}
 				}
@@ -404,7 +404,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$rootCase['list']['Security']['value'	] = strtoupper(md5($concatenationValue));
 		}
 	}
-	
+
 	/*
 	 * Update the tables used and send mail with the order history
 	 */
@@ -412,34 +412,34 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		Db::getInstance()->Execute('
 			UPDATE `'._DB_PREFIX_.'mr_selected`
-			SET `MR_poids` = \''.$params['Poids'].'\',
-					`exp_number` = \''.$expeditionNum.'\',
-					`url_etiquette` = \''.$ticketURL.'\',
-					`url_suivi` = \''.$trackingURL.'\'
+			SET `MR_poids` = \''.pSQL($params['Poids']).'\',
+					`exp_number` = \''.pSQL($expeditionNum).'\',
+					`url_etiquette` = \''.pSQL($ticketURL).'\',
+					`url_suivi` = \''.pSQL($trackingURL).'\'
 			WHERE id_mr_selected = '.(int)$id_mr_selected);
-		
+
 		// NDossier contains the id_order
 		$order = new Order($params['NDossier']);
-	  
+
 	 	// Update the database for order and orderHistory
 		$order->shipping_number = $id_mr_selected;
 		$order->update();
-		
+
 		$templateVars = array('{followup}' => $trackingURL);
-		$orderState = (Configuration::get('PS_OS_SHIPPING')) ? 
-			Configuration::get('PS_OS_SHIPPING') : 
+		$orderState = (Configuration::get('PS_OS_SHIPPING')) ?
+			Configuration::get('PS_OS_SHIPPING') :
 			_PS_OS_SHIPPING_;
-					
+
 		$history = new OrderHistory();
-		$history->id_order = (int)($params['NDossier']);
-		$history->changeIdOrderState($orderState, (int)($params['NDossier'])); 
+		$history->id_order = (int)$params['NDossier'];
+		$history->changeIdOrderState($orderState, (int)$params['NDossier']);
 		$history->id_employee = (int)Context::getContext()->employee->id;
 		$history->addWithemail(true, $templateVars);
 
 		unset($order);
 		unset($history);
 	}
-	
+
 	/*
 	 * Manage the return value of the webservice, handle the errors or build the
 	 * succeed message
@@ -448,11 +448,11 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		$errors = &$this->_resultList['error'][$params['NDossier']];
 		$success = &$this->_resultList['success'][$params['NDossier']];
-		
+
 		if ($client->fault)
 			$errors[] = $this->_mondialRelay->l('It seems the request isn\'t valid:').
 				$result;
-				
+
 		$result = $result['WSI2_CreationEtiquetteResult'];
 		if (($errorNumber = $result['STAT']) != 0)
 		{
@@ -470,16 +470,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$trackingURL = $baseURL.
 				'lg_fr/espaces/url/popup_exp_details.aspx?cmrq='.$params['Enseigne'].
 				$this->_markCode.'&nexp='.$expedition.'&crc='.$securityKey;
-				
+
 			$success['displayExpedition'] = $this->_mondialRelay->l('Expedition Number : ') . $expedition;
 			$success['displayTicketURL'] = $this->_mondialRelay->l('Ticket URL : ') . $ticketURL;
 			$success['displayTrackingURL'] = $this->_mondialRelay->l('Tracking URL: ') . $trackingURL;
 			$success['expeditionNumber'] = $expedition;
-			
-			$this->_updateTable($params, $expedition, $ticketURL, $trackingURL, $id_mr_selected);	
+
+			$this->_updateTable($params, $expedition, $ticketURL, $trackingURL, $id_mr_selected);
 		}
 	}
-	
+
 	/*
 	 * Send one or multiple request to the webservice
 	 */
@@ -489,16 +489,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		{
 			$client->soap_defencoding = 'UTF-8';
 			$client->decode_utf8 = false;
-			
+
 			foreach($this->_fieldsList as $rootCase)
 			{
 				$params = $this->_getSimpleParamArray($rootCase['list']);
 				$result = $client->call(
-					'WSI2_CreationEtiquette', 
-					$params, 
-					'http://www.mondialrelay.fr/webservice/', 
+					'WSI2_CreationEtiquette',
+					$params,
+					'http://www.mondialrelay.fr/webservice/',
 					'http://www.mondialrelay.fr/webservice/WSI2_CreationEtiquette');
-				
+
 				$this->_parseResult($client, $result, $params, $rootCase['id_mr_selected']);
 			}
 			unset($client);
@@ -506,7 +506,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		else
 			throw new Exception($this->_mondialRelay->l('The Mondial Relay webservice isn\'t currently reliable'));
 	}
-	
+
 	/*
 	 * Get the values with associated fields name
 	 * @fields : array containing multiple values information
@@ -514,12 +514,12 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	private function _getSimpleParamArray($fields)
 	{
 		$params = array();
-		
+
 		foreach($fields as $keyName => $valueDetailed)
 			$params[$keyName] = $valueDetailed['value'];
 		return $params;
 	}
-	
+
 	/*
 	 * Return the fields list
 	 */
@@ -527,7 +527,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		return $this->_fieldsList['list'];
 	}
-	
+
 	/*
 	 * Return the result of one or multiple sent requests
 	 */
@@ -535,7 +535,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		return $this->_resultList;
 	}
-	
+
 	/*
 	 * Return which number order of the list is currently managed
 	 */

