// Merge -> revision 8800

admin-dev/ajax.php

@@ -621,7 +621,7 @@ if (Tools::isSubmit('saveHook'))
 			foreach ($hookedModules as $module)
 			{
 				$ids = explode('_', $module);
-				$value .= '('.$ids[1].', '.$id_shop.', (SELECT id_hook FROM '._DB_PREFIX_.'hook WHERE `name` = \''.pSQL($hook).'\' LIMIT 1), '.$i.'),';
+				$value .= '('.(int)$ids[1].', '.$id_shop.', (SELECT id_hook FROM '._DB_PREFIX_.'hook WHERE `name` = \''.pSQL($hook).'\' LIMIT 1), '.(int)$i.'),';
 				$i++;
 			}
 			$value = rtrim($value, ',');
@@ -730,12 +730,12 @@ if (Tools::isSubmit('syncImapMail'))
 	OR !$user = Configuration::get('PS_SAV_IMAP_USER')
 	OR !$password = Configuration::get('PS_SAV_IMAP_PWD'))
 	die('{"hasError" : true, "errors" : ["Configuration is not correct"]}');
-	
+
 	if (!function_exists('imap_open'))
 		die('{"hasError" : true, "errors" : ["imap is not installed on this server"]}');
-	
+
 	$mbox = @imap_open('{'.$url.':'.$port.'}', $user, $password);
-	
+
 	//checks if there is no error when connecting imap server
 	$errors = imap_errors();
 	$str_errors = '';
@@ -747,16 +747,16 @@ if (Tools::isSubmit('syncImapMail'))
 			$str_errors .= '"'.$error.'",';
 		$str_errors = rtrim($str_errors, ',').'';
 	}
-	
+
 	//checks if imap connexion is active
 	if (!$mbox)
 		die('{"hasError" : true, "errors" : ["Cannot connect to the mailbox"]}');
-	
+
 	//Returns information about the current mailbox. Returns FALSE on failure.
 	$check = imap_check($mbox);
 	if ($check)
 		die('{"hasError" : true, "errors" : ["Fail to get information about the current mailbox"]}');
-	
+
 	if ($check->Nmsgs == 0)
 		die('{"hasError" : true, "errors" : ["NO message to sync"]}');
 
@@ -768,7 +768,7 @@ if (Tools::isSubmit('syncImapMail'))
 	   		$subject = $overview->subject;
 	   	else
 	   		$subject = '';
-	   	
+
 		//Creating an md5 to check if message has been allready processed
 	    $md5 = md5($overview->date.$overview->from.$subject.$overview->msgno);
 	    $exist = Db::getInstance()->getValue(

admin-dev/ajaxfilemanager/ajax_create_folder.php

@@ -10,7 +10,10 @@
 	require_once('../init.php');
 	require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . "inc" . DIRECTORY_SEPARATOR . "config.php");
 	@ob_start();
-	displayArray($_POST);
+	$safe_post = array();
+	foreach ($_POST AS $key => $value)
+		$safe_post[Tools::safeOutput($key)] = Tools::safeOutput($value);
+	displayArray($safe_post);
 	writeInfo(@ob_get_clean());
 	echo "{";
 	$error = "";
@@ -72,4 +75,4 @@
 	echo "error:'" . $error . "'";
 	echo $info;
 	echo "}";
-?>
+?>

admin-dev/ajaxfilemanager/ajax_image_editor.php

@@ -105,7 +105,7 @@
 	<fieldset id="modes">
 		<legend>Modes</legend>
 		<form name="formAction" id="formAction" method="post" action="<?php echo appendQueryString(CONFIG_URL_IMAGE_UNDO, makeQueryString(array('path'))); ?>">
-			<input type="hidden" name="file_path" id="file_path" value="<?php echo $_GET['path']; ?>" />
+			<input type="hidden" name="file_path" id="file_path" value="<?php echo Tools::safeOutput($_GET['path']); ?>" />
 			
 			<p><label><?php echo IMG_MODE_RESIZE; ?></label> <input type="radio" name="mode" value="resize" class="input" checked="checked"  onclick="return changeMode();"/>
 			<label><?php echo IMG_MODE_CROP; ?></label> <input type="radio" name="mode" value="crop" class="input" onclick="return changeMode();" />
@@ -131,7 +131,7 @@
 			<p><input type="hidden" name="mode" id="image_mode" value="" />
       <input type="hidden" name="new_name" id="hidden_new_name" value="" />
       <input type="hidden" name="save_to" id="hidden_save_to" value="" />
-			<input type="hidden" name="path" id="path" value="<?php echo $_GET['path']; ?>"  />
+			<input type="hidden" name="path" id="path" value="<?php echo Tools::safeOutput($_GET['path']); ?>"  />
 			<input type="hidden" name="flip_angle" id="flip_angle" value="" />
 			<label><?php echo IMG_LBL_WIDTH; ?></label> <input type="text" name="width" id="width" value="" class="input imageInput"  />
 			<label><?php echo IMG_LBL_HEIGHT; ?></label> <input type="text" name="height" id="height" value="" class="input imageInput" />

admin-dev/ajaxfilemanager/ajaxfilemanager.php

@@ -74,7 +74,7 @@
 <script type="text/javascript" src="jscripts/ajaxfilemanager.js"></script>-->
 <script type="text/javascript">
 	var globalSettings = {'upload_init':false};
-	var queryString = '<?php echo makeQueryString(array('path')); ?>';
+	var queryString = '<?php echo Tools::safeOutput(makeQueryString(array('path'))); ?>';
 	var paths = {'root':'<?php echo addTrailingSlash(backslashToSlash(CONFIG_SYS_ROOT_PATH)); ?>', 'root_title':'<?php echo LBL_FOLDER_ROOT; ?>'};
 	var parentFolder = {};
 	var urls = {
@@ -90,7 +90,7 @@
 			'text_editor':'<?php echo  CONFIG_URL_TEXT_EDITOR; ?>',
 			'image_editor':'<?php echo  CONFIG_URL_IMAGE_EDITOR; ?>',
 			'download':'<?php echo CONFIG_URL_DOWNLOAD; ?>',
-			'present':'<?php echo getCurrentUrl(); ?>',
+			'present':'<?php echo Tools::safeOutput(getCurrentUrl()); ?>',
 			'home':'<?php echo CONFIG_URL_HOME; ?>',
 			'view':'<?php echo CONFIG_URL_LIST_LISTING; ?>'			
 		};
@@ -131,7 +131,7 @@
 	var searchRequired = false;
 	var supporedPreviewExts = '<?php echo CONFIG_VIEWABLE_VALID_EXTS; ?>'; 
 	var supportedUploadExts = '<?php echo CONFIG_UPLOAD_VALID_EXTS; ?>'
-	var elementId = <?php  echo (!empty($_GET['elementId'])?"'" . $_GET['elementId'] . "'":'null'); ?>;
+	var elementId = <?php  echo (!empty($_GET['elementId'])?"'" . Tools::safeOutput($_GET['elementId']) . "'":'null'); ?>;
 	var files = {};
 $(document).ready(
 	function()
@@ -464,9 +464,9 @@ $(document).ready(
         		<tr>
         			<td>
         		<b><?php echo LBL_SEARCH_MTIME; ?></b><br />
-        		<input type="text" class="input inputMtime" name="search_mtime_from" id="search_mtime_from" value="<?php echo (!empty($_GET['search_mtime_from'])?$_GET['search_mtime_from']:''); ?>" /> 
+        		<input type="text" class="input inputMtime" name="search_mtime_from" id="search_mtime_from" value="<?php echo (!empty($_GET['search_mtime_from'])?Tools::safeOutput($_GET['search_mtime_from']):''); ?>" /> 
         		<span class="leftToRightArrow">&nbsp;</span>
-        		<input type="text" class="input inputMtime" name="search_mtime_to" id="search_mtime_to" value="<?php echo (!empty($_GET['search_mtime_to'])?$_GET['search_mtime_to']:''); ?>" />
+        		<input type="text" class="input inputMtime" name="search_mtime_to" id="search_mtime_to" value="<?php echo (!empty($_GET['search_mtime_to'])?Tools::safeOutput($_GET['search_mtime_to']):''); ?>" />
         	</td></tr>
 
 			<tr>

admin-dev/login.php

@@ -48,7 +48,7 @@ if ((empty($_SERVER['HTTPS']) OR strtolower($_SERVER['HTTPS']) == 'off')
 		$errors[] = translate('SSL is activated. However, your IP is allowed to use unsecure mode (Maintenance or local IP).').'<br/>';
 	else
 		$warningSslMessage = translate('SSL is activated. Please connect using the following url to log in in secure mode (https).')
-		.'<br/><br/><a href="https://'.Tools::getServerName().$_SERVER['REQUEST_URI'].'">https://'.Tools::getServerName().$_SERVER['REQUEST_URI'].'</a>';
+		.'<br/><br/><a href="https://'.Tools::getServerName().Tools::safeOutput($_SERVER['REQUEST_URI']).'">https://'.Tools::getServerName().Tools::safeOutput($_SERVER['REQUEST_URI']).'</a>';
 }
 
 $iso = strtolower(Context::getContext()->language->iso_code);

admin-dev/tabs/AdminAddresses.php

@@ -215,7 +215,7 @@ class AdminAddresses extends AdminTab
 		WHERE 1 '.(isset($this->_where) ? $this->_where.' ' : '').(($this->deleted OR $this->table == 'currency') ? 'AND a.`deleted` = 0 ' : '').$this->_filter.' 
 		'.(isset($this->_group) ? $this->_group.' ' : '').'
 		'.(isset($this->addressType) ? 'AND a.id_'.strval($this->addressType).' != 0' : '').'
-		ORDER BY '.(($orderBy == 'id_'.$this->table) ? 'a.' : '').'`'.pSQL($orderBy).'` '.pSQL($orderWay).' 
+		ORDER BY '.(($orderBy == 'id_'.$this->table) ? 'a.' : '').'`'.bqSQL($orderBy).'` '.bqSQL($orderWay).' 
 		LIMIT '.(int)($start).','.(int)($limit));
 	}
 	

admin-dev/tabs/AdminAttributes.php

@@ -116,7 +116,7 @@ class AdminAttributes extends AdminTab
 					<label>'.$this->l('Current texture:').' </label>
 					<div class="margin-form">
 						<p>'.(file_exists(_PS_IMG_DIR_.$this->fieldImageSettings['dir'].'/'.$obj->id.'.jpg')
-							? '<img src="../img/'.$this->fieldImageSettings['dir'].'/'.$obj->id.'.jpg" alt="" title="" /> <a href="'.$_SERVER['REQUEST_URI'].'&deleteImage=1"><img src="../img/admin/delete.gif" alt="'.$this->l('delete').'" title="" /></a>'
+							? '<img src="../img/'.$this->fieldImageSettings['dir'].'/'.$obj->id.'.jpg" alt="" title="" /> <a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&deleteImage=1"><img src="../img/admin/delete.gif" alt="'.$this->l('delete').'" title="" /></a>'
 							: $this->l('None')
 						).'</p>
 					</div>

admin-dev/tabs/AdminDb.php

@@ -114,7 +114,7 @@ class AdminDb extends AdminPreferences
 					if ($engineType == $tables_engine[$table])
 						$this->_errors[] = $table.' '.$this->l('is already in').' '.$engineType;
 					else
-						if (!Db::getInstance()->Execute('ALTER TABLE '.pSQL($table).' ENGINE='.pSQL($engineType)))
+						if (!Db::getInstance()->Execute('ALTER TABLE `'.bqSQL($table).'` ENGINE=`'.bqSQL($engineType).'`'))
 							$this->_errors[] = $this->l('Can\'t change engine for').' '.$table;
 						else
 							echo '<div class="conf confirm"><img src="../img/admin/ok.gif" alt="'.$this->l('Confirmation').'" />'.$this->l('Engine change of').' '.$table.' '.$this->l('to').' '.$engineType.'</div>';

admin-dev/tabs/AdminOrders.php

@@ -891,7 +891,7 @@ class AdminOrders extends AdminTab
 		$slips = OrderSlip::getOrdersSlip($order->id_customer, $order->id);
 		echo '
 		<div style="float: left">
-			<form action="'.$_SERVER['REQUEST_URI'].'&token='.$this->token.'" method="post" onsubmit="if (getE(\'visibility\').checked == true) return confirm(\''.$this->l('Do you want to send this message to the customer?', __CLASS__, true, false).'\');">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&token='.$this->token.'" method="post" onsubmit="if (getE(\'visibility\').checked == true) return confirm(\''.$this->l('Do you want to send this message to the customer?', __CLASS__, true, false).'\');">
 			<fieldset style="width: 400px;">
 				<legend style="cursor: pointer;" onclick="$(\'#message\').slideToggle();$(\'#message_m\').slideToggle();return false"><img src="../img/admin/email_edit.gif" /> '.$this->l('New message').'</legend>
 				<div id="message_m" style="display: '.(Tools::getValue('message') ? 'none' : 'block').'; overflow: auto; width: 400px;">
@@ -926,7 +926,7 @@ class AdminOrders extends AdminTab
 			{
 				echo '<div style="overflow:auto; width:400px;" '.($message['is_new_for_me'] ?'class="new_message"':'').'>';
 				if ($message['is_new_for_me'])
-					echo '<a class="new_message" title="'.$this->l('Mark this message as \'viewed\'').'" href="'.$_SERVER['REQUEST_URI'].'&token='.$this->token.'&messageReaded='.(int)($message['id_message']).'"><img src="../img/admin/enabled.gif" alt="" /></a>';
+					echo '<a class="new_message" title="'.$this->l('Mark this message as \'viewed\'').'" href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&token='.$this->token.'&messageReaded='.(int)($message['id_message']).'"><img src="../img/admin/enabled.gif" alt="" /></a>';
 				echo $this->l('At').' <i>'.Tools::displayDate($message['date_add'], $this->context->language->id, true);
 				echo '</i> '.$this->l('from').' <b>'.(($message['elastname']) ? ($message['efirstname'].' '.$message['elastname']) : ($message['cfirstname'].' '.$message['clastname'])).'</b>';
 				echo ((int)($message['private']) == 1 ? '<span style="color:red; font-weight:bold;">'.$this->l('Private:').'</span>' : '');

admin-dev/tabs/AdminPreferences.php

@@ -40,7 +40,7 @@ class AdminPreferences extends AdminTab
 			$taxes[] = array('id' => 0, 'name' => $this->l('None'));
 			foreach (Tax::getTaxes($this->context->language->id) as $tax)
 				$taxes[] = array('id' => $tax['id_tax'], 'name' => $tax['name']);
-	
+
 			$order_process_type = array(
 				array(
 					'value' => PS_ORDER_PROCESS_STANDARD,
@@ -51,7 +51,7 @@ class AdminPreferences extends AdminTab
 					'name' => $this->l('One page checkout')
 				)
 			);
-	
+
 			$round_mode = array(
 				array(
 					'value' => PS_ROUND_UP,
@@ -66,7 +66,7 @@ class AdminPreferences extends AdminTab
 					'name' => $this->l('classical')
 				)
 			);
-	
+
 			$cms_tab = array(0 =>
 				array(
 					'id' => 0,
@@ -75,7 +75,7 @@ class AdminPreferences extends AdminTab
 			);
 			foreach (CMS::listCms($this->context->language->id) as $cms_file)
 				$cms_tab[] = array('id' => $cms_file['id_cms'], 'name' => $cms_file['meta_title']);
-	
+
 			$fields = array(
 				'PS_SHOP_ENABLE' => array('title' => $this->l('Enable Shop'), 'desc' => $this->l('Activate or deactivate your shop. Deactivate your shop while you perform maintenance on it. Please note that the webservice will not be disabled'), 'validation' => 'isBool', 'cast' => 'intval', 'type' => 'bool'),
 				'PS_MAINTENANCE_IP' => array('title' => $this->l('Maintenance IP'), 'desc' => $this->l('IP addresses allowed to access the Front Office even if shop is disabled. Use a comma to separate them (e.g., 42.24.4.2,127.0.0.1,99.98.97.96)'), 'validation' => 'isGenericName', 'type' => 'maintenance_ip', 'size' => 30, 'default' => ''),
@@ -103,17 +103,17 @@ class AdminPreferences extends AdminTab
 				'PS_SHOW_NEW_CUSTOMERS' => array('title' => $this->l('Show notifications for new customers'), 'desc' => $this->l('This will display notifications when new customers will register on your shop'), 'validation' => 'isBool', 'cast' => 'intval', 'type' => 'bool'),
 				'PS_SHOW_NEW_MESSAGES' => array('title' => $this->l('Show notifications for new messages'), 'desc' => $this->l('This will display notifications when new messages will be posted on your shop'), 'validation' => 'isBool', 'cast' => 'intval', 'type' => 'bool'),
 			);
-	
+
 			if (function_exists('date_default_timezone_set'))
 				$fields['PS_TIMEZONE'] = array('title' => $this->l('Time Zone:'), 'validation' => 'isAnything', 'type' => 'select', 'list' => $timezones, 'identifier' => 'name', 'visibility' => Shop::CONTEXT_ALL);
-			
+
 			// No HTTPS activation if you haven't already.
 			if (!Tools::usingSecureMode())
 			{
 				$fields['PS_SSL_ENABLED']['type'] = 'disabled';
-				$fields['PS_SSL_ENABLED']['disabled'] = '<a href="https://'.Tools::getShopDomainSsl().$_SERVER['REQUEST_URI'].'">'.$this->l('Please click here to use HTTPS protocol before enabling SSL.').'</a>';
+				$fields['PS_SSL_ENABLED']['disabled'] = '<a href="https://'.Tools::getShopDomainSsl().Tools::safeOutput($_SERVER['REQUEST_URI']).'">'.$this->l('Please click here to use HTTPS protocol before enabling SSL.').'</a>';
 			}
-				
+
 			$this->optionsList = array(
 				'general' => array(
 					'title' =>	$this->l('General'),
@@ -171,7 +171,7 @@ class AdminPreferences extends AdminTab
 		$uploadMaxSize = (int)str_replace('M', '',ini_get('upload_max_filesize'));
 		$postMaxSize = (int)str_replace('M', '', ini_get('post_max_size'));
 		$maxSize = $uploadMaxSize < $postMaxSize ? $uploadMaxSize : $postMaxSize;
-           
+
 		Configuration::update('PS_ATTACHMENT_MAXIMUM_SIZE', ($maxSize < Tools::getValue('PS_ATTACHMENT_MAXIMUM_SIZE')) ? $maxSize : Tools::getValue('PS_ATTACHMENT_MAXIMUM_SIZE'));
 	}
 
@@ -183,14 +183,14 @@ class AdminPreferences extends AdminTab
 		echo '<script type="text/javascript">
 				function addRemoteAddr()
 				{
-					var length = $(\'input[name=PS_MAINTENANCE_IP]\').attr(\'value\').length;	
+					var length = $(\'input[name=PS_MAINTENANCE_IP]\').attr(\'value\').length;
 					if (length > 0)
 						$(\'input[name=PS_MAINTENANCE_IP]\').attr(\'value\',$(\'input[name=PS_MAINTENANCE_IP]\').attr(\'value\') +\','.Tools::getRemoteAddr().'\');
 					else
 						$(\'input[name=PS_MAINTENANCE_IP]\').attr(\'value\',\''.Tools::getRemoteAddr().'\');
 				}
 			</script>';
-		
+
 		$this->displayOptionTypeText($key, $field, $value);
 		echo (isset($field['next']) ? '&nbsp;'.strval($field['next']) : '');
 		echo ' &nbsp<a href="#" class="button" onclick="addRemoteAddr(); return false;">'.$this->l('Add my IP').'</a>';

admin-dev/tabs/AdminStatsTab.php

@@ -100,7 +100,7 @@ abstract class AdminStatsTab extends AdminPreferences
 		$arrayGridEngines = ModuleGridEngine::getGridEngines();
 		
 		echo '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset style="width: 200px;"><legend><img src="../img/admin/tab-preferences.gif" />'.$this->l('Settings', 'AdminStatsTab').'</legend>';
 		echo '<p><strong>'.$this->l('Graph engine', 'AdminStatsTab').' </strong><br />';
 		if (sizeof($arrayGraphEngines))
@@ -153,7 +153,7 @@ abstract class AdminStatsTab extends AdminPreferences
 		return '
 		<fieldset style="width: 200px; font-size:13px;"><legend><img src="../img/admin/date.png" /> '.$translations['Calendar'].'</legend>
 			<div>
-				<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+				<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 					<input type="submit" name="submitDateDay" class="button" value="'.$translations['Day'].'">
 					<input type="submit" name="submitDateMonth" class="button" value="'.$translations['Month'].'">
 					<input type="submit" name="submitDateYear" class="button" value="'.$translations['Year'].'"><br />

admin-dev/tabs/AdminTranslations.php

@@ -843,13 +843,13 @@ class AdminTranslations extends AdminTab
 		<script type="text/javascript">';
 		if (Tools::getValue('type') == 'mails')
 			$str_output .= '$(document).ready(function(){
-				openCloseAllDiv(\''.$_GET['type'].'_div\', this.value == openAll); toggleElemValue(this.id, openAll, closeAll);
+				openCloseAllDiv(\''.Tools::safeOutput($_GET['type']).'_div\', this.value == openAll); toggleElemValue(this.id, openAll, closeAll);
 				});';
 		$str_output .= '
 			var openAll = \''.html_entity_decode($this->l('Expand all fieldsets'), ENT_NOQUOTES, 'UTF-8').'\';
 			var closeAll = \''.html_entity_decode($this->l('Close all fieldsets'), ENT_NOQUOTES, 'UTF-8').'\';
 		</script>
-		<input type="button" class="button" id="buttonall" onclick="openCloseAllDiv(\''.$_GET['type'].'_div\', this.value == openAll); toggleElemValue(this.id, openAll, closeAll);" />
+		<input type="button" class="button" id="buttonall" onclick="openCloseAllDiv(\''.Tools::safeOutput($_GET['type']).'_div\', this.value == openAll); toggleElemValue(this.id, openAll, closeAll);" />
 		<script type="text/javascript">toggleElemValue(\'buttonall\', '.($closed ? 'openAll' : 'closeAll').', '.($closed ? 'closeAll' : 'openAll').');</script>';
 		return $str_output;
 	}

classes/AdminTab.php

@@ -844,7 +844,7 @@ abstract class AdminTabCore
 								if (!Validate::isDate($value[0]))
 									$this->_errors[] = Tools::displayError('\'from:\' date format is invalid (YYYY-MM-DD)');
 								else
-									$sqlFilter .= ' AND '.pSQL($key).' >= \''.pSQL(Tools::dateFrom($value[0])).'\'';
+									$sqlFilter .= ' AND `'.bqSQL($key).'` >= \''.pSQL(Tools::dateFrom($value[0])).'\'';
 							}
 
 							if (isset($value[1]) AND !empty($value[1]))
@@ -852,7 +852,7 @@ abstract class AdminTabCore
 								if (!Validate::isDate($value[1]))
 									$this->_errors[] = Tools::displayError('\'to:\' date format is invalid (YYYY-MM-DD)');
 								else
-									$sqlFilter .= ' AND '.pSQL($key).' <= \''.pSQL(Tools::dateTo($value[1])).'\'';
+									$sqlFilter .= ' AND `'.bqSQL($key).'` <= \''.pSQL(Tools::dateTo($value[1])).'\'';
 							}
 						}
 						else

classes/Cart.php

@@ -417,10 +417,11 @@ class CartCore extends ObjectModel
 							IF (IFNULL(pa.`supplier_reference`, \'\') = \'\', p.`supplier_reference`, pa.`supplier_reference`) AS supplier_reference,
 							(p.`weight`+ pa.`weight`) weight_attribute,
 							IF (IFNULL(pa.`ean13`, \'\') = \'\', p.`ean13`, pa.`ean13`) AS ean13, IF (IFNULL(pa.`upc`, \'\') = \'\', p.`upc`, pa.`upc`) AS upc,
-							pai.`id_image` as pai_id_image, IFNULL(pa.`minimal_quantity`, p.`minimal_quantity`) as minimal_quantity, pa.`ecotax` AS ecotax_attr');
+							pai.`id_image` as pai_id_image, il.`legend` as pai_legend, IFNULL(pa.`minimal_quantity`, p.`minimal_quantity`) as minimal_quantity, pa.`ecotax` AS ecotax_attr');
 
 			$sql->leftJoin('product_attribute pa ON pa.`id_product_attribute` = cp.`id_product_attribute`');
 			$sql->leftJoin('product_attribute_image pai ON pai.`id_product_attribute` = pa.`id_product_attribute`');
+			$sql->leftJoin('image_lang il ON il.id_image = pai.id_image AND il.id_lang = '.(int)$this->id_lang);
 		}
 		else
 			$sql->select('p.`reference` AS reference, p.`supplier_reference` AS supplier_reference, p.`ean13`, p.`upc` AS upc, p.`minimal_quantity` AS minimal_quantity');
@@ -465,30 +466,29 @@ class CartCore extends ObjectModel
 				$row['price'] = Product::getPriceStatic((int)$row['id_product'], false, (int)$row['id_product_attribute'], 6, NULL, false, true, $row['cart_quantity'], false, ((int)($this->id_customer) ? (int)($this->id_customer) : NULL), (int)($this->id), ((int)($this->{Configuration::get('PS_TAX_ADDRESS_TYPE')}) ? (int)($this->{Configuration::get('PS_TAX_ADDRESS_TYPE')}) : NULL), $specificPriceOutput);
 				$row['price_wt'] = Product::getPriceStatic((int)$row['id_product'], true, (int)$row['id_product_attribute'], 2, NULL, false, true, $row['cart_quantity'], false, ((int)($this->id_customer) ? (int)($this->id_customer) : NULL), (int)($this->id), ((int)($this->{Configuration::get('PS_TAX_ADDRESS_TYPE')}) ? (int)($this->{Configuration::get('PS_TAX_ADDRESS_TYPE')}) : NULL));
 
-				/* In case when you use QuantityDiscount, getPriceStatic() can be return more of 2 decimals */
+				// In case when you use QuantityDiscount, getPriceStatic() can be return more of 2 decimals
 				$row['price_wt'] = Tools::ps_round($row['price_wt'], 2);
 				$row['total_wt'] = $row['price_wt'] * (int)($row['cart_quantity']);
 				$row['total'] = Tools::ps_round($row['price'] * (int)($row['cart_quantity']), 2);
 			}
 
-			$row2 = Db::getInstance()->getRow('
+			if (!isset($row['pai_id_image']))
-			SELECT i.`id_image`, il.`legend`
+			{
-			FROM `'._DB_PREFIX_.'image` i
+				$row2 = Db::getInstance()->getRow('
-			LEFT JOIN `'._DB_PREFIX_.'image_lang` il ON (i.`id_image` = il.`id_image` AND il.`id_lang` = '.(int)$this->id_lang.')
+				SELECT i.`id_image`, il.`legend`
-			WHERE '.((isset($row['`pai_id_image`']) AND $row['`pai_id_image`'])
+				FROM `'._DB_PREFIX_.'image` i
-				? 'i.`id_image` = (
+				LEFT JOIN `'._DB_PREFIX_.'image_lang` il ON (i.`id_image` = il.`id_image` AND il.`id_lang` = '.(int)$this->id_lang.')
-				SELECT i2.`id_image`
+					WHERE i.`id_product` = '.(int)$row['id_product'].' AND i.`cover` = 1');
-					FROM `'._DB_PREFIX_.'image` i2
+				if (!$row2)
-					INNER JOIN `'._DB_PREFIX_.'product_attribute_image` pai2 ON (pai2.`id_image` = i2.`id_image`)
+					$row2 = array('id_image' => false, 'legend' => false);
-					WHERE i2.`id_product` = p.`id_product` AND pai2.`id_product_attribute` = pa.`id_product_attribute`
+					else
-					ORDER BY i2.`position`
+				$row = array_merge($row, $row2);
-					LIMIT 1
+			}
-				)'
+			else
-				: 'i.`id_product` = '.(int)$row['id_product'].' AND i.`cover` = 1').'
+			{
-			');
+				$row['id_image'] = $row['pai_id_image'];
-			if (!$row2)
+				$row['legend'] = $row['pai_legend'];
-				$row2 = array('id_image' => false, 'legend' => false);
+			}
-			$row = array_merge($row, $row2);
 
 			$row['reduction_applies'] = ($specificPriceOutput AND (float)$specificPriceOutput['reduction']);
 			$row['quantity_discount_applies'] = ($specificPriceOutput AND $row['cart_quantity'] >= (int)$specificPriceOutput['from_quantity']);
@@ -500,6 +500,7 @@ class CartCore extends ObjectModel
 
 			$this->_products[] = $row;
 		}
+
 		return $this->_products;
 	}
 

classes/Category.php

@@ -674,7 +674,7 @@ class CategoryCore extends ObjectModel
 						FROM `'._DB_PREFIX_.'category` c3 
 						WHERE c3.`nleft` > c.`nleft` 
 						AND c3.`nright` < c.`nright`
-						AND c3.`id_category`  IN ('.$selectedCat.')
+			AND c3.`id_category`  IN ('.array_map('intval', $selectedCat).')
 					)' : '0').' AS nbSelectedSubCat
 				FROM `'._DB_PREFIX_.'category` c
 				LEFT JOIN `'._DB_PREFIX_.'category_lang` cl ON c.`id_category` = cl.`id_category`'.$shop->sqlLang('cl').'
@@ -1123,7 +1123,7 @@ class CategoryCore extends ObjectModel
 			FROM `'._DB_PREFIX_.'category` c 
 			LEFT JOIN `'._DB_PREFIX_.'category_lang` cl ON (c.`id_category` = cl.`id_category`'.Context::getContext()->shop->sqlLang('cl').')
 			WHERE cl.`id_lang` = '.(int)$id_lang.'
-			AND c.`id_category` IN ('.implode(',', $ids_category).')
+			AND c.`id_category` IN ('.implode(',', array_map('intval', $ids_category)).')
 		');
 		
 		foreach($results as $category)

classes/ModuleGraph.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -28,16 +28,16 @@
 abstract class ModuleGraphCore extends Module
 {
 	protected $_employee;
-	
+
 	/** @var integer array graph data */
 	protected	$_values = array();
-	
+
 	/** @var string array graph legends (X axis) */
 	protected	$_legend = array();
-	
+
 	/**@var string graph titles */
 	protected	$_titles = array('main' => NULL, 'x' => NULL, 'y' => NULL);
-		
+
 	/** @var ModuleGraphEngine graph engine */
 	protected $_render;
 
@@ -58,7 +58,7 @@ abstract class ModuleGraphCore extends Module
 		// Get dates in a manageable format
 		$fromArray = getdate(strtotime($this->_employee->stats_date_from));
 		$toArray = getdate(strtotime($this->_employee->stats_date_to));
-		
+
 		// If the granularity is inferior to 1 day
 		if ($this->_employee->stats_date_from == $this->_employee->stats_date_to)
 		{
@@ -156,11 +156,11 @@ abstract class ModuleGraphCore extends Module
 				$this->setAllTimeValues($layers);
 		}
 	}
-	
+
 	protected function csvExport($datas)
 	{
 		$context = Context::getContext();
-		
+
 		$this->setEmployee($context->employee->id);
 		$this->setLang($context->language->id);
 
@@ -168,7 +168,7 @@ abstract class ModuleGraphCore extends Module
 		if (isset($datas['option']))
 			$this->setOption($datas['option'], $layers);
 		$this->getData($layers);
-		
+
 		// @todo use native CSV PHP functions ?
 		// Generate first line (column titles)
 		if (is_array($this->_titles['main']))
@@ -191,7 +191,7 @@ abstract class ModuleGraphCore extends Module
 						$total += (is_array($this->_values[$i])  ? $this->_values[$i][$key] : $this->_values[$key]);
 			foreach ($this->_legend AS $key => $legend)
 			{
-				$this->_csv .= $legend.';';		
+				$this->_csv .= $legend.';';
 				for ($i = 0; $i < (is_array($this->_titles['main']) ? sizeof($this->_values) : 1); ++$i)
 				{
 					if (!isset($this->_values[$i]) || !is_array($this->_values[$i]))
@@ -219,7 +219,7 @@ abstract class ModuleGraphCore extends Module
 		}
 		$this->_displayCsv();
 	}
-	
+
 	protected function _displayCsv()
 	{
 		ob_end_clean();
@@ -228,33 +228,33 @@ abstract class ModuleGraphCore extends Module
 		echo $this->_csv;
 		exit;
 	}
-	
+
 	public function create($render, $type, $width, $height, $layers)
 	{
 		if (!Tools::file_exists_cache($file = dirname(__FILE__).'/../modules/'.$render.'/'.$render.'.php'))
 			die(Tools::displayError());
 		require_once($file);
 		$this->_render = new $render($type);
-		
+
 		$this->getData($layers);
 		$this->_render->createValues($this->_values);
 		$this->_render->setSize($width, $height);
 		$this->_render->setLegend($this->_legend);
 		$this->_render->setTitles($this->_titles);
 	}
-	
+
 	public function draw()
 	{
 		$this->_render->draw();
 	}
-	
+
 	/**
 	 * @todo Set this method as abstracted ? Quid of module compatibility.
 	 */
 	public function setOption($option, $layers = 1)
 	{
 	}
-		
+
 	public function engine($params)
 	{
 		$context = Context::getContext();
@@ -262,7 +262,7 @@ abstract class ModuleGraphCore extends Module
 			return Tools::displayError('No graph engine selected');
 		if (!file_exists(dirname(__FILE__).'/../modules/'.$render.'/'.$render.'.php'))
 			return Tools::displayError('Graph engine selected is unavailable.');
-			
+
 		$id_employee = (int)($context->employee->id);
 		$id_lang = (int)($context->language->id);
 
@@ -274,25 +274,25 @@ abstract class ModuleGraphCore extends Module
 			$params['width'] = 550;
 		if (!isset($params['height']))
 			$params['height'] = 270;
-			
+
 		$urlParams = $params;
 		$urlParams['render'] = $render;
 		$urlParams['module'] = Tools::getValue('module');
 		$urlParams['id_employee'] = $id_employee;
 		$urlParams['id_lang'] = $id_lang;
-		$drawer = 'drawer.php?' . http_build_query($urlParams);
+		$drawer = 'drawer.php?' . http_build_query(array_map('Tools::safeOutput', $urlParams));
-			
+
 		require_once(dirname(__FILE__).'/../modules/'.$render.'/'.$render.'.php');
 		return call_user_func(array($render, 'hookGraphEngine'), $params, $drawer);
 	}
-	
+
 	protected static function getEmployee($employee = null, Context $context = null)
 	{
 		if (!$context)
 			$context = Context::getContext();
 		if (!$employee)
 			$employee = $context->employee;
-		
+
 		if (empty($employee->stats_date_from) OR empty($employee->stats_date_to) OR $employee->stats_date_from == '0000-00-00' OR $employee->stats_date_to == '0000-00-00')
 		{
 			if (empty($employee->stats_date_from) OR $employee->stats_date_from == '0000-00-00')
@@ -303,18 +303,18 @@ abstract class ModuleGraphCore extends Module
 		}
 		return $employee;
 	}
-	
+
 	public function getDate()
 	{
 		return self::getDateBetween($this->_employee);
 	}
-	
+
 	public static function getDateBetween($employee = null)
 	{
 		$employee = self::getEmployee($employee);
 		return ' \''.$employee->stats_date_from.' 00:00:00\' AND \''.$employee->stats_date_to.' 23:59:59\' ';
 	}
-	
+
 	public function getLang()
 	{
 		return $this->_id_lang;

classes/ModuleGrid.php

@@ -100,7 +100,7 @@ abstract class ModuleGridCore extends Module
 		if (!file_exists(dirname(__FILE__).'/../modules/'.$render.'/'.$render.'.php'))
 			return Tools::displayError('Grid engine selected is unavailable.');
 			
-		$grider = 'grider.php?render='.$render.'&module='.Tools::getValue('module');
+		$grider = 'grider.php?render='.$render.'&module='.Tools::safeOutput(Tools::getValue('module'));
 		
 		$context = Context::getContext();
 		$grider .= '&id_employee='.(int)($context->employee->id);

classes/Product.php

@@ -1543,7 +1543,7 @@ class ProductCore extends ObjectModel
 					'.$context->shop->sqlAsso('product', 'p').'
 					WHERE p.`active` = 1
 						AND p.`show_price` = 1
-						'.((!$beginning AND !$ending) ? ' AND p.`id_product` IN('.((is_array($ids_product) AND sizeof($ids_product)) ? implode(', ', $ids_product) : 0).')' : '').'
+			'.((!$beginning AND !$ending) ? ' AND p.`id_product` IN('.((is_array($ids_product) AND sizeof($ids_product)) ? implode(', ', array_map('intval', $ids_product)) : 0).')' : '').'
 						AND p.`id_product` IN (
 							SELECT cp.`id_product`
 							FROM `'._DB_PREFIX_.'category_group` cg
@@ -2809,6 +2809,7 @@ class ProductCore extends ObjectModel
 
 	public static function defineProductImage($row, $id_lang)
 	{
+		if (isset($row['id_image']))
 		if ($row['id_image'])
 			return $row['id_product'].'-'.$row['id_image'];
 		return Language::getIsoById((int)$id_lang).'-default';
@@ -3606,7 +3607,7 @@ class ProductCore extends ObjectModel
 		$row = Db::getInstance()->getRow('
 		SELECT `reference`
 		FROM `'._DB_PREFIX_.'product` p
-		WHERE p.reference = "'.$reference.'"');
+		WHERE p.reference = "'.pSQL($reference).'"');
 
 		return isset($row['reference']);
 	}

classes/SpecificPrice.php

@@ -198,8 +198,8 @@ class SpecificPriceCore extends ObjectModel
 
 		return Db::getInstance()->Execute('
 		INSERT INTO `'._DB_PREFIX_.'specific_price_priority` (`id_product`, `priority`)
-		VALUES ('.(int)$id_product.',\''.rtrim($value, ';').'\')
+		VALUES ('.(int)$id_product.',\''.pSQL(rtrim($value, ';')).'\')
-		ON DUPLICATE KEY UPDATE `priority` = \''.rtrim($value, ';').'\'
+		ON DUPLICATE KEY UPDATE `priority` = \''.pSQL(rtrim($value, ';')).'\'
 		');
 	}
 
@@ -285,9 +285,9 @@ class SpecificPriceCore extends ObjectModel
 					`id_group` IN(0, '.(int)$id_group.') AND
 					`from_quantity` = 1 AND
 					(
-						(`from` = \'0000-00-00 00:00:00\' OR \''.$beginning.'\' >= `from`)
+						(`from` = \'0000-00-00 00:00:00\' OR \''.pSQL($beginning).'\' >= `from`)
 						AND
-						(`to` = \'0000-00-00 00:00:00\' OR \''.$ending.'\' <= `to`)
+						(`to` = \'0000-00-00 00:00:00\' OR \''.pSQL($ending).'\' <= `to`)
 					)
 					AND
 					`reduction` > 0

classes/Tools.php

@@ -509,8 +509,8 @@ class ToolsCore
 	public static function safeOutput($string, $html = false)
 	{
 	 	if (!$html)
-			$string = @htmlentities(strip_tags($string), ENT_QUOTES, 'utf-8');
+			$string = strip_tags($string);
-		return $string;
+		return @Tools::htmlentitiesUTF8($string, ENT_QUOTES);;
 	}
 
 	public static function htmlentitiesUTF8($string, $type = ENT_QUOTES)

classes/db/Db.php

@@ -303,7 +303,7 @@ abstract class DbCore
 	public function	delete($table, $where = false, $limit = false, $use_cache = 1)
 	{
 		$this->_result = false;
-		$sql = 'DELETE FROM `'.pSQL($table).'`'.($where ? ' WHERE '.$where : '').($limit ? ' LIMIT '.(int)$limit : '');
+		$sql = 'DELETE FROM `'.bqSQL($table).'`'.($where ? ' WHERE '.$where : '').($limit ? ' LIMIT '.(int)$limit : '');
 		$res = $this->query($sql);
 		if ($use_cache AND _PS_CACHE_ENABLED_)
 			Cache::getInstance()->deleteQuery($sql);

config/alias.php

@@ -57,6 +57,11 @@ function pSQL($string, $htmlOK = false)
 	return Db::getInstance()->escape($string, $htmlOK);
 }
 
+function bqSQL($string)
+{
+	return str_replace('`', '\`', pSQL($string));
+}
+
 /**
  * @deprecated
  */

controllers/front/AuthController.php

@@ -178,6 +178,9 @@ class AuthControllerCore extends FrontController
 								$this->context->cart->secure_key = $customer->secure_key;
 								$this->context->cart->id_address_delivery = Address::getFirstCustomerAddressId((int)($customer->id));
 								$this->context->cart->id_address_invoice = Address::getFirstCustomerAddressId((int)($customer->id));
+
+								// If a logged guest logs in as a customer, the cart secure key was already set and needs to be updated
+								$this->context->cart->secure_key = $customer->secure_key;
 								$this->context->cart->update();
 								Module::hookExec('createAccount', array(
 									'_POST' => $_POST,

controllers/front/CategoryController.php

@@ -156,15 +156,15 @@ class CategoryControllerCore extends FrontController
 	{
 		$hookExecuted = false;
 		Module::hookExec('productListAssign', array('nbProducts' => &$this->nbProducts, 'catProducts' => &$this->cat_products, 'hookExecuted' => &$hookExecuted));
-		if (!$hookExecuted)
+		if (!$hookExecuted) // The hook was not executed, standard working
 		{
-			self::$smarty->assign('categoryNameComplement', '');
+			$this->context->smarty->assign('categoryNameComplement', '');
 			$this->nbProducts = $this->category->getProducts(NULL, NULL, NULL, $this->orderBy, $this->orderWay, true);
-			$this->pagination((int)$this->nbProducts);
+			$this->pagination((int)$this->nbProducts); // Pagination must be call after "getProducts"
 			$this->cat_products = $this->category->getProducts($this->context->language->id, (int)$this->p, (int)$this->n, $this->orderBy, $this->orderWay);
 		}
-		else
+		else // Hook executed, use the override
-			$this->pagination((int)$this->nbProducts);
+			$this->pagination((int)$this->nbProducts); // Pagination must be call after "getProducts"
 		self::$smarty->assign('nb_products', (int)$this->nbProducts);
 	}
 }

localization/gb.xml

@@ -34,7 +34,7 @@
 			<taxRule iso_code_country="sk" id_tax="1"/>
 			<taxRule iso_code_country="fi" id_tax="1"/>
 			<taxRule iso_code_country="se" id_tax="1"/>
-			<taxRule iso_code_country="uk" id_tax="1"/>
+			<taxRule iso_code_country="gb" id_tax="1"/>
 		</taxRulesGroup>
 
 		<taxRulesGroup name="UK Reduced Rate (5%)">
@@ -64,7 +64,7 @@
 			<taxRule iso_code_country="sk" id_tax="2"/>
 			<taxRule iso_code_country="fi" id_tax="2"/>
 			<taxRule iso_code_country="se" id_tax="2"/>
-			<taxRule iso_code_country="uk" id_tax="2"/>
+			<taxRule iso_code_country="gb" id_tax="2"/>
 		</taxRulesGroup>
 	</taxes>
 	<units>
@@ -74,4 +74,5 @@
 		<unit type="base_distance" value="ft"/>
 		<unit type="long_distance" value="mi"/>
 	</units>
-</localizationPack>
+</localizationPack>
+

modules/autoupgrade/AdminPreferences.php

@@ -104,7 +104,7 @@ class AdminPreferences extends AdminTab
 			if (empty($_SERVER['HTTPS']) OR strtolower($_SERVER['HTTPS']) == 'off')
 			{
 				$this->_fieldsGeneral['PS_SSL_ENABLED']['type'] = 'disabled';
-				$this->_fieldsGeneral['PS_SSL_ENABLED']['disabled'] = '<a href="https://'.Tools14::getShopDomainSsl().$_SERVER['REQUEST_URI'].'">'.$this->l('Please click here to use HTTPS protocol before enabling SSL.').'</a>';
+				$this->_fieldsGeneral['PS_SSL_ENABLED']['disabled'] = '<a href="https://'.Tools14::getShopDomainSsl().Tools::safeOutput($_SERVER['REQUEST_URI']).'">'.$this->l('Please click here to use HTTPS protocol before enabling SSL.').'</a>';
 			}
 
 		parent::__construct();

modules/birthdaypresent/birthdaypresent.php

@@ -61,7 +61,7 @@ class BirthdayPresent extends Module
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
 			<p>'.$this->l('Create a voucher for customers celebrating their birthday and having at least one valid order').'</p>
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post" style="margin-top: 15px;">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" style="margin-top: 15px;">
 				<label>'.$this->l('Active').'</label>
 				<div class="margin-form">
 					<img src="../img/admin/enabled.gif" /> <input type="radio" name="bp_active" value="1"'.(Configuration::get('BIRTHDAY_ACTIVE') ? ' checked="checked"' : '').' />

modules/blockadvertising/blockadvertising.php

@@ -169,7 +169,7 @@ class BlockAdvertising extends Module
 		$this->postProcess();
 		$output = '';
 		$output .= '
-<form action="'.$_SERVER['REQUEST_URI'].'" method="post" enctype="multipart/form-data">
+<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" enctype="multipart/form-data">
 <fieldset><legend>'.$this->l('Advertising block configuration').'</legend>
 <a href="'.$this->adv_link.'" target="_blank" title="'.$this->adv_title.'">';
 		if ($this->adv_img)

modules/blockbestsellers/blockbestsellers.php

@@ -78,7 +78,7 @@ class BlockBestSellers extends Module
 	public function displayForm()
 	{
 		return '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Always display block').'</label>

modules/blockcart/blockcart.php

@@ -123,7 +123,7 @@ class BlockCart extends Module
 	public function displayForm()
 	{
 		return '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 

modules/blockcategories/blockcategories.php

@@ -95,7 +95,7 @@ class BlockCategories extends Module
 	public function displayForm()
 	{
 		return '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Maximum depth').'</label>

modules/blocklayered/blocklayered-indexer.php

@@ -1,13 +0,0 @@
-<?php
-
-include(dirname(__FILE__).'/../../config/config.inc.php');
-include(dirname(__FILE__).'/../../init.php');
-include(dirname(__FILE__).'/blocklayered.php');
-
-if (substr(Tools::encrypt('blocklayered/index'),0,10) != Tools::getValue('token') || !Module::isInstalled('blocklayered'))
-	die('Bad token');
-
-if(Tools::getValue('full'))
-	echo BlockLayered::fullindexProcess((int)Tools::getValue('cursor'), (int)Tools::getValue('ajax'), true);
-else
-	echo BlockLayered::indexProcess((int)Tools::getValue('cursor'), (int)Tools::getValue('ajax'));

modules/blocklayered/blocklayered-price-indexer.php

@@ -0,0 +1,29 @@
+<?php
+
+include(dirname(__FILE__).'/../../config/config.inc.php');
+include(dirname(__FILE__).'/../../init.php');
+include(dirname(__FILE__).'/blocklayered.php');
+
+if (substr(Tools::encrypt('blocklayered/index'),0,10) != Tools::getValue('token') || !Module::isInstalled('blocklayered'))
+	die('Bad token');
+
+	
+if (!Tools::getValue('ajax'))
+{
+	// Case of nothing to do but showing a message (1)
+	if (Tools::getValue('return_message') !== false)
+	{
+		echo '1';
+		die();
+	}
+	
+	// Return a content without waiting the end of index execution
+	header('Location: '.Tools::getProtocol().Tools::getHttpHost().'/modules/blocklayered/blocklayered-price-indexer.php?token='.Tools::getValue('token') .'&return_message='.(int)Tools::getValue('cursor'));
+	flush();
+}
+if(Tools::getValue('full'))
+{
+	echo BlockLayered::fullPricesIndexProcess((int)Tools::getValue('cursor'), (int)Tools::getValue('ajax'), true);
+}
+else
+	echo BlockLayered::pricesIndexProcess((int)Tools::getValue('cursor'), (int)Tools::getValue('ajax'));

modules/blocklayered/blocklayered-url-indexer.php

@@ -9,4 +9,4 @@ if (substr(Tools::encrypt('blocklayered/index'),0,10) != Tools::getValue('token'
 