modules/mondialrelay/classes/MRGetRelayPoint.php

@@ -187,7 +187,7 @@ class MRGetRelayPoint implements IMondialRelayWSMethod
 			unset($result['STAT']);
 			
 			// Clean Content
-			foreach($result as &$relayPoint)
+			foreach($result as $num => $relayPoint)
 			{
 				$totalEmptyFields = 0;
 				foreach ($relayPoint as $key => &$value)
@@ -197,11 +197,10 @@ class MRGetRelayPoint implements IMondialRelayWSMethod
  						++$totalEmptyFields;
  				}
  				if ($totalEmptyFields == count($relayPoint))
- 				{
- 					$errors[] = $this->_mondialRelay->l('MondialRelay can\'t find any relay point near your address. Maybe your address isn\'t properly filled ?');
- 					break;
+ 					unset($result[$num]);
  				}
- 			}
+ 			if (!count($result))
+ 				$errors[] = $this->_mondialRelay->l('MondialRelay can\'t find any relay point near your address. Maybe your address isn\'t properly filled ?');
 			$success = $result;
 		}
 		$this->_resultList['error'] = $errors;

modules/mondialrelay/classes/MRGetTickets.php

@@ -142,7 +142,7 @@ class MRGetTickets implements IMondialRelayWSMethod
 	{
 		$query = '
 			SELECT id FROM `'._DB_PREFIX_.'mr_historique`
-			WHERE `order`=\''.$id_order.'\'';
+			WHERE `order`='.(int)$id_order;
 		
 		$row = Db::getInstance()->getRow($query);
 		if ($row)
@@ -151,9 +151,9 @@ class MRGetTickets implements IMondialRelayWSMethod
 				UPDATE `'._DB_PREFIX_.'mr_historique`
   			SET 
   				`exp` = \''.(int)$expeditionNumber.'\',
-  				`url_a4` = \''.(string)$URLA4.'\',
-  				`url_a5` = \''.(string)$URLA5.'\'
-  			WHERE `order` = \''.$id_order.'\'';
+  				`url_a4` = \''.pSQL((string)$URLA4).'\',
+  				`url_a5` = \''.pSQL((string)$URLA5).'\'
+  			WHERE `order` = '.(int)$id_order;
 		}
 		else
 		{
@@ -161,10 +161,10 @@ class MRGetTickets implements IMondialRelayWSMethod
 				INSERT INTO '._DB_PREFIX_.'mr_historique
 				(`order`, `exp`, `url_a4`, `url_a5`)
 				VALUES (
-					\''.(int)$id_order.'\',
-					\''.(int)$expeditionNumber.'\',
-					\''.(string)$URLA4.'\',
-					\''.(string)$URLA5.'\')';
+					'.(int)$id_order.',
+					'.(int)$expeditionNumber.',
+					\''.pSQL((string)$URLA4).'\',
+					\''.pSQL((string)$URLA5).'\')';
 		}
 		Db::getInstance()->Execute($query);
 		$success['id_mr_history'] = isset($row['id']) ? $row['id'] : Db::getInstance()->Insert_ID();