 $blockLayered = new BlockLayered();
 $cursor = Tools::jsonDecode(Tools::getValue('cursor', '{}'), true);
-echo $blockLayered->indexUrl($cursor, (int)Tools::getValue('ajax'), (int)Tools::getValue('truncate'));
+echo $blockLayered->indexUrl($cursor, (int)Tools::getValue('truncate'));

modules/blocklayered/fr.php

@@ -14,7 +14,6 @@ $_MODULE['<{blocklayered}prestashop>blocklayered_b3786b970611c1a3809dd51b630812a
 $_MODULE['<{blocklayered}prestashop>blocklayered_c3ef60194d18cf4026d22051b3a19428'] = 'Indexable :';
 $_MODULE['<{blocklayered}prestashop>blocklayered_7c831eb524882fd27ecdab45019d1466'] = 'Utilise cet attribut dans l\'url généré par le module de bloc de navigation à facette';
 $_MODULE['<{blocklayered}prestashop>blocklayered_ccc12c5568381293a27db0232877937b'] = 'Nom du modèle de filtre nécessaire (ne peut être vide)';
-$_MODULE['<{blocklayered}prestashop>blocklayered_af1b98adf7f686b84cd0b443e022b7a0'] = 'Catégories';
 $_MODULE['<{blocklayered}prestashop>blocklayered_817c37b9c1f5cd4a450dad384e63e6c7'] = 'Votre filtre';
 $_MODULE['<{blocklayered}prestashop>blocklayered_3185cefd67b575e582063148e4f15860'] = 'a été mis à jour avec succès.';
 $_MODULE['<{blocklayered}prestashop>blocklayered_7ccab4d8de5d6b9bb61e99c7bba343ab'] = 'a été ajouté avec succès.';
@@ -35,9 +34,9 @@ $_MODULE['<{blocklayered}prestashop>blocklayered_16349835364cf839e6670b0de7da636
 $_MODULE['<{blocklayered}prestashop>blocklayered_56fc8142961f1f3e9f9ec0c178881b69'] = '(En cours)';
 $_MODULE['<{blocklayered}prestashop>blocklayered_e1e43ed7e0922095a801341dca2f1822'] = 'Indexation des urls terminée';
 $_MODULE['<{blocklayered}prestashop>blocklayered_1c1783101d972ba096fff9756378b0e1'] = 'L\'indexation des urls a échoué';
-$_MODULE['<{blocklayered}prestashop>blocklayered_f83cc9b5e3192cbe1c40ec2effd6cbb4'] = 'Indexation des produits terminée';
+$_MODULE['<{blocklayered}prestashop>blocklayered_e2dd8f544131eaf47a4f722ace7f876b'] = 'Indexation des prix terminée';
-$_MODULE['<{blocklayered}prestashop>blocklayered_638041e8465b00f32e95eeef1d15fc77'] = '(En cours, %s produits à indexer)';
+$_MODULE['<{blocklayered}prestashop>blocklayered_7cf7d150dd287df0a8e17eeb4cf2161d'] = '(En cours,% s produits à indexer)';
-$_MODULE['<{blocklayered}prestashop>blocklayered_5e123b0351f06875436de2dfde577e19'] = 'Produit d\'indexation a échoué';
+$_MODULE['<{blocklayered}prestashop>blocklayered_ceda32b8540dee4f1222cd482a513db8'] = 'L\'Indexation des prix a échouée';
 $_MODULE['<{blocklayered}prestashop>blocklayered_a607dc3941415ecea04bb1eb8a978962'] = 'Modèles de filtres existants';
 $_MODULE['<{blocklayered}prestashop>blocklayered_9923a3739235561cc50eb9446dc1771e'] = 'modèles de filtres sont configurés :';
 $_MODULE['<{blocklayered}prestashop>blocklayered_b718adec73e04ce3ec720dd11a06a308'] = 'ID';

modules/blocklink/blocklink.php

@@ -274,7 +274,7 @@ class BlockLink extends Module
 		</script>
 		<fieldset>
 			<legend><img src="'.$this->_path.'add.png" alt="" title="" /> '.$this->l('Add a new link').'</legend>
-			<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<label>'.$this->l('Text:').'</label>
 				<div class="margin-form">';
 			foreach ($languages as $language)
@@ -299,7 +299,7 @@ class BlockLink extends Module
 		</fieldset>
 		<fieldset class="space">
 			<legend><img src="'.$this->_path.'logo.gif" alt="" title="" /> '.$this->l('Block title').'</legend>
-			<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<label>'.$this->l('Block title:').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
@@ -318,7 +318,7 @@ class BlockLink extends Module
 		</fieldset>
 		<fieldset class="space">
 			<legend><img src="'.$this->_path.'prefs.gif" alt="" title="" /> '.$this->l('Settings').'</legend>
-			<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<label>'.$this->l('Order list:').'</label>
 				<div class="margin-form">
 					<select name="orderWay">

modules/blockmanufacturer/blockmanufacturer.php

@@ -98,7 +98,7 @@ class BlockManufacturer extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Use a plain-text list').'</label>
 				<div class="margin-form">

modules/blocknewproducts/blocknewproducts.php

@@ -73,7 +73,7 @@ class BlockNewProducts extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 		<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Products displayed').'</label>
 					<div class="margin-form">

modules/blocknewsletter/blocknewsletter.php

@@ -117,7 +117,7 @@ class Blocknewsletter extends Module
 	private function _displayForm()
 	{
 		$this->_html .= '
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Display configuration in a new page?').'</label>

modules/blockpaymentlogo/blockpaymentlogo.php

@@ -82,7 +82,7 @@ class BlockPaymentLogo extends Module
 		else
 		{
 			$html .= '
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 				<fieldset>
 					<legend><img src="'.$this->_path.'/logo.gif" alt="" /> '.$this->l('Configure').'</legend>
 					<label>'.$this->l('Page CMS for link').':</label>

modules/blockrss/blockrss.php

@@ -121,7 +121,7 @@ class Blockrss extends Module
 	public function displayForm()
 	{					
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Block title').'</label>
 				<div class="margin-form">

modules/blockspecials/blockspecials.php

@@ -66,7 +66,7 @@ class BlockSpecials extends Module
 	public function displayForm()
 	{
 		return '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Always display block').'</label>

modules/blockstore/blockstore.php

@@ -102,7 +102,7 @@ class BlockStore extends Module
 	public function getContent()
 	{
 		$output = $this->postProcess().'
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post" enctype="multipart/form-data">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" enctype="multipart/form-data">
 			<fieldset>
 				<legend>'.$this->l('Store block configuration').'</legend>';
 		if (Configuration::get('BLOCKSTORE_IMG'))

modules/blocksupplier/blocksupplier.php

@@ -100,7 +100,7 @@ class BlockSupplier extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Use a plain-text list').'</label>
 				<div class="margin-form">

modules/blocktags/blocktags.php

@@ -77,7 +77,7 @@ class BlockTags extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Tags displayed').'</label>
 				<div class="margin-form">

modules/blockviewed/blockviewed.php

@@ -78,7 +78,7 @@ class BlockViewed extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Products displayed').'</label>
 				<div class="margin-form">

modules/blockwishlist/blockwishlist.php

@@ -115,7 +115,7 @@ class BlockWishList extends Module
 		if (!$id_customer)
 			$id_customer = $customers[0]['id_customer'];
 		$this->_html .= '<br />
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post" id="listing">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" id="listing">
 			<fieldset>
 				<legend><img src="'.$this->_path.'img/icon/package_go.png" alt="" title="" />'.$this->l('Listing').'</legend>
 
@@ -297,7 +297,7 @@ class BlockWishList extends Module
 			$this->_html .= $customer->lastname.' '.$customer->firstname.' '.$this->l('No wishlist.');
 		else
 		{
-			$this->_html .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" id="listing">';
+			$this->_html .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" id="listing">';
 	
 			$id_wishlist = (int)(Tools::getValue('id_wishlist'));
 			if (!$id_wishlist)

modules/canadapost/canadapost.php

@@ -380,9 +380,9 @@ class CanadaPost extends CarrierModule
 		if (isset($_GET['id_tab']))
 			$html .= '<script>
 				  $(".menuTabButton.selected").removeClass("selected");
-				  $("#menuTab'.Tools::getValue('id_tab').'").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput(Tools::getValue('id_tab')).'").addClass("selected");
 				  $(".tabItem.selected").removeClass("selected");
-				  $("#menuTab'.Tools::getValue('id_tab').'Sheet").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput(Tools::getValue('id_tab')).'Sheet").addClass("selected");
 			</script>';
 		return $html;
 	}
@@ -416,21 +416,21 @@ class CanadaPost extends CarrierModule
 			</style>
 
 
-			<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=1&section=general" method="post" class="form" id="configForm">
+			<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=1&section=general" method="post" class="form" id="configForm">
 
 				<fieldset style="border: 0px;">
 					<h4>'.$this->l('General configuration').' :</h4>
 					<label>'.$this->l('Your Canada Post account').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="cp_carrier_account" value="'.Tools::getValue('cp_carrier_account', Configuration::get('CP_CARRIER_ACCOUNT')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="cp_carrier_account" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_account', Configuration::get('CP_CARRIER_ACCOUNT'))).'" /></div>
 					<br /><br />
 					<label>'.$this->l('Packaging Weight').' : </label>
 					<div class="margin-form">
-						<input type="text" size="5" name="cp_carrier_packaging_weight" value="'.Tools::getValue('cp_carrier_packaging_weight', Configuration::get('CP_CARRIER_PACKAGING_WEIGHT')).'" />
+						<input type="text" size="5" name="cp_carrier_packaging_weight" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_packaging_weight', Configuration::get('CP_CARRIER_PACKAGING_WEIGHT'))).'" />
-						'.Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT')).'
+						'.Tools::safeOutput(Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT'))).'
 					</div>
 					<label>'.$this->l('Handling Fee').' : </label>
 					<div class="margin-form">
-						<input type="text" size="5" name="cp_carrier_handling_fee" value="'.Tools::getValue('cp_carrier_handling_fee', Configuration::get('CP_CARRIER_HANDLING_FEE')).'" />
+						<input type="text" size="5" name="cp_carrier_handling_fee" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_handling_fee', Configuration::get('CP_CARRIER_HANDLING_FEE'))).'" />
 						'.$configCurrency->sign.'
 					</div>
 				</fieldset>
@@ -439,12 +439,12 @@ class CanadaPost extends CarrierModule
 					<h4>'.$this->l('Localization configuration').' :</h4>
 					<label>'.$this->l('Weight unit').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ps_weight_unit" value="'.Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT')).'" />
+						<input type="text" size="20" name="ps_weight_unit" value="'.Tools::safeOutput(Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT'))).'" />
 						<p>'.$this->l('The weight unit of your shop (eg. kg or lbs)').'</p>
 					</div>
 					<label>'.$this->l('Dimension unit').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ps_dimension_unit" value="'.Tools::getValue('ps_dimension_unit', Configuration::get('PS_DIMENSION_UNIT')).'" />
+						<input type="text" size="20" name="ps_dimension_unit" value="'.Tools::safeOutput(Tools::getValue('ps_dimension_unit', Configuration::get('PS_DIMENSION_UNIT'))).'" />
 						<p>'.$this->l('The dimension unit of your shop (eg. cm or in)').'</p>
 					</div>
 				</fieldset>
@@ -452,13 +452,13 @@ class CanadaPost extends CarrierModule
 				<fieldset style="border: 0px;">
 					<h4>'.$this->l('Address configuration').' :</h4>
 					<label>'.$this->l('Your address line 1').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="cp_carrier_address1" value="'.Tools::getValue('cp_carrier_address1', Configuration::get('CP_CARRIER_ADDRESS1')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="cp_carrier_address1" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_address1', Configuration::get('CP_CARRIER_ADDRESS1'))).'" /></div>
 					<label>'.$this->l('Your address line 2').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="cp_carrier_address2" value="'.Tools::getValue('cp_carrier_address2', Configuration::get('CP_CARRIER_ADDRESS2')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="cp_carrier_address2" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_address2', Configuration::get('CP_CARRIER_ADDRESS2'))).'" /></div>
 					<label>'.$this->l('Zip / Postal Code').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="cp_carrier_postal_code" value="'.Tools::getValue('cp_carrier_postal_code', Configuration::get('CP_CARRIER_POSTAL_CODE')).'" /></div><br />
+					<div class="margin-form"><input type="text" size="20" name="cp_carrier_postal_code" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_postal_code', Configuration::get('CP_CARRIER_POSTAL_CODE'))).'" /></div><br />
 					<label>'.$this->l('Your City').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="cp_carrier_city" value="'.Tools::getValue('cp_carrier_city', Configuration::get('CP_CARRIER_CITY')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="cp_carrier_city" value="'.Tools::safeOutput(Tools::getValue('cp_carrier_city', Configuration::get('CP_CARRIER_CITY'))).'" /></div>
 					<label>'.$this->l('Country').' : </label>
 					<div class="margin-form">
 						<select name="cp_carrier_country" id="cp_carrier_country">
@@ -732,10 +732,10 @@ class CanadaPost extends CarrierModule
 					<td>'.$c['additional_charges'].' '.$configCurrency->sign.'</td>
 					<td>'.$services.'</td>
 					<td>
-						<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=edit&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'" style="float: left;">
+						<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=edit&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'" style="float: left;">
 							<img src="'._PS_IMG_.'admin/edit.gif" />
 						</a>
-						<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=delete&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'&id_category='.(int)($c['id_category']).'" method="post" class="form" style="float: left;">
+						<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=delete&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'&id_category='.(int)($c['id_category']).'" method="post" class="form" style="float: left;">
 							<input name="submitSave" type="image" src="'._PS_IMG_.'admin/delete.gif" OnClick="return confirm(\''.$this->l('Are you sure you want to delete this specific Canada Post configuration for this category ?').'\');" />
 						</form>
 					</td>
@@ -761,13 +761,13 @@ class CanadaPost extends CarrierModule
 				$path .= $p;
 			}
 
-			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
+			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=edit&id_cp_rate_config='.(int)(Tools::getValue('id_cp_rate_config')).'" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=edit&id_cp_rate_config='.(int)(Tools::getValue('id_cp_rate_config')).'" method="post" class="form">
 						<label>'.$this->l('Category').' :</label>
 						<div class="margin-form" style="padding: 0.2em 0.5em 0 0; font-size: 12px;">'.$path.' <input type="hidden" name="id_category" value="'.(int)($configSelected['id_category']).'" /></div><br clear="left" />
 
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges', $configSelected['additional_charges']).'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges', $configSelected['additional_charges'])).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'cp_rate_service_code`');
@@ -785,7 +785,7 @@ class CanadaPost extends CarrierModule
 		else
 		{
 			$html .= '<p align="center"><b>'.$this->l('Add a rule').'</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=add" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=add" method="post" class="form">
 						<label>'.$this->l('Category').' : </label>
 						<div class="margin-form">
 							<select name="id_category">
@@ -794,7 +794,7 @@ class CanadaPost extends CarrierModule
 							</select>
 						</div>
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges').'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges')).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'cp_rate_service_code`');
@@ -963,10 +963,10 @@ class CanadaPost extends CarrierModule
 					<td>'.$c['additional_charges'].' '.$configCurrency->sign.'</td>
 					<td>'.$services.'</td>
 					<td>
-						<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=edit&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'" style="float: left;">
+						<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=edit&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'" style="float: left;">
 							<img src="'._PS_IMG_.'admin/edit.gif" />
 						</a>
-						<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=delete&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'&id_product='.(int)($c['id_product']).'" method="post" class="form" style="float: left;">
+						<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=delete&id_cp_rate_config='.(int)($c['id_cp_rate_config']).'&id_product='.(int)($c['id_product']).'" method="post" class="form" style="float: left;">
 							<input name="submitSave" type="image" src="'._PS_IMG_.'admin/delete.gif" OnClick="return confirm(\''.$this->l('Are you sure you want to delete this specific Canada Post configuration for this product ?').'\');" />
 						</form>
 					</td>
@@ -984,13 +984,13 @@ class CanadaPost extends CarrierModule
 			$configSelected = Db::getInstance()->getRow('SELECT * FROM `'._DB_PREFIX_.'cp_rate_config` WHERE `id_cp_rate_config` = '.(int)(Tools::getValue('id_cp_rate_config')));
 			$product = new Product((int)$configSelected['id_product'], false, (int)$this->context->language->id);
 
-			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
+			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=edit&id_cp_rate_config='.(int)(Tools::getValue('id_cp_rate_config')).'" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=edit&id_cp_rate_config='.(int)(Tools::getValue('id_cp_rate_config')).'" method="post" class="form">
 						<label>'.$this->l('Product').' :</label>
 						<div class="margin-form" style="padding: 0.2em 0.5em 0 0; font-size: 12px;">'.$product->name.' <input type="hidden" name="id_product" value="'.(int)($configSelected['id_product']).'" /></div><br clear="left" />
 
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges', $configSelected['additional_charges']).'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges', $configSelected['additional_charges'])).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'cp_rate_service_code`');
@@ -1008,7 +1008,7 @@ class CanadaPost extends CarrierModule
 		else
 		{
 			$html .= '<p align="center"><b>'.$this->l('Add a rule').'</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=add" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=add" method="post" class="form">
 						<label>'.$this->l('Product').' : </label>
 						<div class="margin-form">
 							<select name="id_product">
@@ -1024,7 +1024,7 @@ class CanadaPost extends CarrierModule
 						</div>
 
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges').'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges')).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'cp_rate_service_code`');

modules/crossselling/crossselling.php

@@ -82,7 +82,7 @@ class CrossSelling extends Module
 			$this->_html .= $this->displayConfirmation($this->l('Settings updated successfully'));
 		}
 		$this->_html .= '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 		<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 			<label>'.$this->l('Display price on products').'</label>
 			<div class="margin-form">

modules/dejala/dejala.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -46,10 +46,10 @@ class Dejala extends CarrierModule
 	public $id_lang ;
 	private $wday_labels ;
 	private static $INSTANCE = NULL ;
-	
+
-	public static function getInstance() 
+	public static function getInstance()
 	{
-		if (!self::$INSTANCE) 
+		if (!self::$INSTANCE)
 		{
         	self::$INSTANCE = new Dejala();
 		}
@@ -66,7 +66,7 @@ class Dejala extends CarrierModule
 		$this->version = 1.4;
 		$this->internal_version = '1.3';
 		parent::__construct();
-		
+
 		$this->id_lang = $this->context->language->id;
 		$this->wday_labels = array($this->l('Sunday'), $this->l('Monday'), $this->l('Tuesday'), $this->l('Wednesday'), $this->l('Thursday'), $this->l('Friday'), $this->l('Saturday'));
 
@@ -74,30 +74,30 @@ class Dejala extends CarrierModule
 		$this->page = basename(__FILE__, '.php');
 	 	$this->displayName = $this->l('Dejala.com : Courier delivery');
 		$this->description = $this->l('Lets Dejala.com handle your deliveries by courier');
-		
+
 		// load configuration only if installed
 		if ($this->id)
 		{
-			if (true !== extension_loaded('curl')) 
+			if (true !== extension_loaded('curl'))
 			{
 				$this->warning = $this->l('The Dejala module requires php extension cURL to function properly. Please install the php extension "cURL"');
 			}
 
 			$this->dejalaConfig = new DejalaConfig();
 			$this->dejalaConfig->loadConfig();
-			
+
 			// Update table schema
-			if (!isset($this->dejalaConfig->internal_version) || $this->dejalaConfig->internal_version < $this->internal_version) 
+			if (!isset($this->dejalaConfig->internal_version) || $this->dejalaConfig->internal_version < $this->internal_version)
 			{
 				$this->unregisterHook('cart') ;
 				$res = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'dejala_cart` LIMIT 1') ;
-				if ($res) 
+				if ($res)
 				{
-					if (!array_key_exists('cart_date_upd', (int)$res[0])) 
+					if (!array_key_exists('cart_date_upd', (int)$res[0]))
 					{
 						Db::getInstance()->Execute('ALTER TABLE `'._DB_PREFIX_.'dejala_cart` ADD COLUMN cart_date_upd DATETIME DEFAULT 0;');
 					}
-					if (!array_key_exists('delivery_price', (int)$res[0])) 
+					if (!array_key_exists('delivery_price', (int)$res[0]))
 					{
 						Db::getInstance()->Execute('ALTER TABLE `'._DB_PREFIX_.'dejala_cart` ADD COLUMN delivery_price FLOAT DEFAULT NULL;');
 					}
@@ -114,16 +114,16 @@ class Dejala extends CarrierModule
 	*/
   public function install()
   {
-  	if (!file_exists(dirname(__FILE__).'/'.self::INSTALL_SQL_FILE)) 
+  	if (!file_exists(dirname(__FILE__).'/'.self::INSTALL_SQL_FILE))
 			return (false);
 	elseif (!$sql = file_get_contents(dirname(__FILE__).'/'.self::INSTALL_SQL_FILE))
 		return (false);
 
 	$sql = str_replace(array('PREFIX_', 'ENGINE_TYPE'), array(_DB_PREFIX_, _MYSQL_ENGINE_), $sql);
 	$sql = preg_split("/;\s*[\r\n]+/",$sql);
-	
+
-	foreach ($sql as $query) 
+	foreach ($sql as $query)
-		if (!empty($query)) 
+		if (!empty($query))
 		{
 			if (!Db::getInstance()->Execute(trim($query)))
 			return (false);
@@ -139,7 +139,7 @@ class Dejala extends CarrierModule
 	$this->dejalaConfig = new DejalaConfig();
 	if (!$this->dejalaConfig->saveConfig())
 		return (false);
-		
+
 	DejalaCarrierUtils::createDejalaCarrier($this->dejalaConfig) ;
 	return (true);
   }
@@ -151,9 +151,9 @@ class Dejala extends CarrierModule
   	if (Configuration::get('PS_CARRIER_DEFAULT') == (int)($djlCarrier->id))
   	{
   		$carriers = Carrier::getCarriers($this->context->language->id, true, false, false, NULL, Carrier::PS_CARRIERS_AND_CARRIER_MODULES_NEED_RANGE);
-  		foreach($carriers as $carrier) 
+  		foreach($carriers as $carrier)
   		{
-  			if ($carrier['active'] AND !$carrier['deleted'] AND ($carrier['external_module_name'] != $this->name)) 
+  			if ($carrier['active'] AND !$carrier['deleted'] AND ($carrier['external_module_name'] != $this->name))
   			{
   				Configuration::updateValue('PS_CARRIER_DEFAULT', (int)$carrier['id_carrier']);
   				break ;
@@ -162,14 +162,14 @@ class Dejala extends CarrierModule
   	}
   	$djlCarrier->deleted = 1;
   	if (!$djlCarrier->update()) return false;
-  	
+
   	$this->dejalaConfig->uninstall();
   	if (!parent::uninstall() OR
   		!$this->unregisterHook('updateOrderStatus') OR
   		!$this->unregisterHook('extraCarrier') OR
   		!$this->unregisterHook('processCarrier'))
   		return false;
-  		
+
   	return true;
   }
 
@@ -182,7 +182,7 @@ class Dejala extends CarrierModule
 		$errors = array();
 
 		$method = Tools::getValue('method');
-		if ($method == 'signin') 
+		if ($method == 'signin')
 		{
 			if (empty($_POST['login']))
 				$errors[] = $this->l('login is required.');
@@ -204,7 +204,7 @@ class Dejala extends CarrierModule
 			if (empty($_POST['country']))
 				$errors[] = $this->l('country is required.');
 		}
-		else if ($method == 'products') 
+		else if ($method == 'products')
 		{
 			$products = array();
 			$djlUtil = new DejalaUtils();
@@ -235,7 +235,7 @@ class Dejala extends CarrierModule
 							break;
 						}
 					}
-					if ($product) 
+					if ($product)
 					{
 						$vat_factor = (1+ ($product['vat'] / 100));
 						$public_price = round($product['price']*$vat_factor, 2);
@@ -272,13 +272,13 @@ class Dejala extends CarrierModule
 			{
 				$this->dejalaConfig->saveConfig();
 			}
-			else 
+			else
 			{
 				if ($response['status'] == 401)
 					$errors[] = $this->l('An error occurred while authenticating your account on Dejala.com. Your credentials were not recognized.');
 				else
 					$errors[] = $this->l('Unable to process the action.') . '(' . $response['status'] . ')';
-				
+
 				$this->dejalaConfig->login = null;
 				$this->dejalaConfig->password = null;
 			}
@@ -300,7 +300,7 @@ class Dejala extends CarrierModule
 				$errors[] = $this->l('Please choose another login');
 			elseif ($response['status'] == 403)
 				$errors[] = $this->l('Dejala Server cannot be reached by your Prestashop server. This is most likely due to a limit set by your hosting provider. Please contact their technical support and ask if your server is authorized to initiate outbound HTTP connections.');
-			else 
+			else
 				$errors[] = $this->l('Unable to process the action.') . '(' . $response['status'] . ')';
 			$this->dejalaConfig->loadConfig();
 		}
@@ -337,7 +337,7 @@ class Dejala extends CarrierModule
 			if ($maxSatuses > 30)
 				$maxSatuses = 30;
 			$selectedTriggers=array();
-			for ($i = 0; $i < $maxSatuses; $i++) 
+			for ($i = 0; $i < $maxSatuses; $i++)
 			{
 				$l_val = Tools::getValue('status_'.$i);
 				if ($l_val)
@@ -348,7 +348,7 @@ class Dejala extends CarrierModule
 			$this->dejalaConfig->saveConfig();
 			$this->dejalaConfig->loadConfig();
 		}
-		else if ($method == 'delivery_options') 
+		else if ($method == 'delivery_options')
 		{
 			$djlUtil = new DejalaUtils();
 			$response = $djlUtil->setStoreCalendar($this->dejalaConfig, $_POST);
@@ -363,32 +363,32 @@ class Dejala extends CarrierModule
 			if ($response['status'] != 200)
 				$errors[] = $this->l('An error occurred while updating products');
 
-		} 
+		}
-		else if ($method == 'golive') 
+		else if ($method == 'golive')
 		{
 			$djlUtil = new DejalaUtils();
 			$response = $djlUtil->goLive($this->dejalaConfig, $_POST);
 		}
-		else if ($method == 'switchMode') 
+		else if ($method == 'switchMode')
 		{
 			$l_mode = Tools::getValue('mode');
-			if ( ('PROD' == $l_mode) || ('TEST' == $l_mode) ) 
+			if ( ('PROD' == $l_mode) || ('TEST' == $l_mode) )
 			{
 				$this->dejalaConfig->mode = $l_mode;
 				$this->dejalaConfig->saveConfig();
 			}
-		} 
+		}
-		else if ($method == 'switchActive') 
+		else if ($method == 'switchActive')
 		{
 
 			$l_active = Tools::getValue('visibility_status');
 
-			if (($l_active == "visible") || ($l_active == "invisible")) 
+			if (($l_active == "visible") || ($l_active == "invisible"))
 			{
 				$this->dejalaConfig->visibility_status = $l_active;
 				$this->dejalaConfig->saveConfig();
 			}
-			if ($l_active == "visible_limited") 
+			if ($l_active == "visible_limited")
 			{
 				$l_active_list = Tools::getValue('visible_users_list');
 				if ($l_active_list == "")
@@ -398,7 +398,7 @@ class Dejala extends CarrierModule
 
 					$errors[] = $this->l('You must provide at least one email address to restrict Dejala\'s visibility.');
 				}
-				else 
+				else
 				{
 					$this->dejalaConfig->visibility_status = $l_active;
 					$this->dejalaConfig->visible_users_list = $l_active_list;
@@ -408,7 +408,7 @@ class Dejala extends CarrierModule
 		}
 		else
 			$errors[] = $this->l('Unable to process the action.');
-			
+
 		return ($errors);
 	}
 
@@ -457,12 +457,12 @@ class Dejala extends CarrierModule
 		$registered = TRUE;
 		if ((0 == strlen($this->dejalaConfig->login)) || (0 == strlen($this->dejalaConfig->password)))
 			$registered= FALSE;
-		
+
-		if ($registered) 
+		if ($registered)
 		{
 			$djlUtil = new DejalaUtils();
 			$responsePing = $djlUtil->ping($this->dejalaConfig, $this->dejalaConfig->mode);
-			if (200 != $responsePing['status']) 
+			if (200 != $responsePing['status'])
 			{
 				if (401 == $responsePing['status'])
 					$errors[] = $this->l('An error occurred while authenticating your account on Dejala.com. Your credentials were not recognized.');
@@ -474,19 +474,19 @@ class Dejala extends CarrierModule
 		}
 
 		$this->context->smarty->assign("registered", $registered?"1":"0");
-		
+
 
 		if (!isset($_GET['cat']) || ($_GET['cat']==='home') || ($_GET['cat']===''))
-			$currentTab="home";
+			$currentTab = "home";
 		else
-			$currentTab=$_GET['cat'];
+			$currentTab = $_GET['cat'];
-			
+
 		$this->context->smarty->assign("currentTab", $currentTab);
 		$this->context->smarty->assign("moduleConfigURL", 'index.php?tab=AdminModules&configure=dejala&token='.$_GET['token']);
-		$this->context->smarty->assign("formAction", $_SERVER['REQUEST_URI']);
+		$this->context->smarty->assign("formAction", Tools::safeOutput($_SERVER['REQUEST_URI']));
 		$outputMenu = $this->display(__FILE__, 'dejala_menu.tpl');
 
-		if ($currentTab==='home') 
+		if ($currentTab === 'home')
 		{
 			$this->context->smarty->assign("login", html_entity_decode(Configuration::get('PS_SHOP_EMAIL'), ENT_COMPAT, 'UTF-8'));
 			if ($registered)
@@ -507,7 +507,7 @@ class Dejala extends CarrierModule
 			}
 			$outputMain = $this->display(__FILE__, 'dejala_home.tpl');
 		}
-		else if ($currentTab==='contacts') 
+		else if ($currentTab==='contacts')
 		{
 			$contacts = array();
 			$djlUtil = new DejalaUtils();
@@ -531,7 +531,7 @@ class Dejala extends CarrierModule
 			{
 				foreach ($location as $key=>$value)
 					$this->context->smarty->assign($key, $value);
-				
+
 				$outputMain = $this->display(__FILE__, 'dejala_location.tpl');
 			}
 		}
@@ -544,11 +544,11 @@ class Dejala extends CarrierModule
 			{
 				foreach ($processes as $key=>$value)
 					$this->context->smarty->assign($key, $value);
-					
+
 				$outputMain = $this->display(__FILE__, 'dejala_processes.tpl');
 			}
 		}
-		else if ($currentTab==='prices') 
+		else if ($currentTab==='prices')
 		{
 			$products = array();
 			$djlUtil = new DejalaUtils();
@@ -568,7 +568,7 @@ class Dejala extends CarrierModule
 				$outputMain = $this->display(__FILE__, 'dejala_products.tpl');
 			}
 		}
-		else if ($currentTab === 'accounting') 
+		else if ($currentTab === 'accounting')
 		{
 			$smartifyErrors = $this->smartyfyStoreAttributes();
 			if (isset($smartifyErrors) && count($smartifyErrors))
@@ -579,17 +579,17 @@ class Dejala extends CarrierModule
 			$responseArray = $djlUtil->getStoreDeliveries($this->dejalaConfig, $deliveries);
 			if ('200'==$responseArray['status'])
 			{
-				foreach ($deliveries as &$delivery) 
+				foreach ($deliveries as &$delivery)
 				{
 					$delivery['creation_date'] = date('d/m/Y', $delivery['creation_utc']);
 					$delivery['creation_time'] = date('H\hi', $delivery['creation_utc']);
-					if (isset($delivery['shipping_start_utc'])) 
+					if (isset($delivery['shipping_start_utc']))
 					{
 						$delivery['shipping_date'] = date('d/m/Y', $delivery['shipping_start_utc']);
 						$delivery['shipping_start'] = date('H\hi', $delivery['shipping_start_utc']);
 						$delivery['shipping_stop'] = date('H\hi', (int)($delivery['shipping_start_utc']) + 3600*(int)($delivery['timelimit']) );
 					}
-					else 
+					else
 					{
 						$delivery['shipping_date'] = '';
 						$delivery['shipping_start'] = '';
@@ -609,7 +609,7 @@ class Dejala extends CarrierModule
 				$outputMain = $this->display(__FILE__, 'dejala_deliveries.tpl');
 			}
 		}
-		else if ($currentTab==='delivery_options') 
+		else if ($currentTab==='delivery_options')
 		{
 			$outputMain = $this->displayDeliveryOptions();
 		}
@@ -716,7 +716,7 @@ class Dejala extends CarrierModule
 
 		$calendar = array();
 		$response = $djlUtil->getStoreCalendar($this->dejalaConfig, $calendar);
-		if ($response['status'] == 200) 
+		if ($response['status'] == 200)
 		{
 			$this->context->smarty->assign("calendar", $calendar);
 			$this->context->smarty->assign("timetableTpl", dirname(__FILE__)."/dejala_picking_timetable.tpl");
@@ -729,7 +729,7 @@ class Dejala extends CarrierModule
 	/**
 	 * Retourne FALSE si un des produits du cart n'est pas en stock, retourne FALSE sinon
 	**/
-	function isCartOutOfStock($cart) 
+	function isCartOutOfStock($cart)
 	{
 		$products = $cart->getProducts();
 		foreach ($products as $product)
@@ -749,7 +749,7 @@ class Dejala extends CarrierModule
 	/**
 	** Affiche le transporteur Dejala.com dans la liste des transporteurs sur le Front Office
 	*/
-	public function hookExtraCarrier($params) 
+	public function hookExtraCarrier($params)
 	{
 
 		$cart = $params['cart'];
@@ -759,8 +759,8 @@ class Dejala extends CarrierModule
 		// Check if Dejala should be visible
 		if ($this->dejalaConfig->visibility_status == "invisible")
 			return ;
-			
+
-		if (($this->dejalaConfig->visibility_status == "visible_limited") && ((int)$this->context->customer->id > 0)) 
+		if (($this->dejalaConfig->visibility_status == "visible_limited") && ((int)$this->context->customer->id > 0))
 		{
 			$customer = $this->context->customer;
 			if (!in_array($customer->email, preg_split("/[\s,]+/", $this->dejalaConfig->visible_users_list)))
@@ -789,10 +789,10 @@ class Dejala extends CarrierModule
 			$id_zone = (int)Address::getZoneById((int)($cart->id_address_delivery));
 		else
 			$id_zone = (int)$this->context->country->id_zone;
-		
+
 		$djlCarrier = DejalaCarrierUtils::getCarrierByName($this->name) ;
-		
+
-		$this->mylog("electedCarrier=" . $this->logValue($djlCarrier,1));	
+		$this->mylog("electedCarrier=" . $this->logValue($djlCarrier,1));
 
 		if ($djlCarrier == null)
 			return null ;
@@ -811,11 +811,11 @@ class Dejala extends CarrierModule
 		$this->mylog("productCalendar=" . $this->logValue($productCalendar,1));
 		$this->mylog("storeCalendar=" . $this->logValue($storeCalendar,1));
 		$this->mylog("response['status']=" . $response['status']);
-		if ($response['status'] == 200) 
+		if ($response['status'] == 200)
 		{
-			foreach ($storeCalendar['entries'] as $weekday=>$calEntry) 
+			foreach ($storeCalendar['entries'] as $weekday=>$calEntry)
 			{
-				if (isset($productCalendar[$weekday])) 
+				if (isset($productCalendar[$weekday]))
 				{
 					$calendar[$weekday]["weekday"] = $weekday;
 					$calendar[$weekday]["start_hour"] = max((int)($productCalendar[$weekday]["start_hour"]), (int)($calEntry["start_hour"]));
@@ -840,7 +840,7 @@ class Dejala extends CarrierModule
 
 		if ($dateUtc == NULL)
 			return ;
-		if ($deliveryDelay > 0) 
+		if ($deliveryDelay > 0)
 		{
 			if ($skipCurDay)
 				$dateUtc = $calUtils->skipCurDay($dateUtc);
@@ -861,7 +861,7 @@ class Dejala extends CarrierModule
 		$dates = array();
 		$balladUtc = $dateUtc;
 
-		do 
+		do
 		{
 			$wd = date("w", $balladUtc);
 			if ((int)($calendar[$wd]['stop_hour']) < (int)($calendar[$wd]['start_hour'])) continue ;
@@ -881,9 +881,9 @@ class Dejala extends CarrierModule
 			return ;
 
 		$now = (int)(date("H", $ctime)) ;
-		if ((int)($dates[0]['stop_hour']) > $now && (int)($dates[0]['start_hour']) < $now) 
+		if ((int)($dates[0]['stop_hour']) > $now && (int)($dates[0]['start_hour']) < $now)
 			$dates[0]['start_hour'] = $now ;
-		elseif ((int)($dates[0]['ts']) == $now && (int)($dates[0]['stop_hour']) < $now) 
+		elseif ((int)($dates[0]['ts']) == $now && (int)($dates[0]['stop_hour']) < $now)
 			array_shift($dates) ;
 
 
@@ -930,7 +930,7 @@ class Dejala extends CarrierModule
 			$this->mylog("shipping_date=" . $this->logValue($deliveryDateSelected));
 			foreach ($dates as $l_key=>$l_date)
 			{
-				if ($l_date['value'] == $deliveryDateSelected) 
+				if ($l_date['value'] == $deliveryDateSelected)
 				{
 					$this->context->smarty->assign("deliveryDateIndexSelected", $l_key);
 					$this->context->smarty->assign("deliveryDateSelected", $deliveryDateSelected);
@@ -939,7 +939,7 @@ class Dejala extends CarrierModule
 				}
 			}
 		}
-		if ($setDefaultDate) 
+		if ($setDefaultDate)
 		{
 			$this->context->smarty->assign("deliveryDateIndexSelected", 0);
 			$this->context->smarty->assign("deliveryDateSelected", date("Y/m/d", $dateUtc));
@@ -947,7 +947,7 @@ class Dejala extends CarrierModule
 		}
 
 		$this->context->smarty->assign("isCartOutOfStock", $isCartOutOfStock);
-		if (!$isCartOutOfStock) 
+		if (!$isCartOutOfStock)
 		{
 			$buffer = $this->display(__FILE__, 'dejala_carrier.tpl');
 			$buffer = $buffer . $this->display(__FILE__, 'dejala_timetable.tpl');
@@ -967,7 +967,7 @@ class Dejala extends CarrierModule
 		$this->myLog("POST=" . $this->logValue($_POST));
 
 		$this->myLog('dejala_action=' . Tools::getValue('dejala_action') );
-		if (Tools::getValue('dejala_action')=='order') 
+		if (Tools::getValue('dejala_action')=='order')
 		{
 			$this->myLog('inside - id_cart=' . $id_cart);
 			$mOrderId = (int)Order::getOrderByCartId($id_cart);
@@ -980,14 +980,14 @@ class Dejala extends CarrierModule
 			$mDejalaProductID = $djlCart->id_dejala_product;
 			$mShippingDate = $djlCart->shipping_date;
 			echo '<h4 style="color:red;">';
-			if ($djlCart->mode !== 'PROD') 
+			if ($djlCart->mode !== 'PROD')
 				echo 'MODE : TEST<br/>';
 
 			if (!empty($mShippingDate) && ($mShippingDate != 0))
 				echo $this->l('Shipping date selected') . ' : ' .date('d/m/Y',$mShippingDate). ', ' . $this->l('starting at') . ' : ' .date('H\hi', $mShippingDate) .'<br/>';
 			else
 				echo $this->l('Shipping date not yet selected by the customer') .'<br/>';
-				
+
 			if ( ($djlCart->id_delivery) && Validate::isUnsignedId($djlCart->id_delivery) )
 			{
 				$l_delivery = array();
@@ -1001,11 +1001,11 @@ class Dejala extends CarrierModule
 					else
 						echo $this->l('Order sent to Dejala') . '<br/>';
 				}
-			} 
+			}
 			else
 			{
 				$_html = '';
-				$_html .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post">';
+				$_html .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">';
 				$_html .= '<input type="hidden" name="dejala_action" value="order">';
 				$_html .= '<input type="submit" value="Commander la course">';
 				$_html .= '</form><br />';
@@ -1021,7 +1021,7 @@ class Dejala extends CarrierModule
 	{
 		$text = print_r($var, true);
 
-		if (is_array($arrayOfObjectsToHide)) 
+		if (is_array($arrayOfObjectsToHide))
 		{
 			foreach ($arrayOfObjectsToHide as $objectName)
 			{
@@ -1035,7 +1035,7 @@ class Dejala extends CarrierModule
 		$text = preg_replace('#(\w+)(\s+Object\s+\()#s', '<span style="color: #079700;">$1</span>$2', $text);
 		// color code object properties
 		$text = preg_replace('#\[(\w+)\:(public|private|protected)\]#', '[<span style="color: #000099;">$1</span>:<span style="color: #009999;">$2</span>]', $text);
-		 
+
 		echo '<pre style="font-size: '.$fontSize.'px; line-height: '.$fontSize.'px;text-align:left;">'.$text.'</pre>';
 	}
 
@@ -1050,13 +1050,13 @@ class Dejala extends CarrierModule
 		$dejalaCarrierID = (int)Tools::getValue('dejala_id_carrier');
 		$carrierID = (int)Tools::getValue('id_carrier');
 		$dejalaProductID = (int)Tools::getValue('dejala_id_product');
-		
+
 		if ( !empty($dejalaCarrierID) && !empty($carrierID) && ((int)($dejalaCarrierID) == (int)($carrierID)) )
 		{
 			$id_cart = (int)($cartParams->id);
 
 			$product = $this->getDejalaProduct($cartParams, $dejalaProductID) ;
-			
+
 			$timelimit = 10;
 			if (isset($product['timelimit']))
 			$timelimit = (int)($product['timelimit']);
@@ -1075,7 +1075,7 @@ class Dejala extends CarrierModule
 				if ($shippingTime > time() - 5 * 60)
 					$date_shipping = $shippingTime;
 			}
-			
+
 			$djlCart = $this->getDejalaCart($cartParams->id) ;
 			$djlCart->shipping_date = $date_shipping;
 			$djlCart->id_dejala_product = $dejalaProductID;
@@ -1087,7 +1087,7 @@ class Dejala extends CarrierModule
 			$djlCart->cart_date_upd = date('Y-m-d H:i:s') ;
 			$djlCart->save() ;
 		}
-		
+
 		// FO: VERY DIRTY HACK.... Re-assign the global cart to what it was before.
 		$this->context->cart = $cartParams ;
 	}
@@ -1116,7 +1116,7 @@ class Dejala extends CarrierModule
 		$this->mylog("triggeringStatusList=" . $triggeringStatusList);
 		$triggeringStatuses = explode(",", $triggeringStatusList);
 		$orderID = $params["id_order"];
-		
+
 		if ((NULL !== $orderID) && (TRUE === in_array($currentOrderStatusID, $triggeringStatuses)))
 		{
 			$mOrder = new Order($orderID);
@@ -1157,20 +1157,20 @@ class Dejala extends CarrierModule
 			if ("201" === $statusCode)
 			{
 				$this->mylog("updating dejala cart cart_id=" . $cartId);
-				if (Validate::isUnsignedId($delivery['id'])) 
+				if (Validate::isUnsignedId($delivery['id']))
 				{
 					$this->mylog("updating dejala cart id_delivery=" . $delivery['id']);
 					$djlCart->id_delivery = $delivery['id'];
 					$djlCart->update();
 				}
-				
+
 				if (is_null($mOrder->shipping_number) || (0 === strlen($mOrder->shipping_number)))
 				{
 					$this->myLog('setting Order->shipping_number to ' . $delivery['tracking_number']);
 					$mOrder->shipping_number = $delivery['tracking_number'];
 					$mOrder->save();
 				}
-				
+
 				$this->myLog("OK -  Order sent to dejala.com");
 			}
 			else
@@ -1184,7 +1184,7 @@ class Dejala extends CarrierModule
 	public function getInfoFromOrder($orderID, &$delivery)
 	{
 		$mOrder = new Order((int)$orderID);
-		if (NULL !== $mOrder) 
+		if (NULL !== $mOrder)
 		{
 			$mDeliveryAddress = new Address($mOrder->id_address_delivery);
 			if (NULL !== $mDeliveryAddress)
@@ -1221,9 +1221,9 @@ class Dejala extends CarrierModule
 				$mDejalaProductID = (int)$djlCart->id_dejala_product;
 				$delivery["product_id"] = (int)($mDejalaProductID);
 				$mShippingDate = $djlCart->shipping_date;
-				if ( is_null($mShippingDate) || empty($mShippingDate) ) 
+				if ( is_null($mShippingDate) || empty($mShippingDate) )
 					$mShippingDate = 0;
-					
+
 				$delivery["shipping_start_utc"]=$mShippingDate;
 			}
 		}
@@ -1236,11 +1236,11 @@ class Dejala extends CarrierModule
 		return $this->getOrderShippingCost($cart, 0);
 	}
 