modules/mondialrelay/mondialrelay.js

@@ -372,9 +372,11 @@ function PS_MRBackupDatabase()
 */
 function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
 {
+	PS_MRSelectedRelayPoint['relayPointNum'] = relayPointNumber;
+	
 	// Ajax call to add the selection in the database (compatibility for 1.3)
 	// But keep this way to add a selection better that the hook
-	$.ajax({
+	MRjQuery.ajax({
 		type: 'POST',
     url: _PS_MR_MODULE_DIR_ + 'ajax.php',
     data: {'method' : 'addSelectedCarrierToDB',
@@ -384,6 +386,7 @@ function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
     	'mrtoken' : mrtoken},
     success: function(json)
     {
+			
     },
     error: function(xhr, ajaxOptions, thrownError)
     {
@@ -398,6 +401,7 @@ function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
 function PS_MRAddSelectedCarrierInDB(id_carrier)
 {
 	PS_MRHideLastRelayPointList();
+
 	// Make the request
 	$.ajax({
 		type: 'POST',
@@ -417,12 +421,23 @@ function PS_MRAddSelectedCarrierInDB(id_carrier)
 
 function PS_MRCarrierSelectedProcess(carrierSelected, id_carrier, MRLivraisonType)
 {
+	// Reset for any carrier changement
 	if (MRLivraisonType != 'LD1' &&	MRLivraisonType != 'LDS')
+	{
 		// Seek Relay point if it doesn't a home delivery mode
 		PS_MRGetRelayPoint(carrierSelected);
+		
+		// Will have relay points
+		PS_MRSelectedRelayPoint['relayPointNum'] = 0;
+	}
 	else
+	{
 		// Simply add the selected carrier to the db, relay information will be empty
 		PS_MRAddSelectedCarrierInDB(id_carrier);
+		
+		// Won't have any relay points
+		PS_MRSelectedRelayPoint['relayPointNum'] = -1;
+}
 }
 
 /*
@@ -433,6 +448,26 @@ function PS_MRHideLastRelayPointList()
 	$('.PS_MRSelectedCarrier').fadeOut('fast');
 }
 
+/*
+** Check if the user select a carrier and a relay point if exist
+*/
+function PS_MRCheckSelectedRelayPoint()
+{
+	var input;
+	
+	// Check if the input is linked to the module and look into
+	// a temporary variable if a relay point has been selected
+	if ((input = $('input[name=id_carrier]:checked')).length &&
+		PS_MRCarrierMethodList[input.val()] != undefined &&
+		PS_MRSelectedRelayPoint['relayPointNum'] == 0)
+	{
+		//$('#PS_MRSelectCarrierError').fadeIn('fast');
+		alert(PS_MRTranslationList['errorSelection']);
+		return false;
+	}		
+	return true;
+}
+
 /*
 ** Link the generated relay point to an handle click
 ** Allow to add the selected relay point in the database
@@ -535,7 +570,7 @@ function PS_MRFetchRelayPoint(carrierSelected)
 		</td></tr>');
 	
 	fetchingRelayPoint[carrier_id] = $('#PS_MRSelectedCarrier_' + carrier_id);
-	$.ajax(
+	MRjQuery.ajax(
 	{
 		type: 'POST',
 		url: _PS_MR_MODULE_DIR_ + 'ajax.php',
@@ -748,6 +783,10 @@ function PS_MRAddGMapMarker(id_carrier, relayPointNumber, contentBlockid)
 