-	public function getOrderShippingCost($cart, $shipping_cost) 
+	public function getOrderShippingCost($cart, $shipping_cost)
 	{
 		return $this->getDejalaProductPrice($cart) ;
 	}
-	
+
 
 	private function getDejalaCart($cartId) {
 		return DejalaCart::getInstance($cartId) ;
@@ -1249,9 +1249,9 @@ class Dejala extends CarrierModule
 	private function getDejalaProductPrice($cart)
 	{
 		$djlCart = $this->getDejalaCart($cart->id) ;
-		if (isset($djlCart->delivery_price) && $cart->date_upd <= $djlCart->cart_date_upd) 
+		if (isset($djlCart->delivery_price) && $cart->date_upd <= $djlCart->cart_date_upd)
 			return $djlCart->delivery_price ;
-			
+
 		$product = $this->getDejalaProduct($cart) ;
 		return $product["price"] ;
 	}
@@ -1262,7 +1262,7 @@ class Dejala extends CarrierModule
 		$djlCart = $this->getDejalaCart($cart->id) ;
 
 		if (isset($djlCart->delivery_price) && $cart->date_upd <= $djlCart->cart_date_upd && isset($djlCart->product))
-			if ($productId >= 0 && $djlCart->product["id"] == $productId) 
+			if ($productId >= 0 && $djlCart->product["id"] == $productId)
 				return $djlCart->product ;
 
 
@@ -1280,9 +1280,9 @@ class Dejala extends CarrierModule
 			$acceptPartial = false;
 		if ( ($isCartOutOfStock == '1') && !$acceptPartial)
 			return ;
-		
+
 		$address = new Address($cart->id_address_delivery) ;
-		
+
 		// ask dejala.com for a quotation
 		$quotation["receiver_name"] = $address->lastname;
 		$quotation["receiver_firstname"] = $address->firstname;
@@ -1319,7 +1319,7 @@ class Dejala extends CarrierModule
 		$djlCart->id_dejala_product = (int)$electedProduct["id"];
 		$djlCart->id_delivery = NULL;
 		$djlCart->mode = $this->dejalaConfig->mode;
-		
+
 		$vat_factor = (1+ ($electedProduct['vat'] / 100));
 		$priceTTC = round(($electedProduct['price']*$vat_factor) + $electedProduct['margin'], 2);
 		$priceHT = round($priceTTC/$vat_factor, 2);
@@ -1331,7 +1331,7 @@ class Dejala extends CarrierModule
 		$djlCart->save() ;
 
 		return $electedProduct ;
-		
+
 	}
 
 	public function mylog($msg) {

modules/ebay/ebay.php

@@ -526,7 +526,7 @@ class Ebay extends Module
 		if (Tools::getValue('ebay_country_default_fr') == 'ok')
 			$this->context->cookie->ebay_country_default_fr = true;
 		if (strtolower($this->context->country->iso_code) != 'fr' && !isset($this->context->cookie->ebay_country_default_fr))
-			return $this->_html.$this->displayError($this->l('eBay module currently works only for eBay.fr').'. <a href="'.$_SERVER['REQUEST_URI'].'&ebay_country_default_fr=ok">'.$this->l('Continue anyway ?').'</a>');
+			return $this->_html.$this->displayError($this->l('eBay module currently works only for eBay.fr').'. <a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&ebay_country_default_fr=ok">'.$this->l('Continue anyway ?').'</a>');
 
 
 		// Checking Extension
@@ -653,7 +653,7 @@ class Ebay extends Module
 					  success: function(data)
 					  {
 						if (data == \'OK\')
-							window.location.href = \''.$_SERVER['REQUEST_URI'].'&action=validateToken\';
+							window.location.href = \''.Tools::safeOutput($_SERVER['REQUEST_URI']).'&action=validateToken\';
 						else
 							setTimeout ("checkToken()", 5000);
 					  }
@@ -690,7 +690,7 @@ class Ebay extends Module
 					});
 				});
 			</script>
-			<form action="'.$_SERVER['REQUEST_URI'].'&action=logged" method="post">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&action=logged" method="post">
 				<fieldset>
 					<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Register the module on eBay').'</legend>
 					<label>'.$this->l('Click on the button below').'</label>
@@ -763,9 +763,9 @@ class Ebay extends Module
 		if (isset($_GET['id_tab']))
 			$html .= '<script>
 				  $(".menuTabButton.selected").removeClass("selected");
-				  $("#menuTab'.$_GET['id_tab'].'").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput($_GET['id_tab']).'").addClass("selected");
 				  $(".tabItem.selected").removeClass("selected");
-				  $("#menuTab'.$_GET['id_tab'].'Sheet").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput($_GET['id_tab']).'Sheet").addClass("selected");
 			</script>';
 		return $html;
 	}
@@ -777,22 +777,22 @@ class Ebay extends Module
 
 
 		// Display Form
-		$html = '<form action="index.php?tab='.$_GET['tab'].'&configure='.$_GET['configure'].'&token='.$_GET['token'].'&tab_module='.$_GET['tab_module'].'&module_name='.$_GET['module_name'].'&id_tab=1&section=parameters" method="post" class="form" id="configForm1">
+		$html = '<form action="index.php?tab='.Tools::safeOutput($_GET['tab']).'&configure='.Tools::safeOutput($_GET['configure']).'&token='.Tools::safeOutput($_GET['token']).'&tab_module='.Tools::safeOutput($_GET['tab_module']).'&module_name='.Tools::safeOutput($_GET['module_name']).'&id_tab=1&section=parameters" method="post" class="form" id="configForm1">
 				<fieldset style="border: 0">
 					<h4>'.$this->l('To export your products on eBay, you have to create a pro account on eBay (see Help) and configure your eBay-Prestashop module.').'</h4>
 					<label>'.$this->l('eBay Identifier').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ebay_identifier" value="'.Tools::getValue('ebay_identifier', Configuration::get('EBAY_IDENTIFIER')).'" />
+						<input type="text" size="20" name="ebay_identifier" value="'.Tools::safeOutput(Tools::getValue('ebay_identifier', Configuration::get('EBAY_IDENTIFIER'))).'" />
 						<p>'.(Configuration::get('EBAY_IDENTIFIER') ? '<a href="http://shop.ebay.fr/'.Configuration::get('EBAY_IDENTIFIER').'/m.html?_ipg=50&_sop=12&_rdc=1" target="_blank">'.$this->l('Your products on eBay').'</a>' : $this->l('Your eBay identifier')).'</p>
 					</div>
 					<label>'.$this->l('eBay shop').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ebay_shop" value="'.Tools::getValue('ebay_shop', Configuration::get('EBAY_SHOP')).'" />
+						<input type="text" size="20" name="ebay_shop" value="'.Tools::safeOutput(Tools::getValue('ebay_shop', Configuration::get('EBAY_SHOP'))).'" />
 						<p>'.(Configuration::get('EBAY_SHOP') ? '<a href="http://stores.ebay.fr/'.Configuration::get('EBAY_SHOP').'" target="_blank">'.$this->l('Your shop on eBay').'</a>' : $this->l('Your eBay shop name')).'</p>
 					</div>
 					<label>'.$this->l('Paypal Identifier (e-mail)').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ebay_paypal_email" value="'.Tools::getValue('ebay_paypal_email', Configuration::get('EBAY_PAYPAL_EMAIL')).'" />
+						<input type="text" size="20" name="ebay_paypal_email" value="'.Tools::safeOutput(Tools::getValue('ebay_paypal_email', Configuration::get('EBAY_PAYPAL_EMAIL'))).'" />
 						<p>'.$this->l('You have to set your PayPal e-mail account, it\'s the only payment available with this module').'</p>
 					</div>
 					<label>'.$this->l('Shipping method').' : </label>
@@ -805,12 +805,12 @@ class Ebay extends Module
 					</div>
 					<label>'.$this->l('Shipping cost').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ebay_shipping_cost" value="'.Tools::getValue('ebay_shipping_cost', Configuration::get('EBAY_SHIPPING_COST')).'" /> '.$configCurrency->sign.'
+						<input type="text" size="20" name="ebay_shipping_cost" value="'.Tools::safeOutput(Tools::getValue('ebay_shipping_cost', Configuration::get('EBAY_SHIPPING_COST'))).'" /> '.$configCurrency->sign.'
 						<p>'.$this->l('Shipping cost configuration for your products on eBay').'</p>
 					</div>
 					<label>'.$this->l('Shop postal code').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ebay_shop_postalcode" value="'.Tools::getValue('ebay_shop_postalcode', Configuration::get('EBAY_SHOP_POSTALCODE')).'" />
+						<input type="text" size="20" name="ebay_shop_postalcode" value="'.Tools::safeOutput(Tools::getValue('ebay_shop_postalcode', Configuration::get('EBAY_SHOP_POSTALCODE'))).'" />
 						<p>'.$this->l('Your shop\'s postal code').'</p>
 					</div>
 				</fieldset>
@@ -932,13 +932,13 @@ class Ebay extends Module
 		// Display header
 		$html = '<p><b>'.$this->l('To export your products on eBay, you have to associate each one of your shop categories to an eBay category. You can also define an impact of your price on eBay.').'</b></p><br />
 
-		<form action="index.php?tab='.$_GET['tab'].'&configure='.$_GET['configure'].'&token='.$_GET['token'].'&tab_module='.$_GET['tab_module'].'&module_name='.$_GET['module_name'].'&id_tab=2&section=category&action=suggestCategories" method="post" class="form" id="configForm2SuggestedCategories">
+		<form action="index.php?tab='.Tools::safeOutput($_GET['tab']).'&configure='.Tools::safeOutput($_GET['configure']).'&token='.Tools::safeOutput($_GET['token']).'&tab_module='.Tools::safeOutput($_GET['tab_module']).'&module_name='.Tools::safeOutput($_GET['module_name']).'&id_tab=2&section=category&action=suggestCategories" method="post" class="form" id="configForm2SuggestedCategories">
 			<p><b>'.$this->l('You can use the button below to associate automatically the categories which have no association for the moment with an eBay suggested category.').'</b>
 			<input class="button" name="submitSave" type="submit" value="'.$this->l('Suggest Categories').'" />
 			</p><br />
 		</form>
 
-		<form action="index.php?tab='.$_GET['tab'].'&configure='.$_GET['configure'].'&token='.$_GET['token'].'&tab_module='.$_GET['tab_module'].'&module_name='.$_GET['module_name'].'&id_tab=2&section=category" method="post" class="form" id="configForm2">
+		<form action="index.php?tab='.Tools::safeOutput($_GET['tab']).'&configure='.Tools::safeOutput($_GET['configure']).'&token='.Tools::safeOutput($_GET['token']).'&tab_module='.Tools::safeOutput($_GET['tab_module']).'&module_name='.Tools::safeOutput($_GET['module_name']).'&id_tab=2&section=category" method="post" class="form" id="configForm2">
 		<table class="table tableDnD" cellpadding="0" cellspacing="0" width="100%">
 			<thead>
 				<tr class="nodrag nodrop">
@@ -1108,10 +1108,10 @@ class Ebay extends Module
 		$ad = dirname($_SERVER["PHP_SELF"]);
 
 		// Display Form
-		$html = '<form action="index.php?tab='.$_GET['tab'].'&configure='.$_GET['configure'].'&token='.$_GET['token'].'&tab_module='.$_GET['tab_module'].'&module_name='.$_GET['module_name'].'&id_tab=3&section=template" method="post" class="form" id="configForm3">
+		$html = '<form action="index.php?tab='.Tools::safeOutput($_GET['tab']).'&configure='.Tools::safeOutput($_GET['configure']).'&token='.Tools::safeOutput($_GET['token']).'&tab_module='.Tools::safeOutput($_GET['tab_module']).'&module_name='.Tools::safeOutput($_GET['module_name']).'&id_tab=3&section=template" method="post" class="form" id="configForm3">
 				<fieldset style="border: 0">
 					<h4>'.$this->l('You can customise the template for your products page on eBay').' :</h4>
-					<textarea class="rte" cols="100" rows="50" name="ebay_product_template">'.Tools::getValue('ebay_product_template', Configuration::get('EBAY_PRODUCT_TEMPLATE')).'</textarea><br />
+					<textarea class="rte" cols="100" rows="50" name="ebay_product_template">'.Tools::safeOutput(Tools::getValue('ebay_product_template', Configuration::get('EBAY_PRODUCT_TEMPLATE'))).'</textarea><br />
 
 					'.(substr(_PS_VERSION_, 0, 3) == '1.3' ? '
 					<script type="text/javascript" src="'.__PS_BASE_URI__.'js/tinymce/jscripts/tiny_mce/tiny_mce.js"></script>
@@ -1289,7 +1289,7 @@ class Ebay extends Module
 
 		<div id="resultSync" style="text-align: center; font-weight: bold; font-size: 14px;"></div>
 
-		<form action="index.php?tab='.$_GET['tab'].'&configure='.$_GET['configure'].'&token='.$_GET['token'].'&tab_module='.$_GET['tab_module'].'&module_name='.$_GET['module_name'].'&id_tab=4&section=sync" method="post" class="form" id="configForm4">
+		<form action="index.php?tab='.Tools::safeOutput($_GET['tab']).'&configure='.Tools::safeOutput($_GET['configure']).'&token='.Tools::safeOutput($_GET['token']).'&tab_module='.Tools::safeOutput($_GET['tab_module']).'&module_name='.Tools::safeOutput($_GET['module_name']).'&id_tab=4&section=sync" method="post" class="form" id="configForm4">
 				<fieldset style="border: 0">
 					<h4>'.$this->l('You will now push your products on eBay.').' <b>'.$this->l('Reminder,').'</b> '.$this->l('you will not have to pay any fees if you have a shop on eBay.').'</h4>
 					<label style="width: 250px;">'.$this->l('Sync Mode').' : </label><br clear="left" /><br /><br />

modules/editorial/editorial.php

@@ -196,7 +196,7 @@ class Editorial extends Module
 			<script type="text/javascript" src="'.__PS_BASE_URI__.'js/tinymce.inc.js"></script>';
 		$this->_html .= '
 		<script type="text/javascript">id_language = Number('.$defaultLanguage.');</script>
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" enctype="multipart/form-data">
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" enctype="multipart/form-data">
 			<fieldset style="width: 905px;">
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" /> '.$this->displayName.'</legend>
 				<label>'.$this->l('Main title').'</label>
@@ -252,7 +252,7 @@ class Editorial extends Module
 						$this->_html .= '<div id="image" >
 							<img src="'.$this->_path.'homepage_logo.jpg?t='.time().'" />
 							<p align="center">'.$this->l('Filesize').' '.(filesize(dirname(__FILE__).'/homepage_logo.jpg') / 1000).'kb</p>
-							<a href="'.$_SERVER['REQUEST_URI'].'&deleteImage" onclick="return confirm(\''.$this->l('Are you sure?', __CLASS__, true, false).'\');">
+							<a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&deleteImage" onclick="return confirm(\''.$this->l('Are you sure?', __CLASS__, true, false).'\');">
 							<img src="../img/admin/delete.gif" alt="'.$this->l('Delete').'" /> '.$this->l('Delete').'</a>
 						</div>';
 						

modules/envoimoinscher/AdminEnvoiMoinsCher.php

@@ -50,7 +50,7 @@ class AdminEnvoiMoinsCher extends AdminTab
 					$orderToExport[] = self::getOrderDetails((int)($id));
 				}
 				echo '<form action="http://www.envoimoinscher.com/index.html" method="POST">
-						<input type="hidden" name="url_renvoi" value="'.Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').$_SERVER['REQUEST_URI'].'">
+						<input type="hidden" name="url_renvoi" value="'.Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 						<input type="hidden" name="login" value="'.htmlspecialchars(Configuration::get('EMC_LOGIN'), ENT_COMPAT, 'UTF-8').'">
 						<input type="hidden" name="tracking" value="prestashop_module_v1">';
 				self::inputMaker($orderToExport);
@@ -65,7 +65,7 @@ class AdminEnvoiMoinsCher extends AdminTab
 			else echo '<div class="alert error">
 					   <img src="' . _PS_IMG_ . 'admin/forbbiden.gif" alt="nok" />
 					   '.$emc->lang('No order to export').'</div>
-					   <p><a class="button" href="'.Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').$_SERVER['REQUEST_URI'].'">Retour</a></p>';
+					   <p><a class="button" href="'.Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').Tools::safeOutput($_SERVER['REQUEST_URI']).'">Retour</a></p>';
 		}
 		else
 		{
@@ -73,7 +73,7 @@ class AdminEnvoiMoinsCher extends AdminTab
 			 AND Configuration::get('EMC_ADDRESS') AND Configuration::get('EMC_ZIP_CODE') AND Configuration::get('EMC_CITY') AND Configuration::get('EMC_COUNTRY')
 			 AND Configuration::get('EMC_PHONE') AND Configuration::get('EMC_EMAIL') AND Configuration::get('EMC_LOGIN'))
 			{
-				echo '<form action="'.$_SERVER['REQUEST_URI'].'" method="POST">';
+				echo '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="POST">';
 				$orders = self::getOrders();
 				self::displayOrders($orders);
 				echo '<p><input type="submit" value="'.$emc->lang('Send').'" name="submitExport" class="button" style="margin:10px 0px 0px 25px;"></p>

modules/envoimoinscher/envoimoinscher.php

@@ -172,10 +172,10 @@ class Envoimoinscher extends Module
 		&facturation.contact_ville='.(isset($confs['EMC_CITY']) ? htmlspecialchars($confs['EMC_CITY'], ENT_COMPAT, 'UTF-8') : '' ).'
 		&facturation.contact_tel='.(isset($confs['EMC_PHONE']) ? htmlspecialchars($confs['EMC_PHONE'], ENT_COMPAT, 'UTF-8') : '' ).'
 		&facturation.contact_email='.(isset($confs['EMC_EMAIL']) ? htmlspecialchars($confs['EMC_EMAIL'], ENT_COMPAT, 'UTF-8') : '' ).'
-		&url_renvoi='.urlencode(Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').$_SERVER['REQUEST_URI']).'">';
+		&url_renvoi='.urlencode(Tools::getProtocol().htmlspecialchars($_SERVER['HTTP_HOST'], ENT_COMPAT, 'UTF-8').Tools::safeOutput($_SERVER['REQUEST_URI'])).'">';
 		
 						
-		$this->_html .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">
+		$this->_html .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">
 		<div style="float: right; width: 440px; height: 165px; border: 1px dashed rgb(102, 102, 102); padding: 8px; margin-left: 12px;margin-top: 11px;">'.$link.'
 			<h3>'.$this->l('Create Envoimoinscher account:').'</h3>
 			<p style="text-align:justify">'.$this->l('To create your account on Envoimoinscher, click the image below. You will go to a dedicated personal space where you will find the necessary tools for easy management of your shipments.').'</p>

modules/fedexcarrier/config.xml

@@ -2,7 +2,7 @@
 <module>
 	<name>fedexcarrier</name>
 	<displayName><![CDATA[Fedex Carrier]]></displayName>
-	<version><![CDATA[1.2.1]]></version>
+	<version><![CDATA[1.2.3]]></version>
 	<description><![CDATA[Offer your customers, different delivery methods with Fedex]]></description>
 	<author><![CDATA[PrestaShop]]></author>
 	<tab><![CDATA[shipping_logistics]]></tab>

modules/fedexcarrier/fedexcarrier.php

@@ -56,7 +56,7 @@ class FedexCarrier extends CarrierModule
 	{
 		$this->name = 'fedexcarrier';
 		$this->tab = 'shipping_logistics';
-		$this->version = '1.2.1';
+		$this->version = '1.2.3';
 		$this->author = 'PrestaShop';
 		$this->limited_countries = array('us');
 
@@ -432,9 +432,9 @@ class FedexCarrier extends CarrierModule
 		if (isset($_GET['id_tab']))
 			$html .= '<script>
 				  $(".menuTabButton.selected").removeClass("selected");
-				  $("#menuTab'.Tools::getValue('id_tab').'").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput(Tools::getValue('id_tab')).'").addClass("selected");
 				  $(".tabItem.selected").removeClass("selected");
-				  $("#menuTab'.Tools::getValue('id_tab').'Sheet").addClass("selected");
+				  $("#menuTab'.Tools::safeOutput(Tools::getValue('id_tab')).'Sheet").addClass("selected");
 			</script>';
 		return $html;
 	}
@@ -468,30 +468,30 @@ class FedexCarrier extends CarrierModule
 			</style>
 
 
-			<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=1&section=general" method="post" class="form" id="configForm">
+			<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=1&section=general" method="post" class="form" id="configForm">
 
 				<fieldset style="border: 0px;">
 					<h4>'.$this->l('General configuration').' :</h4>
 					<label>'.$this->l('Your Fedex account').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_account" value="'.Tools::getValue('fedex_carrier_account', Configuration::get('FEDEX_CARRIER_ACCOUNT')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_account" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_account', Configuration::get('FEDEX_CARRIER_ACCOUNT'))).'" /></div>
 					<label>'.$this->l('Your Fedex meter number').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_meter" value="'.Tools::getValue('fedex_carrier_meter', Configuration::get('FEDEX_CARRIER_METER')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_meter" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_meter', Configuration::get('FEDEX_CARRIER_METER'))).'" /></div>
 					<label>'.$this->l('Your Fedex password').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_password" value="'.Tools::getValue('fedex_carrier_password', Configuration::get('FEDEX_CARRIER_PASSWORD')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_password" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_password', Configuration::get('FEDEX_CARRIER_PASSWORD'))).'" /></div>
 					<label>'.$this->l('Your Fedex API Key').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="fedex_carrier_api_key" value="'.Tools::getValue('fedex_carrier_api_key', Configuration::get('FEDEX_CARRIER_API_KEY')).'" />
+						<input type="text" size="20" name="fedex_carrier_api_key" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_api_key', Configuration::get('FEDEX_CARRIER_API_KEY'))).'" />
 						<p><a href="http://www.fedex.com/webtools/" target="_blank">' . $this->l('Please click here to get your Fedex API Key.') . '</a></p>
 					</div>
 					<br /><br />
 					<label>'.$this->l('Packaging Weight').' : </label>
 					<div class="margin-form">
-						<input type="text" size="5" name="fedex_carrier_packaging_weight" value="'.Tools::getValue('fedex_carrier_packaging_weight', Configuration::get('FEDEX_CARRIER_PACKAGING_WEIGHT')).'" />
+						<input type="text" size="5" name="fedex_carrier_packaging_weight" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_packaging_weight', Configuration::get('FEDEX_CARRIER_PACKAGING_WEIGHT'))).'" />
-						'.Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT')).'
+						'.Tools::safeOutput(Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT'))).'
 					</div>
 					<label>'.$this->l('Handling Fee').' : </label>
 					<div class="margin-form">
-						<input type="text" size="5" name="fedex_carrier_handling_fee" value="'.Tools::getValue('fedex_carrier_handling_fee', Configuration::get('FEDEX_CARRIER_HANDLING_FEE')).'" />
+						<input type="text" size="5" name="fedex_carrier_handling_fee" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_handling_fee', Configuration::get('FEDEX_CARRIER_HANDLING_FEE'))).'" />
 						'.$configCurrency->sign.'
 					</div>
 				</fieldset>
@@ -500,12 +500,12 @@ class FedexCarrier extends CarrierModule
 					<h4>'.$this->l('Localization configuration').' :</h4>
 					<label>'.$this->l('Weight unit').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ps_weight_unit" value="'.Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT')).'" />
+						<input type="text" size="20" name="ps_weight_unit" value="'.Tools::safeOutput(Tools::getValue('ps_weight_unit', Configuration::get('PS_WEIGHT_UNIT'))).'" />
 						<p>'.$this->l('The weight unit of your shop (eg. kg or lbs)').'</p>
 					</div>
 					<label>'.$this->l('Dimension unit').' : </label>
 					<div class="margin-form">
-						<input type="text" size="20" name="ps_dimension_unit" value="'.Tools::getValue('ps_dimension_unit', Configuration::get('PS_DIMENSION_UNIT')).'" />
+						<input type="text" size="20" name="ps_dimension_unit" value="'.Tools::safeOutput(Tools::getValue('ps_dimension_unit', Configuration::get('PS_DIMENSION_UNIT'))).'" />
 						<p>'.$this->l('The dimension unit of your shop (eg. cm or in)').'</p>
 					</div>
 				</fieldset>
@@ -513,13 +513,13 @@ class FedexCarrier extends CarrierModule
 				<fieldset style="border: 0px;">
 					<h4>'.$this->l('Address configuration').' :</h4>
 					<label>'.$this->l('Your address line 1').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_address1" value="'.Tools::getValue('fedex_carrier_address1', Configuration::get('FEDEX_CARRIER_ADDRESS1')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_address1" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_address1', Configuration::get('FEDEX_CARRIER_ADDRESS1'))).'" /></div>
 					<label>'.$this->l('Your address line 2').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_address2" value="'.Tools::getValue('fedex_carrier_address2', Configuration::get('FEDEX_CARRIER_ADDRESS2')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_address2" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_address2', Configuration::get('FEDEX_CARRIER_ADDRESS2'))).'" /></div>
 					<label>'.$this->l('Zip / Postal Code').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_postal_code" value="'.Tools::getValue('fedex_carrier_postal_code', Configuration::get('FEDEX_CARRIER_POSTAL_CODE')).'" /></div><br />
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_postal_code" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_postal_code', Configuration::get('FEDEX_CARRIER_POSTAL_CODE'))).'" /></div><br />
 					<label>'.$this->l('Your City').' : </label>
-					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_city" value="'.Tools::getValue('fedex_carrier_city', Configuration::get('FEDEX_CARRIER_CITY')).'" /></div>
+					<div class="margin-form"><input type="text" size="20" name="fedex_carrier_city" value="'.Tools::safeOutput(Tools::getValue('fedex_carrier_city', Configuration::get('FEDEX_CARRIER_CITY'))).'" /></div>
 					<label>'.$this->l('Country').' : </label>
 					<div class="margin-form">
 						<select name="fedex_carrier_country" id="fedex_carrier_country">
@@ -832,10 +832,10 @@ class FedexCarrier extends CarrierModule
 					<td>'.$c['additional_charges'].' '.$configCurrency->sign.'</td>
 					<td>'.$services.'</td>
 					<td>
-						<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=edit&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'" style="float: left;">
+						<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=edit&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'" style="float: left;">
 							<img src="'._PS_IMG_.'admin/edit.gif" />
 						</a>
-						<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=delete&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'&id_category='.(int)($c['id_category']).'" method="post" class="form" style="float: left;">
+						<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=delete&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'&id_category='.(int)($c['id_category']).'" method="post" class="form" style="float: left;">
 							<input name="submitSave" type="image" src="'._PS_IMG_.'admin/delete.gif" OnClick="return confirm(\''.$this->l('Are you sure you want to delete this specific FEDEX configuration for this category ?').'\');" />
 						</form>
 					</td>
@@ -861,8 +861,8 @@ class FedexCarrier extends CarrierModule
 				$path .= $p;
 			}
 
-			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
+			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=edit&id_fedex_rate_config='.(int)(Tools::getValue('id_fedex_rate_config')).'" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=edit&id_fedex_rate_config='.(int)(Tools::getValue('id_fedex_rate_config')).'" method="post" class="form">
 						<label>'.$this->l('Category').' :</label>
 						<div class="margin-form" style="padding: 0.2em 0.5em 0 0; font-size: 12px;">'.$path.' <input type="hidden" name="id_category" value="'.(int)($configSelected['id_category']).'" /></div><br clear="left" />
 						<label>'.$this->l('Pickup Type').' : </label>
@@ -882,7 +882,7 @@ class FedexCarrier extends CarrierModule
 						$html .= '</select>
 						</div>
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges', $configSelected['additional_charges']).'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges', $configSelected['additional_charges'])).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'fedex_rate_service_code`');
@@ -900,7 +900,7 @@ class FedexCarrier extends CarrierModule
 		else
 		{
 			$html .= '<p align="center"><b>'.$this->l('Add a rule').'</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=2&section=category&action=add" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=2&section=category&action=add" method="post" class="form">
 						<label>'.$this->l('Category').' : </label>
 						<div class="margin-form">
 							<select name="id_category">
@@ -925,7 +925,7 @@ class FedexCarrier extends CarrierModule
 						$html .= '</select>
 						</div>
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges').'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges')).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'fedex_rate_service_code`');
@@ -1102,10 +1102,10 @@ class FedexCarrier extends CarrierModule
 					<td>'.$c['additional_charges'].' '.$configCurrency->sign.'</td>
 					<td>'.$services.'</td>
 					<td>
-						<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=edit&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'" style="float: left;">
+						<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=edit&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'" style="float: left;">
 							<img src="'._PS_IMG_.'admin/edit.gif" />
 						</a>
-						<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=delete&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'&id_product='.(int)($c['id_product']).'" method="post" class="form" style="float: left;">
+						<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=delete&id_fedex_rate_config='.(int)($c['id_fedex_rate_config']).'&id_product='.(int)($c['id_product']).'" method="post" class="form" style="float: left;">
 							<input name="submitSave" type="image" src="'._PS_IMG_.'admin/delete.gif" OnClick="return confirm(\''.$this->l('Are you sure you want to delete this specific FEDEX configuration for this product ?').'\');" />
 						</form>
 					</td>
@@ -1123,8 +1123,8 @@ class FedexCarrier extends CarrierModule
 			$configSelected = Db::getInstance()->getRow('SELECT * FROM `'._DB_PREFIX_.'fedex_rate_config` WHERE `id_fedex_rate_config` = '.(int)(Tools::getValue('id_fedex_rate_config')));
 			$product = new Product((int)$configSelected['id_product'], false, (int)$this->context->language->id);
 
-			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
+			$html .= '<p align="center"><b>'.$this->l('Update a rule').' (<a href="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=add">'.$this->l('Add a rule').' ?</a>)</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=edit&id_fedex_rate_config='.(int)(Tools::getValue('id_fedex_rate_config')).'" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=edit&id_fedex_rate_config='.(int)(Tools::getValue('id_fedex_rate_config')).'" method="post" class="form">
 						<label>'.$this->l('Product').' :</label>
 						<div class="margin-form" style="padding: 0.2em 0.5em 0 0; font-size: 12px;">'.$product->name.' <input type="hidden" name="id_product" value="'.(int)($configSelected['id_product']).'" /></div><br clear="left" />
 						<label>'.$this->l('Pickup Type').' : </label>
@@ -1144,13 +1144,14 @@ class FedexCarrier extends CarrierModule
 						$html .= '</select>
 						</div>
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges', $configSelected['additional_charges']).'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges', $configSelected['additional_charges'])).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'fedex_rate_service_code`');
 								foreach($rateServiceList as $rateService)
 								{
-									$configServiceSelected = Db::getInstance()->getValue('SELECT `id_fedex_rate_service_code` FROM `'._DB_PREFIX_.'fedex_rate_config_service` WHERE `id_fedex_rate_config` = '.(int)(Tools::getValue('id_fedex_rate_config')).' AND `id_fedex_rate_service_code` = '.(int)($rateService['id_fedex_rate_service_code']));
+									$configServiceSelected = Db::getInstance()->getValue('SELECT `id_fedex_rate_service_code` FROM `'._DB_PREFIX_.'fedex_rate_config_service` WHERE `id_fedex_rate_config` = '.(int)(
+									Tools::getValue('id_fedex_rate_config')).' AND `id_fedex_rate_service_code` = '.(int)($rateService['id_fedex_rate_service_code']));
 									$html .= '<input type="checkbox" name="service[]" value="'.$rateService['id_fedex_rate_service_code'].'" '.(($this->_isPostCheck($rateService['id_fedex_rate_service_code']) == 1 || $configServiceSelected > 0) ? 'checked="checked"' : '').' /> '.$rateService['service'].'<br />';
 								}
 						$html .= '
@@ -1162,7 +1163,7 @@ class FedexCarrier extends CarrierModule
 		else
 		{
 			$html .= '<p align="center"><b>'.$this->l('Add a rule').'</b></p>
-					<form action="index.php?tab='.Tools::getValue('tab').'&configure='.Tools::getValue('configure').'&token='.Tools::getValue('token').'&tab_module='.Tools::getValue('tab_module').'&module_name='.Tools::getValue('module_name').'&id_tab=3&section=product&action=add" method="post" class="form">
+					<form action="index.php?tab='.Tools::safeOutput(Tools::getValue('tab')).'&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'&id_tab=3&section=product&action=add" method="post" class="form">
 						<label>'.$this->l('Product').' : </label>
 						<div class="margin-form">
 							<select name="id_product">
@@ -1193,7 +1194,7 @@ class FedexCarrier extends CarrierModule
 						$html .= '</select>
 						</div>
 						<label>'.$this->l('Additional charges').' : </label>
-						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::getValue('additional_charges').'" /></div><br />
+						<div class="margin-form"><input type="text" size="20" name="additional_charges" value="'.Tools::safeOutput(Tools::getValue('additional_charges')).'" /></div><br />
 						<label>'.$this->l('Delivery Service').' : </label>
 							<div class="margin-form">';
 								$rateServiceList = Db::getInstance()->ExecuteS('SELECT * FROM `'._DB_PREFIX_.'fedex_rate_service_code`');
@@ -1692,7 +1693,7 @@ class FedexCarrier extends CarrierModule
 				Db::getInstance()->autoExecute(_DB_PREFIX_.'fedex_cache_test', array('hash' => pSQL(md5(var_export($requestHash, true))), 'result' => pSQL(serialize($resultTab)), 'date_add' => pSQL(date('Y-m-d H:i:s')), 'date_upd' => pSQL(date('Y-m-d H:i:s'))), 'INSERT');
 
 			// Return results
-			if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity == 'SUCCESS')
+			if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity != 'ERROR' && isset($resultTab->RateReplyDetails->RatedShipmentDetails[0]->ShipmentRateDetail->TotalNetCharge->Amount))
 				return true;
 
 			if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity == 'ERROR')
@@ -1763,7 +1764,7 @@ class FedexCarrier extends CarrierModule
 
 		// Get Rates
 		try { $resultTab = $client->getRates($request); }
-		catch (Exception $e) { return array('connect' => false, 'cost' => 0); }
+		catch (Exception $e) { }
 
 
 		// Check currency
@@ -1775,7 +1776,7 @@ class FedexCarrier extends CarrierModule
 		}
 
 		// Return results
-		if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity == 'SUCCESS')
+		if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity != 'ERROR' && isset($resultTab->RateReplyDetails->RatedShipmentDetails[0]->ShipmentRateDetail->TotalNetCharge->Amount))
 			return array('connect' => true, 'cost' => number_format($resultTab->RateReplyDetails->RatedShipmentDetails[0]->ShipmentRateDetail->TotalNetCharge->Amount,2,'.',',') * $conversionRate);
 
 		if (isset($resultTab->HighestSeverity) && $resultTab->HighestSeverity == 'ERROR')

modules/followup/followup.php

@@ -108,7 +108,7 @@ class Followup extends Module
 		
 		echo '
 		<h2>'.$this->l('Customer follow-up').'</h2>
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset style="width: 400px; float: left;">
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<p>'.$this->l('Four kinds of e-mail alerts available in order to stay in touch with your customers!').'<br /><br />

modules/gadsense/gadsense.php

@@ -79,11 +79,11 @@ class GAdsense extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend>'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Your code').'</label>
 				<div class="margin-form">
-					<textarea name="gadsense_id" cols="90" rows="10" />'.Tools::getValue('gadsense_id', Configuration::get('GADSENSE_ID')).'</textarea>
+					<textarea name="gadsense_id" cols="90" rows="10" />'.Tools::safeOutput(Tools::getValue('gadsense_id', Configuration::get('GADSENSE_ID'))).'</textarea>
 					<p class="clear">'.$this->l('Example:').' <br /><br /><img src="../modules/gadsense/adsense_script.gif"></p>
 				</div>
 				<center><input type="submit" name="submitGAdsense" value="'.$this->l('Update settings').'" class="button" /></center>			

modules/ganalytics/ganalytics.php

@@ -78,12 +78,12 @@ class GAnalytics extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset class="width2">
 				<legend><img src="../img/admin/cog.gif" alt="" class="middle" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Your username').'</label>
 				<div class="margin-form">
-					<input type="text" name="ganalytics_id" value="'.Tools::getValue('ganalytics_id', Configuration::get('GANALYTICS_ID')).'" />
+					<input type="text" name="ganalytics_id" value="'.Tools::safeOutput(Tools::getValue('ganalytics_id', Configuration::get('GANALYTICS_ID'))).'" />
 					<p class="clear">'.$this->l('Example:').' UA-1234567-1</p>
 				</div>
 				<center><input type="submit" name="submitGAnalytics" value="'.$this->l('Update ID').'" class="button" /></center>

modules/gcheckout/gcheckout.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -36,7 +36,7 @@ class GCheckout extends PaymentModule
         $this->tab = 'payments_gateways';
 		$this->version = '1.2';
 		$this->author = 'PrestaShop';
-		
+
 		$this->currencies = true;
 		$this->currencies_mode = 'radio';
 
@@ -44,7 +44,7 @@ class GCheckout extends PaymentModule
 
 		$this->displayName = $this->l('Google Checkout');
 		$this->description = $this->l('Google Checkout API implementation');
-		
+
 		if (!sizeof(Currency::checkPaymentCurrencies($this->id)))
 			$this->warning = $this->l('No currency set for this module');
 
@@ -57,13 +57,13 @@ class GCheckout extends PaymentModule
 	}
 
 	public function install()
-	{		
+	{
-		if (!parent::install() OR !$this->registerHook('payment') OR 
+		if (!parent::install() OR !$this->registerHook('payment') OR
-				!$this->registerHook('paymentReturn') OR 
+				!$this->registerHook('paymentReturn') OR
-				!Configuration::updateValue('GCHECKOUT_MERCHANT_ID', '822305931131113') OR 
+				!Configuration::updateValue('GCHECKOUT_MERCHANT_ID', '822305931131113') OR
-				!Configuration::updateValue('GCHECKOUT_MERCHANT_KEY', '2Lv_osMomVIocnLK0aif3A') OR 
+				!Configuration::updateValue('GCHECKOUT_MERCHANT_KEY', '2Lv_osMomVIocnLK0aif3A') OR
-				!Configuration::updateValue('GCHECKOUT_LOGS', '1') OR 
+				!Configuration::updateValue('GCHECKOUT_LOGS', '1') OR
-				!Configuration::updateValue('GCHECKOUT_MODE', 'real') OR 
+				!Configuration::updateValue('GCHECKOUT_MODE', 'real') OR
 				!Configuration::updateValue('GCHECKOUT_NO_SHIPPING', '0'))
 			return false;
 		return true;
@@ -71,14 +71,14 @@ class GCheckout extends PaymentModule
 
 	public function uninstall()
 	{
-		return (parent::uninstall() AND 
+		return (parent::uninstall() AND
-			Configuration::deleteByName('GCHECKOUT_MERCHANT_ID') AND 
+			Configuration::deleteByName('GCHECKOUT_MERCHANT_ID') AND
 			Configuration::deleteByName('GCHECKOUT_MERCHANT_KEY') AND
-			Configuration::deleteByName('GCHECKOUT_MODE') AND 
+			Configuration::deleteByName('GCHECKOUT_MODE') AND
-			Configuration::deleteByName('GCHECKOUT_LOGS') AND 
+			Configuration::deleteByName('GCHECKOUT_LOGS') AND
 			Configuration::deleteByName('GCHECKOUT_NO_SHIPPING'));
 	}
-	
+
 	public function getContent()
 	{
 		if (Tools::isSubmit('submitGoogleCheckout'))
@@ -98,20 +98,20 @@ class GCheckout extends PaymentModule
 				Configuration::updateValue('GCHECKOUT_LOGS', 1);
 			else
 				Configuration::updateValue('GCHECKOUT_LOGS', 0);
-			
+
 			if (Tools::getValue('gcheckout_no_shipping'))
 				Configuration::updateValue('GCHECKOUT_NO_SHIPPING', 1);
 			else
 				Configuration::updateValue('GCHECKOUT_NO_SHIPPING', 0);
 
-			if (!sizeof($errors))
+			if (!$errors)
-				Tools::redirectAdmin(AdminTab::$currentIndex.'&configure=gcheckout&token='.Tools::getValue('token').'&conf=4');
+				Tools::redirectAdmin(AdminTab::$currentIndex.'&configure=gcheckout&token='.Tools::safeOutput(Tools::getValue('token')).'&conf=4');
 			foreach ($errors as $error)
 				echo $error;
 		}
-		
+
 		$html = '<h2>'.$this->displayName.'</h2>
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 			<legend><img src="'.__PS_BASE_URI__.'modules/gcheckout/logo.gif" />'.$this->l('Settings').'</legend>
 			<p>
@@ -139,13 +139,13 @@ class GCheckout extends PaymentModule
 					'.$this->l('Merchant ID').'
 				</label>
 				<div class="margin-form">
-					<input type="text" name="gcheckout_merchant_id" value="'.Tools::getValue('gcheckout_merchant_id', Configuration::get('GCHECKOUT_MERCHANT_ID')).'" />
+					<input type="text" name="gcheckout_merchant_id" value="'.Tools::safeOutput(Tools::getValue('gcheckout_merchant_id', Configuration::get('GCHECKOUT_MERCHANT_ID'))).'" />
 				</div>
 				<label>
 					'.$this->l('Merchant Key').'
 				</label>
 				<div class="margin-form">
-					<input type="text" name="gcheckout_merchant_key" value="'.Tools::getValue('gcheckout_merchant_key', Configuration::get('GCHECKOUT_MERCHANT_KEY')).'" />
+					<input type="text" name="gcheckout_merchant_key" value="'.Tools::safeOutput(Tools::getValue('gcheckout_merchant_key', Configuration::get('GCHECKOUT_MERCHANT_KEY'))).'" />
 				</div>
 				<p>'.$this->l('If you click this box, buyers will be able to see the shipping fees you have setup in Google Checkout on the purchase page.').'</p>
 				<label>
@@ -154,7 +154,7 @@ class GCheckout extends PaymentModule
 				<div class="margin-form" style="margin-top:5px">
 					<input type="checkbox" name="gcheckout_no_shipping"'.(Tools::getValue('gcheckout_no_shipping', Configuration::get('GCHECKOUT_NO_SHIPPING')) ? ' checked="checked"' : '').' />
 				</div>
-				<p>'.$this->l('You can log the server-to-server communication. The log files are').' '.__PS_BASE_URI__.'modules/gcheckout/googleerror.log '.$this->l('and').' '.__PS_BASE_URI__.'modules/gcheckout/googlemessage.log. '.$this->l('If activated, be sure to protect them by putting a .htaccess file in the same directory. If not, they will be readable by everyone.').'</p>				
+				<p>'.$this->l('You can log the server-to-server communication. The log files are').' '.__PS_BASE_URI__.'modules/gcheckout/googleerror.log '.$this->l('and').' '.__PS_BASE_URI__.'modules/gcheckout/googlemessage.log. '.$this->l('If activated, be sure to protect them by putting a .htaccess file in the same directory. If not, they will be readable by everyone.').'</p>
 				<label>
 					'.$this->l('Logs').'
 				</label>
@@ -173,7 +173,7 @@ class GCheckout extends PaymentModule
 			<p>- '.$this->l('The callback method must be set to').' <b>XML</b>.</p>
 			<p>- '.$this->l('Orders must be placed with the same currency as your seller account. Carts in other currencies will be converted if the customer chooses to pay with this module.').'<p>
 		</fieldset>';
-		
+
 		return $html;
 	}
 