 $(document).ready(function()
 {
+	$('#form').submit(function()
+	{
+		return PS_MRCheckSelectedRelayPoint();
+	});
 	$('#toggleStatusOrderList').click(function()
 	{
 		toggleOrderListSelection();

modules/mondialrelay/mondialrelay.php

@@ -59,7 +59,7 @@ class MondialRelay extends Module
 	{
 		$this->name		= 'mondialrelay';
 		$this->tab		= 'shipping_logistics';
-		$this->version	= '1.7';
+		$this->version	= '1.7.3';
 
 		parent::__construct();
 
@@ -394,13 +394,20 @@ class MondialRelay extends Module
 	** Override a jQuery version included by another one us.
 	** Allow a compatibility for Presta < 1.4
 	*/
-	public static function getJqueryCompatibility()
+	public static function getJqueryCompatibility($overloadCurrent = false)
 	{
+		if ($overloadCurrent)
 		return '
 			<script type="text/javascript">
-				jq13 = jQuery.noConflict(true); 
+					current = jQuery.noConflict(true); 
 			</script>
 			<script type="text/javascript" src="'.self::$moduleURL.'/jquery-1.4.4.min.js"></script>';
+
+		return '
+			<script type="text/javascript" src="'.self::$moduleURL.'/jquery-1.4.4.min.js"></script>
+			<script type="text/javascript">
+				MRjQuery = jQuery.noConflict(true); 
+			</script>';
 	}
 	
 	public function hookNewOrder($params)
@@ -422,7 +429,8 @@ class MondialRelay extends Module
 				var _PS_MR_MODULE_DIR_ = "'.self::$moduleURL.'";
 				var mrtoken = "'.self::$MRBackToken.'";
 			</script>
-			<script type="text/javascript" src="'.$jsFilePath.'"></script>';
+			<script type="text/javascript" src="'.$jsFilePath.'"></script>'.
+			self::getJqueryCompatibility(true);
 	}
 	
 	private function _postValidation()
@@ -625,7 +633,8 @@ class MondialRelay extends Module
 							'one_page_checkout' => (Configuration::get('PS_ORDER_PROCESS_TYPE') ? Configuration::get('PS_ORDER_PROCESS_TYPE') : 0),
 							'new_base_dir' => self::$moduleURL,
 			'MRToken' => self::$MRFrontToken,
-			'carriersextra' => $carriersList));
+			'carriersextra' => $carriersList,
+			'jQueryOverload' => self::getJqueryCompatibility()));
 			
 			return $this->display(__FILE__, 'mondialrelay.tpl');
 		}
@@ -768,7 +777,7 @@ class MondialRelay extends Module
 				Db::getInstance()->Execute('
 				INSERT INTO `' . _DB_PREFIX_ . 'carrier`
 				(`url`, `name`, `active`, `is_module`, `range_behavior`)
-				VALUES(NULL, "'.pSQL('mondialrelay').'", "1", "1", "1")');
+				VALUES(NULL, "'.pSQL('mondialrelay').'", "1", "0", "1")');
 
 			$get   = Db::getInstance()->getRow('SELECT * FROM `' . _DB_PREFIX_ . 'carrier` WHERE `id_carrier` = "' . Db::getInstance()->Insert_ID() . '"');
 			Db::getInstance()->Execute('UPDATE `' . _DB_PREFIX_ . 'mr_method` SET `id_carrier` = "' . (int)($get['id_carrier']) . '" WHERE `id_mr_method` = "' . pSQL($mainInsert) . '"');
@@ -806,7 +815,7 @@ class MondialRelay extends Module
 	{
 		$zones = Db::getInstance()->ExecuteS("SELECT * FROM " . _DB_PREFIX_ . "zone WHERE active = 1");
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post" >
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" >
 			<fieldset>
 				<legend><img src="../modules/mondialrelay/images/logo.gif" alt="" />'.$this->l('Add a Shipping Method').'</legend>
 				<ul>
@@ -815,7 +824,7 @@ class MondialRelay extends Module
 					</li>
 					<li>
 						<label for="mr_Name" class="shipLabel">'.$this->l('Carrier\'s name').'<sup>*</sup></label>
-						<input type="text" id="mr_Name" name="mr_Name" '.(Tools::getValue('mr_Name') ? 'value="'.Tools::getValue('mr_Name').'"' : '').'/>
+						<input type="text" id="mr_Name" name="mr_Name" '.(Tools::getValue('mr_Name') ? 'value="'.Tools::safeOutput(Tools::getValue('mr_Name')).'"' : '').'/>
 					</li>
 					<li>
 						<label for="mr_ModeCol" class="shipLabel">'.$this->l('Collection Mode').'<sup>*</sup></label>
@@ -878,7 +887,7 @@ class MondialRelay extends Module
 		WHERE c.`deleted` = 0');
 			
 		$output = '
-		<form action="' . $_SERVER['REQUEST_URI'] . '" method="post">
+		<form action="' . Tools::safeOutput($_SERVER['REQUEST_URI']) . '" method="post">
 			<fieldset class="shippingList">
 				<legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Shipping Method\'s list').'</legend>
 				<ol>';
@@ -942,7 +951,7 @@ class MondialRelay extends Module
 		
 		// Check if a request exist and if errors occured, use the post variable
 		if (Tools::isSubmit('PS_MRSubmitFieldPersonalization') && count($this->_postErrors))
-			$addr1 = Tools::getValue('Expe_ad1');
+			$addr1 = Tools::safeOutput(Tools::getValue('Expe_ad1'));
 			
 
 		if (!Configuration::get('PS_MR_SHOP_NAME'))
@@ -950,7 +959,7 @@ class MondialRelay extends Module
 				$this->l('Its seems you updated Mondialrelay without use the uninstall / install method, you have to set up this part to make working the generating ticket process').
 				'</div>';			
 		// Form
-		$form = '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">';
+		$form = '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">';
 		$form .= '
 			<fieldset class="PS_MRFormStyle">
 				<legend>
@@ -983,7 +992,7 @@ class MondialRelay extends Module
 	{
 		$this->orderState = Configuration::get('MONDIAL_RELAY_ORDER_STATE');
 	    $output = '';
-		$output .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">';
+		$output .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">';
 		$output .= '<fieldset><legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Settings').'</legend>';
 		$output .= '<label for="id_order_state">' . $this->l('Order state') . '</label>';
 		$output .= '<div class="margin-form">';
@@ -1012,7 +1021,7 @@ class MondialRelay extends Module
 	public function settingsForm()
 	{
 		$output = '
-			<form action="' . $_SERVER['REQUEST_URI'] . '" method="post" >
+			<form action="' . Tools::safeOutput($_SERVER['REQUEST_URI']) . '" method="post" >
 				<fieldset>
 					<legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Mondial Relay Account Settings').'</legend>
 					<div>
@@ -1025,22 +1034,22 @@ class MondialRelay extends Module
 						<li>
 							<label for="mr_Enseigne_WebService" class="mrLabel">' . $this->l('Webservice Enseigne:') . '<sup>*</sup></label>
 							<input id="mr_Enseigne_WebService" class="mrInput" type="text" name="mr_Enseigne_WebService" value="' .
-							(Tools::getValue('mr_Enseigne_WebService') ? Tools::getValue('mr_Enseigne_WebService') : Configuration::get('MR_ENSEIGNE_WEBSERVICE')) . '"/>
+							(Tools::getValue('mr_Enseigne_WebService') ? Tools::safeOutput(Tools::getValue('mr_Enseigne_WebService')) : Configuration::get('MR_ENSEIGNE_WEBSERVICE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_code_marque" class="mrLabel">' . $this->l('Code marque:') . '<sup>*</sup></label>
 							<input id="mr_code_marque" class="mrInput" type="text" name="mr_code_marque" value="' .
-							(Tools::getValue('mr_code_marque') ? Tools::getValue('mr_code_marque') : Configuration::get('MR_CODE_MARQUE')) . '"/>