@@ -185,22 +185,22 @@ class GCheckout extends PaymentModule
 		$this->context->smarty->assign('buttonText', $this->l('Pay with GoogleCheckout'));
 		return $this->display(__FILE__, 'payment.tpl');
 	}
-	
+
 	public function hookPaymentReturn($params)
 	{
 		if (!$this->active)
 			return;
 		return $this->display(__FILE__, 'payment_return.tpl');
 	}
-	
+
 	public function preparePayment()
 	{
 		require_once(dirname(__FILE__).'/library/googlecart.php');
 		require_once(dirname(__FILE__).'/library/googleitem.php');
 		require_once(dirname(__FILE__).'/library/googleshipping.php');
-		
+
 		$currency = $this->getCurrency($this->context->cart->id_currency);
-			
+
 		if ($this->context->cart->id_currency != $currency->id)
 		{
 			$this->context->cart->id_currency = (int)$currency->id;
@@ -208,29 +208,29 @@ class GCheckout extends PaymentModule
 			$this->context->cart->update();
 			Tools::redirect('modules/'.$this->name.'/payment.php');
 		}
-			
+
 			$googleCart = new GoogleCart(
-				Configuration::get('GCHECKOUT_MERCHANT_ID'), 
+				Configuration::get('GCHECKOUT_MERCHANT_ID'),
-				Configuration::get('GCHECKOUT_MERCHANT_KEY'), 
+				Configuration::get('GCHECKOUT_MERCHANT_KEY'),
 				Configuration::get('GCHECKOUT_MODE'), $currency->iso_code);
-				
+
 		foreach ($this->context->cart->getProducts() AS $product)
 				$googleCart->AddItem(new GoogleItem(utf8_decode($product['name'].
-				((isset($product['attributes']) AND !empty($product['attributes'])) ? 
+				((isset($product['attributes']) AND !empty($product['attributes'])) ?
-				' - '.$product['attributes'] : '')), utf8_decode($product['description_short']), 
+				' - '.$product['attributes'] : '')), utf8_decode($product['description_short']),
-				(int)$product['cart_quantity'], $product['price_wt'], 
+				(int)$product['cart_quantity'], $product['price_wt'],
 				strtoupper(Configuration::get('PS_WEIGHT_UNIT')), (float)$product['weight']));
-				 
+
 		if ($wrapping = $this->context->cart->getOrderTotal(true, Cart::ONLY_WRAPPING))
 			$googleCart->AddItem(new GoogleItem(utf8_decode($this->l('Wrapping')), '', 1, $wrapping));
 		foreach ($this->context->cart->getDiscounts() AS $voucher)
-				$googleCart->AddItem(new GoogleItem(utf8_decode($voucher['name']), 
+				$googleCart->AddItem(new GoogleItem(utf8_decode($voucher['name']),
 				utf8_decode($voucher['description']), 1, '-'.$voucher['value_real']));
-		
+
 		if (!Configuration::get('GCHECKOUT_NO_SHIPPING'))
 		{
 			$carrier = new Carrier((int)($this->context->cart->id_carrier), $this->context->language->id);
-			$googleCart->AddShipping(new GoogleFlatRateShipping(utf8_decode($carrier->name), 
+			$googleCart->AddShipping(new GoogleFlatRateShipping(utf8_decode($carrier->name),
 				$this->context->cart->getOrderShippingCost($this->context->cart->id_carrier)));
 		}
 
@@ -238,9 +238,9 @@ class GCheckout extends PaymentModule
 		$googleCart->SetContinueShoppingUrl(Tools::getShopDomainSsl(true, true).__PS_BASE_URI__.'order-confirmation.php');
 		$googleCart->SetRequestBuyerPhone(false);
 		$googleCart->SetMerchantPrivateData($this->context->cart->id.'|'.$this->context->cart->secure_key);
-			
+
 			$total = $this->context->cart->getOrderTotal();
-	
+
 		$this->context->smarty->assign(array(
 			'googleCheckoutExtraForm' => $googleCart->CheckoutButtonCode($this->l('Pay with GoogleCheckout'), 'LARGE'),
 				'total' => $total,

modules/hipay/hipay.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -43,7 +43,7 @@ class Hipay extends PaymentModule
 		$this->currencies_mode = 'radio';
 
 		parent::__construct();
-		
+
 		$this->displayName = $this->l('Hipay');
 		$this->description = $this->l('Secure payement with Visa, Mastercard and European solutions.');
 
@@ -58,12 +58,12 @@ class Hipay extends PaymentModule
 
 		foreach ($result as $num => $iso)
 			$this->limited_countries[] = $iso['iso_code'];
-		
+
 		if ($this->id)
 		{
 			$this->prod = (int)Tools::getValue('HIPAY_PROD', Configuration::get('HIPAY_PROD'));
 			// Define extracted from mapi/mapi_defs.php
-			if (!defined('HIPAY_GATEWAY_URL')) 
+			if (!defined('HIPAY_GATEWAY_URL'))
 				define('HIPAY_GATEWAY_URL','https://'.($this->prod ? '' : 'test.').'payment.hipay.com/order/');
 		}
 	}
@@ -71,36 +71,36 @@ class Hipay extends PaymentModule
 	public function	install()
 	{
 		Configuration::updateValue('HIPAY_SALT', uniqid());
-		// Force using Prod mod	
+		// Force using Prod mod
 		Configuration::updateValue('HIPAY_PROD', 1);
 
 		if (!Configuration::get('HIPAY_UNIQID'))
 			Configuration::updateValue('HIPAY_UNIQID', uniqid());
 		if (!Configuration::get('HIPAY_RATING'))
 			Configuration::updateValue('HIPAY_RATING', 'ALL');
-		
+
 		if (!(parent::install() AND $this->registerHook('payment')))
 			return false;
-			
+
 		$result = Db::getInstance()->ExecuteS('
 			SELECT `id_zone`, `name`
 			FROM `'._DB_PREFIX_.'zone`
 			WHERE `active` = 1
 		');
-		
+
 		foreach ($result as $rowNumber => $rowValues)
 		{
 			Configuration::deleteByName('HIPAY_AZ_'.$rowValues['id_zone']);
 			Configuration::deleteByName('HIPAY_AZ_ALL_'.$rowValues['id_zone']);
 		}
 		Db::getInstance()->Execute('DELETE FROM `'._DB_PREFIX_.'module_country` WHERE `id_module` = '.(int)$this->id);
-			
+
 		return true;
 	}
 
 	/**
 	 * Set shipping zone search
-	 * 
+	 *
 	 * @param	string $searchField = 'z.id_zone'
 	 * @param	int $defaultZone = 1
 	 * @return	string
@@ -112,20 +112,20 @@ class Hipay extends PaymentModule
 			FROM `'._DB_PREFIX_.'zone`
 			WHERE `active` = 1
 		');
-		
+
 		$tmp = null;
-		foreach ($result as $rowNumber => $rowValues) 
+		foreach ($result as $rowNumber => $rowValues)
 			if (strcmp(Configuration::get('HIPAY_AZ_'.$rowValues['id_zone']), 'ok') == 0)
 				$tmp .= $searchField.' = '.$rowValues['id_zone'].' OR ';
-		
+
 		if ($tmp == null)
 			$tmp = $searchField.' = '.$defaultZone;
 		else
 			$tmp = substr($tmp, 0, strlen($tmp) - strlen(' OR '));
-			
+
 		return $tmp;
 	}
-	
+
 	public function hookPayment($params)
 	{
 		$currency = new Currency($this->getModuleCurrency($this->context->cart));
@@ -133,7 +133,7 @@ class Hipay extends PaymentModule
 		$hipayPassword = ($this->prod ? Configuration::get('HIPAY_PASSWORD_'.$currency->iso_code) : Configuration::get('HIPAY_PASSWORD_TEST_'.$currency->iso_code));
 		$hipaySiteId = ($this->prod ? Configuration::get('HIPAY_SITEID_'.$currency->iso_code) : Configuration::get('HIPAY_SITEID_TEST_'.$currency->iso_code));
 		$hipayCategory = ($this->prod ? Configuration::get('HIPAY_CATEGORY_'.$currency->iso_code) : Configuration::get('HIPAY_CATEGORY_TEST_'.$currency->iso_code));
-		
+
 		if ($hipayAccount AND $hipayPassword AND $hipaySiteId AND $hipayCategory AND Configuration::get('HIPAY_RATING'))
 		{
 			$this->context->smarty->assign('hipay_prod', $this->prod);
@@ -145,12 +145,12 @@ class Hipay extends PaymentModule
 	private function getModuleCurrency($cart)
 	{
 		$id_currency = (int)self::MysqlGetValue('SELECT id_currency FROM `'._DB_PREFIX_.'module_currency` WHERE id_module = '.(int)$this->id);
-		
+
 		if (!$id_currency OR $id_currency == -2)
 			$id_currency = Configuration::get('PS_CURRENCY_DEFAULT');
 		elseif ($id_currency == -1)
 			$id_currency = $cart->id_currency;
-			
+
 		return $id_currency;
 	}
 
@@ -161,7 +161,7 @@ class Hipay extends PaymentModule
 		if ($this->context->cart->id_currency != $id_currency)
 			if (Db::getInstance()->execute('UPDATE '._DB_PREFIX_.'cart SET id_currency = '.(int)$id_currency.' WHERE id_cart = '.(int)$this->context->cart->id))
 				$this->context->cart->id_currency = $id_currency;
-		
+
 		$currency = new Currency($id_currency);
 		$language = new Language($this->context->cart->id_lang);
 		$customer = new Customer($this->context->cart->id_customer);
@@ -169,7 +169,7 @@ class Hipay extends PaymentModule
 		$id_zone = self::MysqlGetValue('SELECT id_zone FROM '._DB_PREFIX_.'address a INNER JOIN '._DB_PREFIX_.'country c ON a.id_country = c.id_country WHERE id_address = '.(int)$this->context->cart->id_address_delivery);
 
 		require_once(dirname(__FILE__).'/mapi/mapi_package.php');
-		
+
 		$hipayAccount = ($this->prod ? Configuration::get('HIPAY_ACCOUNT_'.$currency->iso_code) : Configuration::get('HIPAY_ACCOUNT_TEST_'.$currency->iso_code));
 		$hipayPassword = ($this->prod ? Configuration::get('HIPAY_PASSWORD_'.$currency->iso_code) : Configuration::get('HIPAY_PASSWORD_TEST_'.$currency->iso_code));
 		$hipaySiteId = ($this->prod ? Configuration::get('HIPAY_SITEID_'.$currency->iso_code) : Configuration::get('HIPAY_SITEID_TEST_'.$currency->iso_code));
@@ -202,14 +202,14 @@ class Hipay extends PaymentModule
 		$item->setRef($this->context->cart->id);
 		$item->setCategory($hipaycategory);
 		$item->setPrice($this->context->cart->getOrderTotal());
-		
+
 		try {
 			if (!$item->check())
 				return $this->l('[Hipay] Error: cannot create "Cart" Product');
 		} catch (Exception $e) {
 			return $this->l('[Hipay] Error: cannot create "Cart" Product');
 		}
-		
+
 		$items = array($item);
 
 		$order = new HIPAY_MAPI_Order();
@@ -234,11 +234,11 @@ class Hipay extends PaymentModule
 		else
 		{
 			include(dirname(__FILE__).'/../../header.php');
-			
+
 			$this->context->smarty->assign('errors', array('[Hipay] '.strval($err_msg).' ('.$output.')'));
 			$_SERVER['HTTP_REFERER'] = self::getHttpHost(true, true).'index.php?controller=order&step=3';
 			$this->context->smarty->display(_PS_THEME_DIR_.'errors.tpl');
-			
+
 			include(dirname(__FILE__).'/../../footer.php');
 		}
 	}
@@ -250,7 +250,7 @@ class Hipay extends PaymentModule
 
 		if (_PS_MAGIC_QUOTES_GPC_)
 			$_POST['xml'] = stripslashes($_POST['xml']);
-		
+
 		require_once(dirname(__FILE__).'/mapi/mapi_package.php');
 
 		if (HIPAY_MAPI_COMM_XML::analyzeNotificationXML($_POST['xml'], $operation, $status, $date, $time, $transid, $amount, $currency, $id_cart, $data) === false)
@@ -258,7 +258,7 @@ class Hipay extends PaymentModule
 			file_put_contents('logs'.Configuration::get('HIPAY_UNIQID').'.txt', '['.date('Y-m-d H:i:s').'] Analysis error: '.htmlentities($_POST['xml'])."\n", FILE_APPEND);
 			return false;
 		}
-		
+
 		$cart = new Cart((int)$id_cart);
 		if ($cart->secure_key != Tools::getValue('token'))
 			file_put_contents('logs'.Configuration::get('HIPAY_UNIQID').'.txt', '['.date('Y-m-d H:i:s').'] Token error: '.htmlentities($_POST['xml'])."\n", FILE_APPEND);
@@ -275,11 +275,11 @@ class Hipay extends PaymentModule
 				/* Paiement remboursé sur Hipay */
 				if (!($id_order = Order::getOrderByCartId((int)($id_cart))))
 					die(Tools::displayError());
-					
+
 				$order = new Order((int)($id_order));
 				if (!$order->valid OR $order->getCurrentState() === Configuration::get('PS_OS_REFUND'))
 					die(Tools::displayError());
-					
+
 				$orderHistory = new OrderHistory();
 				$orderHistory->id_order = (int)($order->id);
 				$orderHistory->changeIdOrderState((int)(Configuration::get('PS_OS_REFUND')), (int)($id_order));
@@ -290,48 +290,48 @@ class Hipay extends PaymentModule
 
 	/**
 	 * Uninstall and clean the module settings
-	 * 
+	 *
 	 * @return	bool
 	 */
 	public function uninstall()
 	{
 		parent::uninstall();
-		
+
 		$result = Db::getInstance()->ExecuteS('
 			SELECT `id_zone`, `name`
 			FROM `'._DB_PREFIX_.'zone`
 			WHERE `active` = 1
 		');
-		
+
 		foreach ($result as $rowValues)
 		{
 			Configuration::deleteByName('HIPAY_AZ_'.$rowValues['id_zone']);
 			Configuration::deleteByName('HIPAY_AZ_ALL_'.$rowValues['id_zone']);
 		}
 		Db::getInstance()->Execute('DELETE FROM `'._DB_PREFIX_.'module_country` WHERE `id_module` = '.(int)$this->id);
-		
+
 		return (true);
 	}
-	
+
 	public function getContent()
 	{
 		$currencies = DB::getInstance(_PS_USE_SQL_SLAVE_)->ExecuteS('SELECT c.iso_code, c.name, c.sign FROM '._DB_PREFIX_.'currency c');
-		
+
-		if (Tools::isSubmit('submitHipayAZ')) 
+		if (Tools::isSubmit('submitHipayAZ'))
 		{
 			// Delete all configurated zones
-			foreach ($_POST as $key => $val) 
+			foreach ($_POST as $key => $val)
 			{
-				if (strncmp($key, 'HIPAY_AZ_ALL_', strlen('HIPAY_AZ_ALL_')) == 0) 
+				if (strncmp($key, 'HIPAY_AZ_ALL_', strlen('HIPAY_AZ_ALL_')) == 0)
 				{
 					$id = substr($key, -(strlen($key) - strlen('HIPAY_AZ_ALL_')));
 					Configuration::updateValue('HIPAY_AZ_'.$id, 'ko');
 				}
 			}
 			Db::getInstance()->Execute('DELETE FROM `'._DB_PREFIX_.'module_country` WHERE `id_module` = '.(int)$this->id);
-			
+
 			// Add the new configuration zones
-			foreach ($_POST as $key => $val) 
+			foreach ($_POST as $key => $val)
 			{
 				if (strncmp($key, 'HIPAY_AZ_', strlen('HIPAY_AZ_')) == 0)
 					Configuration::updateValue($key, 'ok');
@@ -340,13 +340,13 @@ class Hipay extends PaymentModule
 			$results = Db::getInstance()->ExecuteS($request.$this->getRequestZones('id_zone'));
 			foreach ($results as $rowValues)
 				Db::getInstance()->Execute('INSERT INTO '._DB_PREFIX_.'module_country VALUE('.(int)$this->id.', '.(int)$rowValues['id_country'].')');
-			
+
 		}
 		elseif (Tools::isSubmit('submitHipay'))
 		{
 			Configuration::updateValue('HIPAY_PROD', Tools::getValue('HIPAY_PROD'));
 			$this->prod = (int)Tools::getValue('HIPAY_PROD', Configuration::get('HIPAY_PROD'));
-			
+
 			$accounts = array();
 			foreach ($currencies as $currency)
 			{
@@ -354,34 +354,34 @@ class Hipay extends PaymentModule
 					Configuration::updateValue('HIPAY_CATEGORY_'.$currency['iso_code'], false);
 				if (Configuration::get('HIPAY_SITEID_TEST_'.$currency['iso_code']) != Tools::getValue('HIPAY_SITEID_TEST_'.$currency['iso_code']))
 					Configuration::updateValue('HIPAY_CATEGORY_TEST_'.$currency['iso_code'], false);
-			
+
 				Configuration::updateValue('HIPAY_ACCOUNT_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_ACCOUNT_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_PASSWORD_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_PASSWORD_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_SITEID_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_SITEID_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_CATEGORY_'.$currency['iso_code'], Tools::getValue('HIPAY_CATEGORY_'.$currency['iso_code']));
-				
+
 				if ($this->prod AND Tools::getValue('HIPAY_ACCOUNT_'.$currency['iso_code']))
 					$accounts[Tools::getValue('HIPAY_ACCOUNT_'.$currency['iso_code'])] = 1;
-					
+
 				Configuration::updateValue('HIPAY_ACCOUNT_TEST_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_ACCOUNT_TEST_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_PASSWORD_TEST_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_PASSWORD_TEST_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_SITEID_TEST_'.$currency['iso_code'], trim(Tools::getValue('HIPAY_SITEID_TEST_'.$currency['iso_code'])));
 				Configuration::updateValue('HIPAY_CATEGORY_TEST_'.$currency['iso_code'], Tools::getValue('HIPAY_CATEGORY_TEST_'.$currency['iso_code']));
-				
+
 				if (!$this->prod AND Tools::getValue('HIPAY_ACCOUNT_TEST_'.$currency['iso_code']))
-					$accounts[Tools::getValue('HIPAY_ACCOUNT_TEST_'.$currency['iso_code'])] = 1;				
+					$accounts[Tools::getValue('HIPAY_ACCOUNT_TEST_'.$currency['iso_code'])] = 1;
 			}
-			
+
 			$i = 1;
 			$dataSync = 'http://www.prestashop.com/modules/hipay.png?mode='.($this->prod ? 'prod' : 'test');
 			foreach ($accounts as $account => $null)
 				$dataSync .= '&account'.($i++).'='.urlencode($account);
-			
+
 			Configuration::updateValue('HIPAY_RATING', Tools::getValue('HIPAY_RATING'));
-			
+
 			echo $this->displayConfirmation($this->l('Configuration updated').'<img src="'.$dataSync.'" style="float:right" />');
 		}
-		
+
 		// Check configuration
 		$allow_url_fopen = ini_get('allow_url_fopen');
 		$openssl = extension_loaded('openssl');
@@ -390,18 +390,18 @@ class Hipay extends PaymentModule
 		$online = (in_array(Tools::getRemoteAddr(), array('127.0.0.1', '::1')) ? false : true);
 		$categories = true;
 		$categoryRetrieval = true;
-		
+
 		foreach ($currencies as $currency)
 		{
 			if (($hipaySiteId = Configuration::get('HIPAY_SITEID_'.$currency['iso_code']) AND $hipayAccountId = Configuration::get('HIPAY_ACCOUNT_'.$currency['iso_code']) AND !count($this->getHipayCategories(true, $hipaySiteId, $hipayAccountId)))
 			OR ($hipaySiteIdTest = Configuration::get('HIPAY_SITEID_TEST_'.$currency['iso_code']) AND $hipayAccountIdTest = Configuration::get('HIPAY_ACCOUNT_TEST_'.$currency['iso_code']) AND !count($this->getHipayCategories(false, $hipaySiteIdTest, $hipayAccountIdTest))))
 				$categoryRetrieval = false;
-				
+
 			if ((Configuration::get('HIPAY_SITEID_'.$currency['iso_code']) AND !Configuration::get('HIPAY_CATEGORY_'.$currency['iso_code']))
 			OR (Configuration::get('HIPAY_SITEID_TEST_'.$currency['iso_code']) AND !Configuration::get('HIPAY_CATEGORY_TEST_'.$currency['iso_code'])))
 				$categories = false;
 		}
-		
+
 		if (!$allow_url_fopen OR !$openssl OR !$curl OR !$ping OR !$categories OR !$categoryRetrieval OR !$online)
 		{
 			echo '
@@ -416,7 +416,7 @@ class Hipay extends PaymentModule
 			</div>';
 		}
 
-		$link = AdminTab::$currentIndex.'&configure='.$this->name.'&token='.Tools::getValue('token');
+		$link = AdminTab::$currentIndex.'&configure='.$this->name.'&token='.Tools::safeOutput(Tools::getValue('token'));
 		$form = '
 		<style>
 			.hipay_label {float:none;font-weight:normal;padding:0;text-align:left;width:100%;line-height:30px}
@@ -453,16 +453,16 @@ class Hipay extends PaymentModule
 				<td class="tab2">'.$this->l('Activate the Hipay solution in your Prestashop, it\'s free!').'</td>
 			</tr>
 			<tr>
-				<td><img src="../modules/'.$this->name.'/3.png" alt="step 3" /></td> 
+				<td><img src="../modules/'.$this->name.'/3.png" alt="step 3" /></td>
-				<td class="tab2">'.$this->l('Enjoy preferred pricing on transactions via Prestashop by').' 
+				<td class="tab2">'.$this->l('Enjoy preferred pricing on transactions via Prestashop by').'
 				<a style="color:blue; text-decoration:underline;" href="mailto:commercial@hipay.com">'
 				.$this->l('contacting our sales department').'</a></td>
 			</tr>
-		</table>	
+		</table>
 		<form action="'.$link.'" method="post">
 		<table id="hipay_table" cellspacing="0" cellpadding="0">
 			<tr>
-				<td style="">&nbsp;</td>	
+				<td style="">&nbsp;</td>
 				<td style="height:40px;">Compte Hipay</td>
 			</tr>';
 