+							(Tools::getValue('mr_code_marque') ? Tools::safeOutput(Tools::getValue('mr_code_marque')) : Configuration::get('MR_CODE_MARQUE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_Key_WebService" class="mrLabel">' . $this->l('Webservice Key:') . '<sup>*</sup></label>
 							<input id="mr_Key_WebService" class="mrInput" type="text" name="mr_Key_WebService" value="' .
-							(Tools::getValue('mr_Key_WebService') ? Tools::getValue('mr_Key_WebService') : Configuration::get('MR_KEY_WEBSERVICE')) . '"/>
+							(Tools::getValue('mr_Key_WebService') ? Tools::safeOutput(Tools::getValue('mr_Key_WebService')) : Configuration::get('MR_KEY_WEBSERVICE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_Langage" class="mrLabel">' . $this->l('Etiquette\'s Language:') . '<sup>*</sup></label>
 							<select id="mr_Langage" name="mr_Langage" value="'.
-							(Tools::getValue('mr_Langage') ? Tools::getValue('mr_Langage') : Configuration::get('MR_LANGUAGE')).'" >';
+							(Tools::getValue('mr_Langage') ? Tools::safeOutput(Tools::getValue('mr_Langage')) : Configuration::get('MR_LANGUAGE')).'" >';
 		$languages = Language::getLanguages();
 		foreach ($languages as $language)
 			$output .= '<option value="'.strtoupper($language['iso_code']).'" '.(strtoupper($language['iso_code']) == Configuration::get('MR_LANGUAGE') ? 'selected="selected"' : '').'>'.$language['name'].'</option>';
@@ -1050,7 +1059,7 @@ class MondialRelay extends Module
 						<li>
 							<label for="mr_weight_coef" class="mrLabel">' . $this->l('Weight Coefficient:') . '<sup>*</sup></label>
 							<input class="mrInput" type="text" name="mr_weight_coef" value="' . 
-							(Tools::getValue('mr_weight_coef') ? Tools::getValue('mr_weight_coef') : Configuration::get('MR_WEIGHT_COEF')) . '"  style="width:45px;"/>
+							(Tools::getValue('mr_weight_coef') ? Tools::safeOutput(Tools::getValue('mr_weight_coef')) : Configuration::get('MR_WEIGHT_COEF')) . '"  style="width:45px;"/>
 							<span class="indication">(' . $this->l('grammes = 1 ') . Configuration::get('PS_WEIGHT_UNIT').')</span>
 						</li>						
 						<li class="PS_MRSubmit">

modules/mondialrelay/mondialrelay.tpl

@@ -24,6 +24,8 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
+{$jQueryOverload}
+
 <link href="{$new_base_dir}/style.css" rel="stylesheet" type="text/css" media="all" /> 
 
 <script type="text/javascript">
@@ -33,9 +35,11 @@
 	var one_page_checkout = {$one_page_checkout};
 	var PS_MRTranslationList = new Array();
 	var PS_MRCarrierMethodList =  new Array();
+	var PS_MRSelectedRelayPoint = {literal}{{/literal}'carrier_id': 0, 'relayPointNum': 0{literal}}{/literal};
 	
 	PS_MRTranslationList['Select'] = "{l s='Select' mod='mondialrelay'}";
 	PS_MRTranslationList['Selected'] = "{l s='Selected' mod='mondialrelay'}";
+	PS_MRTranslationList['errorSelection'] = "{l s='Please choose a relay point' mod='mondialrelay'}";
 </script>
 
 <script type="text/javascript" src="{$new_base_dir}mondialrelay.js"></script>
@@ -43,6 +47,7 @@
 <script type="text/javascript" src="{$new_base_dir}js/gmap.js"></script>
 
 <script type="text/javascript">
+
 	$(document).ready(function() 
 	{literal}{{/literal}
 		// Bind id_carrierX to an ajax call