@@ -472,11 +472,11 @@ class Hipay extends PaymentModule
 						<td class="hipay_block"><b>'.$this->l('Configuration in').' '.$currency['name'].' '.$currency['sign'].'</b></td>
 						<td class="hipay_prod hipay_block" style="padding-left:10px">
 							<label class="hipay_label" for="HIPAY_ACCOUNT_'.$currency['iso_code'].'">'.$this->l('Account number').' <a href="../modules/'.$this->name.'/screenshots/accountnumber.png" target="_blank"><img src="../modules/'.$this->name.'/help.png" class="hipay_help" /></a></label><br />
-							<input type="text" id="HIPAY_ACCOUNT_'.$currency['iso_code'].'" name="HIPAY_ACCOUNT_'.$currency['iso_code'].'" value="'.Tools::getValue('HIPAY_ACCOUNT_'.$currency['iso_code'], Configuration::get('HIPAY_ACCOUNT_'.$currency['iso_code'])).'" /><br />
+							<input type="text" id="HIPAY_ACCOUNT_'.$currency['iso_code'].'" name="HIPAY_ACCOUNT_'.$currency['iso_code'].'" value="'.Tools::safeOutput(Tools::getValue('HIPAY_ACCOUNT_'.$currency['iso_code'], Configuration::get('HIPAY_ACCOUNT_'.$currency['iso_code']))).'" /><br />
 							<label class="hipay_label" for="HIPAY_PASSWORD_'.$currency['iso_code'].'">'.$this->l('Merchant password').' <a href="../modules/'.$this->name.'/screenshots/merchantpassword.png" target="_blank"><img src="../modules/'.$this->name.'/help.png" class="hipay_help" /></a></label><br />
-							<input type="text" id="HIPAY_PASSWORD_'.$currency['iso_code'].'" name="HIPAY_PASSWORD_'.$currency['iso_code'].'" value="'.Tools::getValue('HIPAY_PASSWORD_'.$currency['iso_code'], Configuration::get('HIPAY_PASSWORD_'.$currency['iso_code'])).'" /><br />
+							<input type="text" id="HIPAY_PASSWORD_'.$currency['iso_code'].'" name="HIPAY_PASSWORD_'.$currency['iso_code'].'" value="'.Tools::safeOutput(Tools::getValue('HIPAY_PASSWORD_'.$currency['iso_code'], Configuration::get('HIPAY_PASSWORD_'.$currency['iso_code']))).'" /><br />
 							<label class="hipay_label" for="HIPAY_SITEID_'.$currency['iso_code'].'">'.$this->l('Site ID').' <a href="../modules/'.$this->name.'/screenshots/siteid.png" target="_blank"><img src="../modules/'.$this->name.'/help.png" class="hipay_help" /></a></label><br />
-							<input type="text" id="HIPAY_SITEID_'.$currency['iso_code'].'" name="HIPAY_SITEID_'.$currency['iso_code'].'" value="'.Tools::getValue('HIPAY_SITEID_'.$currency['iso_code'], Configuration::get('HIPAY_SITEID_'.$currency['iso_code'])).'" /><br />';
+							<input type="text" id="HIPAY_SITEID_'.$currency['iso_code'].'" name="HIPAY_SITEID_'.$currency['iso_code'].'" value="'.Tools::safeOutput(Tools::getValue('HIPAY_SITEID_'.$currency['iso_code'], Configuration::get('HIPAY_SITEID_'.$currency['iso_code']))).'" /><br />';
 			if ($ping AND $hipaySiteId = (int)Configuration::get('HIPAY_SITEID_'.$currency['iso_code']) AND $hipayAccountId = (int)Configuration::get('HIPAY_ACCOUNT_'.$currency['iso_code']))
 			{
 				$form .= '	<label for="HIPAY_CATEGORY_'.$currency['iso_code'].'" class="hipay_label">'.$this->l('Category').'</label><br />
@@ -499,7 +499,7 @@ class Hipay extends PaymentModule
 					<tr><td class="hipay_end">&nbsp;</td><td class="hipay_prod hipay_end">&nbsp;</td>';
 			$form .= '</tr>';
 		}
-		
+
 		$form .= '</table>
 				<hr class="clear" />
 				<label for="HIPAY_RATING">'.$this->l('Authorized age group').'</label>
@@ -518,12 +518,12 @@ class Hipay extends PaymentModule
 		</fieldset>
 		<br />
 		';
-		
+
 		$form .= '
 		<fieldset>
 			<legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->l('Zones restrictions').'</legend>
 			'.$this->l('Select the authorized shipping zones').'<br /><br />
-			<form action="'.AdminTab::$currentIndex.'&configure=hipay&token='.Tools::getValue('token').'" method="post">
+			<form action="'.AdminTab::$currentIndex.'&configure=hipay&token='.Tools::safeOutput(Tools::getValue('token')).'" method="post">
 				<table cellspacing="0" cellpadding="0" class="table">
 					<tr>
 						<th class="center">'.$this->l('ID').'</th>
@@ -531,7 +531,7 @@ class Hipay extends PaymentModule
 						<th align="center"><img src="../modules/'.$this->name.'/logo.gif" /></th>
 					</tr>
 		';
-		
+
 		$result = Db::getInstance()->ExecuteS('
 			SELECT `id_zone`, `name`
 			FROM '._DB_PREFIX_.'zone
@@ -546,12 +546,12 @@ class Hipay extends PaymentModule
 			$chk = null;
 			if (Configuration::get('HIPAY_AZ_'.$rowValues['id_zone']) == 'ok')
 				$chk = "checked ";
-			
+
 			$form .= '<td align="center"><input type="checkbox" name="HIPAY_AZ_'.$rowValues['id_zone'].'" value="ok" '.$chk.'/>';
 			$form .= '<input type="hidden" name="HIPAY_AZ_ALL_'.$rowValues['id_zone'].'" value="ok" /></td>';
 			$form .= '</tr>';
 		}
-		
+
 		$form .= '
 				</table><br>
 				<input type="submit" name="submitHipayAZ" value="'.$this->l('Update zones').'" class="button" />
@@ -609,24 +609,24 @@ class Hipay extends PaymentModule
 		}
 		return $this->arrayCategories;
 	}
-	
+
 	// Retro compatibility with 1.2.5
 	static private function MysqlGetValue($query)
 	{
 		$row = Db::getInstance()->getRow($query);
 		return array_shift($row);
 	}
-	
+
 	// Retro compatibility with 1.2.5
 	static private function getHttpHost($http = false, $entities = false)
 	{
 		$host = (isset($_SERVER['HTTP_X_FORWARDED_HOST']) ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST']);
-		
+
 		if ($entities)
-			$host = htmlspecialchars($host, ENT_COMPAT, 'UTF-8');		
+			$host = htmlspecialchars($host, ENT_COMPAT, 'UTF-8');
 		if ($http)
 			$host = (Configuration::get('PS_SSL_ENABLED') ? 'https://' : 'http://').$host;
-			
+
 		return $host;
 	}
 }

modules/homefeatured/homefeatured.php

@@ -75,12 +75,12 @@ class HomeFeatured extends Module
 	public function displayForm()
 	{
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<p>'.$this->l('In order to add products to your homepage, just add them to the "home" category.').'</p><br />
 				<label>'.$this->l('Number of products displayed').'</label>
 				<div class="margin-form">
-					<input type="text" size="5" name="nbr" value="'.Tools::getValue('nbr', (int)(Configuration::get('HOME_FEATURED_NBR'))).'" />
+					<input type="text" size="5" name="nbr" value="'.Tools::safeOutput(Tools::getValue('nbr', (int)(Configuration::get('HOME_FEATURED_NBR')))).'" />
 					<p class="clear">'.$this->l('The number of products displayed on homepage (default: 10).').'</p>
 
 				</div>

modules/iadvize/iadvize.php

@@ -85,7 +85,7 @@ class iAdvize extends Module
 				<br />
 				<a href="http://www.iadvize.com/offre_prestashop.html" target="_blank">'.$this->l('For more information, click here').'</a>
 			</p>
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 				<fieldset class="width2">
 					<legend><img src="../img/admin/cog.gif" alt="" class="middle" />'.$this->l('Settings').'</legend>
 					<label>'.$this->l('iAdvize merchant ID:').'</label>

modules/importerosc/importerosc.php

@@ -61,8 +61,8 @@ class importerosc extends ImportModule
 
 	public function displaySpecificOptions()
 	{
-		$langagues = $this->ExecuteS('SELECT * FROM  `'.addslashes($this->prefix).'languages`');
+		$langagues = $this->ExecuteS('SELECT * FROM  `'.bqSQL($this->prefix).'languages`');
-		$curencies = $this->ExecuteS('SELECT * FROM  `'.addslashes($this->prefix).'currencies`');
+		$curencies = $this->ExecuteS('SELECT * FROM  `'.bqSQL($this->prefix).'currencies`');
 
 		$html = '<label style=\'width:220px\'>'.$this->l('Default osCommerce language  : ').'</label>
 				<div class="margin-form">
@@ -115,7 +115,7 @@ class importerosc extends ImportModule
 	public function getLangagues($limit = 0, $nrb_import = 100)
 	{
 		$identifier = 'id_lang';
-		$langagues = $this->ExecuteS('SELECT languages_id as id_lang, name as name, code as iso_code, 1 as active FROM  `'.addslashes($this->prefix).'languages` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+		$langagues = $this->ExecuteS('SELECT languages_id as id_lang, name as name, code as iso_code, 1 as active FROM  `'.bqSQL($this->prefix).'languages` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($langagues, $identifier);
 	}
 
@@ -125,7 +125,7 @@ class importerosc extends ImportModule
 		$currencies = $this->ExecuteS('
 									SELECT currencies_id as id_currency, title as name, code as iso_code, 0 as format, 999 as iso_code_num, 1 as decimals,
 									CONCAT(`symbol_left`, `symbol_right`) as sign, value as conversion_rate
-									FROM  `'.addslashes($this->prefix).'currencies` LIMIT '.(int)($limit).' , '.(int)$nrb_import
+									FROM  `'.bqSQL($this->prefix).'currencies` LIMIT '.(int)($limit).' , '.(int)$nrb_import
 									);
 		return $this->autoFormat($currencies, $identifier);
 	}
@@ -133,7 +133,7 @@ class importerosc extends ImportModule
 	public function getZones($limit = 0, $nrb_import = 100)
 	{
 		$identifier = 'id_zone';
-		$zones = $this->ExecuteS('SELECT geo_zone_id as id_zone, geo_zone_name as name, 1 as active FROM  `'.addslashes($this->prefix).'geo_zones` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+		$zones = $this->ExecuteS('SELECT geo_zone_id as id_zone, geo_zone_name as name, 1 as active FROM  `'.bqSQL($this->prefix).'geo_zones` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($zones, $identifier);
 	}
 
@@ -144,9 +144,9 @@ class importerosc extends ImportModule
 		$identifier = 'id_country';
 		$defaultIdLang = $this->getDefaultIdLang();
 		$countries = $this->ExecuteS('
-										SELECT countries_id as id_country, countries_name as name, countries_iso_code_2 as iso_code, '.$defaultIdLang.' as id_lang,
+										SELECT countries_id as id_country, countries_name as name, countries_iso_code_2 as iso_code, `'.bqSQL($defaultIdLang).'̀  as id_lang,
 										1 as id_zone, 0 as id_currency, 1 as contains_states, 1 as need_identification_number, 1 as active, 1 as display_tax_label
-										FROM  `'.addslashes($this->prefix).'countries` as c  LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+										FROM  `'.bqSQL($this->prefix).'countries` as c  LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($countries, $identifier, $keyLanguage, $multiLangFields);
 	}
 
@@ -186,8 +186,8 @@ class importerosc extends ImportModule
 									IFNULL( STRCMP(c.`customers_newsletter`, \'\') , 0 ) as newsletter, c.`customers_lastname` as lastname,
 									DATE(c.`customers_dob`) as birthday, c.`customers_email_address` as email, c.`customers_password` as passwd, 1 as active,
 									ci.`customers_info_date_account_created` as date_add
-									FROM  `'.addslashes($this->prefix).'customers` c
+									FROM  `'.bqSQL($this->prefix).'customers` c
-									LEFT JOIN `'.addslashes($this->prefix).'customers_info` ci  ON (c.`customers_id` = ci.`customers_info_id`)
+									LEFT JOIN `'.bqSQL($this->prefix).'customers_info` ci  ON (c.`customers_id` = ci.`customers_info_id`)
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import
 									);
 
@@ -206,7 +206,7 @@ class importerosc extends ImportModule
 		$addresses = $this->ExecuteS('
 									SELECT address_book_id as id_address, customers_id as id_customer, CONCAT(customers_id, \'_address\') as alias, entry_company as company, entry_firstname as firstname,
 									entry_lastname as lastname, entry_street_address as address1, entry_postcode as postcode, entry_city as city, entry_country_id as id_country, 0 as id_state
-									FROM  `'.addslashes($this->prefix).'address_book` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+									FROM  `'.bqSQL($this->prefix).'address_book` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($addresses, $identifier);
 	}
 
@@ -218,8 +218,8 @@ class importerosc extends ImportModule
 
 		$categories = $this->ExecuteS('
 									SELECT c.categories_id as id_category, c.parent_id as id_parent, 0 as level_depth, cd.language_id as id_lang, cd.categories_name as name , 1 as active, categories_image as images
-									FROM `'.addslashes($this->prefix).'categories` c
+									FROM `'.bqSQL($this->prefix).'categories` c 
-									LEFT JOIN `'.addslashes($this->prefix).'categories_description` cd ON (c.categories_id = cd.categories_id)
+									LEFT JOIN `'.bqSQL($this->prefix).'categories_description` cd ON (c.categories_id = cd.categories_id)
 									WHERE cd.categories_name IS NOT NULL AND cd.language_id IS NOT NULL
 									ORDER BY c.categories_id, cd.language_id
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import);
@@ -238,7 +238,7 @@ class importerosc extends ImportModule
 		$identifier = 'id_attribute_group';
 		$countries = $this->ExecuteS('
 									SELECT products_options_id as id_attribute_group, products_options_name as name , products_options_name as public_name, language_id as id_lang, 0 as is_color_group
-									FROM  `'.addslashes($this->prefix).'products_options`
+									FROM  `'.bqSQL($this->prefix).'products_options` 
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($countries, $identifier, $keyLanguage, $multiLangFields);
 	}
@@ -250,8 +250,8 @@ class importerosc extends ImportModule
 		$identifier = 'id_attribute';
 		$countries = $this->ExecuteS('
 									SELECT p.`products_options_values_id` as id_attribute, p.`products_options_values_name` as name, p.`language_id` as id_lang , po.`products_options_id` as id_attribute_group
-									FROM  `'.addslashes($this->prefix).'products_options_values` p
+									FROM  `'.bqSQL($this->prefix).'products_options_values` p
-									LEFT JOIN `'.addslashes($this->prefix).'products_options_values_to_products_options` po ON (po.products_options_values_id = p.products_options_values_id)
+									LEFT JOIN `'.bqSQL($this->prefix).'products_options_values_to_products_options` po ON (po.products_options_values_id = p.products_options_values_id)
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		return $this->autoFormat($countries, $identifier, $keyLanguage, $multiLangFields);
 	}
@@ -264,11 +264,11 @@ class importerosc extends ImportModule
 		$products = $this->ExecuteS('
 									SELECT p.`products_id` as id_product, p.`products_quantity` as quantity, p.`products_model` as reference, p.`products_price` as price, p.`products_weight` as weight,
 									IFNULL(STRCMP(p.`products_status`, \'\') , 0 ) as active, p.`manufacturers_id` as id_manufacturer, pd.language_id as id_lang, pd.products_name as name,
-									pd.products_description as description, CONCAT(\''.Tools::getProtocol().Tools::getValue('shop_url').'\/images/\',p.`products_image`) as images,
+									pd.products_description as description, CONCAT(\''.pSQL(Tools::getProtocol()).pSQL(Tools::getValue('shop_url')).'\/images/\',p.`products_image`) as images,
-									(SELECT ptc.categories_id FROM `'.addslashes($this->prefix).'products_to_categories` ptc WHERE ptc.`products_id` = p.`products_id` LIMIT 1) as id_category_default,
+									(SELECT ptc.categories_id FROM `'.bqSQL($this->prefix).'products_to_categories` ptc WHERE ptc.`products_id` = p.`products_id` LIMIT 1) as id_category_default,
 									p.`products_date_added` as date_add
-									FROM	`'.addslashes($this->prefix).'products` p
+									FROM	`'.bqSQL($this->prefix).'products` p 
-									LEFT JOIN `'.addslashes($this->prefix).'products_description` pd ON (p.products_id = pd.products_id)
+									LEFT JOIN `'.bqSQL($this->prefix).'products_description` pd ON (p.products_id = pd.products_id)
 									WHERE pd.products_name IS NOT NULL AND pd.language_id IS NOT NULL
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 
@@ -283,7 +283,7 @@ class importerosc extends ImportModule
 						)');
 		foreach($products as& $product)
 		{
-			$result = $this->ExecuteS('SELECT `image` FROM `'.addslashes($this->prefix).'products_images` WHERE products_id = '.(int)$product['id_product']);
+			$result = $this->ExecuteS('SELECT `image` FROM `'.bqSQL($this->prefix).'products_images` WHERE products_id = '.(int)$product['id_product']);
 			$images = array();
 			foreach($result as $res)
 				$images[] = Tools::getProtocol().Tools::getValue('shop_url').'/images/'.$res['image'];
@@ -299,7 +299,7 @@ class importerosc extends ImportModule
 		$identifier = 'id_product_attribute';
 		$combinations = $this->ExecuteS('
 										SELECT products_attributes_id as id_product_attribute, products_id as id_product, options_values_price as price, options_values_id
-										FROM  `'.addslashes($this->prefix).'products_attributes` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+										FROM  `'.bqSQL($this->prefix).'products_attributes` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		foreach($combinations as& $combination)
 		{
 			$combination['association'] = array('product_attribute_combination' => array($combination['options_values_id'] => $combination['id_product_attribute']));
@@ -313,7 +313,7 @@ class importerosc extends ImportModule
 		$identifier = 'id_manufacturer';
 		$manufacturers = $this->ExecuteS('
 										SELECT manufacturers_id as id_manufacturer, manufacturers_name as name, 1 as active, manufacturers_image as images
-										FROM  `'.addslashes($this->prefix).'manufacturers` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+										FROM  `'.bqSQL($this->prefix).'manufacturers` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		foreach($manufacturers as& $manufacturer)
 			$manufacturer['images'] = array(Tools::getProtocol().Tools::getValue('shop_url').'/images/'.$manufacturer['images']);
 
@@ -327,7 +327,7 @@ class importerosc extends ImportModule
 		$identifier = 'id_order_state';
 		$ordersStates = $this->ExecuteS('
 									SELECT `orders_status_id` as id_order_state, `language_id` as id_lang, `orders_status_name` as name , 1 as hidden
-									FROM  `'.addslashes($this->prefix).'orders_status`
+									FROM  `'.bqSQL($this->prefix).'orders_status`
 									LIMIT '.(int)($limit).' , '.(int)$nrb_import);//IF(`public_flag` = 0, 1, 0) as hidden
 		return $this->autoFormat($ordersStates, $identifier, $keyLanguage, $multiLangFields);
 	}
@@ -335,7 +335,7 @@ class importerosc extends ImportModule
 	public function getOrders($limit = 0, $nrb_import = 100)
 	{
 		$orders = array();
-		$addresses = $this->ExecuteS('SELECT customers_id as id_customer, address_book_id as id_address FROM  `'.addslashes($this->prefix).'address_book` GROUP BY customers_id');
+		$addresses = $this->ExecuteS('SELECT customers_id as id_customer, address_book_id as id_address FROM  `'.bqSQL($this->prefix).'address_book` GROUP BY customers_id');
 		$matchAddresses = array();
 		foreach($addresses as $address)
 			$matchAddresses[$address['id_customer']] = $address['id_address'];
@@ -351,30 +351,30 @@ class importerosc extends ImportModule
 		$orders = $this->ExecuteS('
 								SELECT orders_id as id_cart, '.$psCarrierDefault.' as id_carrier, 1 as id_lang, currency as id_currency, customers_id as id_customer, payment_method as payment, 1 as valid,
 								date_purchased as date_add, last_modified as date_upd
-								FROM  `'.addslashes($this->prefix).'orders` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
+								FROM  `'.bqSQL($this->prefix).'orders` LIMIT '.(int)($limit).' , '.(int)$nrb_import);
 		foreach($orders as $key => $order)
 		{
 			$orders[$key]['id_currency'] = (array_key_exists($order['id_currency'], $psCurrency) ? $psCurrency[$order['id_currency']] : 0);
 			$orders[$key]['id_address_delivery'] = (array_key_exists($order['id_customer'], $matchAddresses) ?  $matchAddresses[$order['id_customer']] : 0);
 			$orders[$key]['id_address_invoice'] = (array_key_exists($order['id_customer'], $matchAddresses) ?  $matchAddresses[$order['id_customer']] : 0);
-			$orders[$key]['total_paid'] = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_total\'');
+			$orders[$key]['total_paid'] = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_total\'');
-			$orders[$key]['total_paid_real'] = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_total\'');
+			$orders[$key]['total_paid_real'] = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_total\'');
-			$orders[$key]['total_products'] = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_shipping\'');
+			$orders[$key]['total_products'] = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_shipping\'');
-			$tax = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_tax\'');
+			$tax = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_tax\'');
-			$orders[$key]['total_products_wt'] = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_total\'') - $tax;
+			$orders[$key]['total_products_wt'] = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_total\'') - $tax;
-			$orders[$key]['total_shipping'] = $this->getValue('SELECT value FROM `'.addslashes($this->prefix).'orders_total` WHERE `orders_id` = '.$order['id_cart'].' AND class=\'ot_shipping\'');
+			$orders[$key]['total_shipping'] = $this->getValue('SELECT value FROM `'.bqSQL($this->prefix).'orders_total` WHERE `orders_id` = '.(int)$order['id_cart'].' AND class=\'ot_shipping\'');
 			$orders[$key]['total_discounts'] = 0;
 			$orders[$key]['total_wrapping'] = 0;
 			$orders[$key]['cart_products'] = $this->ExecuteS('
 														SELECT `orders_id` as id_cart, `products_id` as id_product, 0 as id_product_attribute, `products_quantity` as quantity
-														FROM  `'.addslashes($this->prefix).'orders_products` WHERE `orders_id` = '.$order['id_cart']);
+														FROM  `'.bqSQL($this->prefix).'orders_products` WHERE `orders_id` = '.(int)$order['id_cart']);
 			$orders[$key]['order_products'] = $this->ExecuteS('
 														SELECT `orders_id` as id_order, `products_id` as product_id, 0 as product_attribute_id, `products_name` as product_name, `products_quantity` as product_quantity,
 														`final_price` as product_price, 0 as product_weight
- 														FROM  `'.addslashes($this->prefix).'orders_products` WHERE `orders_id` = '.$order['id_cart']);
+ 														FROM  `'.bqSQL($this->prefix).'orders_products` WHERE `orders_id` = '.(int)$order['id_cart']);
 			$orders[$key]['order_history'] = $this->ExecuteS('
 														SELECT `orders_status_history_id` as id_order_history, 0 as id_employee, `orders_id` as id_order, `orders_status_id` as id_order_state, `date_added` as date_add
-														FROM  `'.addslashes($this->prefix).'orders_status_history` WHERE `orders_id` = '.$order['id_cart']);
+														FROM  `'.bqSQL($this->prefix).'orders_status_history` WHERE `orders_id` = '.(int)$order['id_cart']);
 
 		}
 		return $orders;
@@ -413,7 +413,7 @@ class importerosc extends ImportModule
 				$ps_passwd =  md5(pSQL(_COOKIE_KEY_.$passwd));
 				Db::getInstance()->Execute('
 				UPDATE `'._DB_PREFIX_.'customer`
-				SET `passwd` = \''.pSQL($ps_passwd).'\', passwd_'.pSQL($this->name).' = \'\'
+				SET `passwd` = \''.pSQL($ps_passwd).'\', `passwd_'.bqSQL($this->name).'` = \'\'
 				WHERE `'._DB_PREFIX_.'customer`.`id_customer` ='.(int)$result['id_customer'].' LIMIT 1');
 			}
 		}

modules/loyalty/loyalty.php

@@ -258,7 +258,7 @@ class Loyalty extends Module
 			id_language = Number('.$defaultLanguage.');
 		</script>
 		<h2>'.$this->l('Loyalty Program').'</h2>
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>
 				<legend>'.$this->l('Settings').'</legend>
 				

modules/mondialrelay/AdminMondialRelay.php

@@ -68,7 +68,7 @@ class AdminMondialRelay extends AdminTab
 			$html.= '<h3 style="color:red;">' . $this->l('No orders with this state.') . '</h3>';
 		else
 		{
-			$html.= '<form method="post" action="'.$_SERVER['REQUEST_URI'].'">';
+			$html.= '<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">';
 			$html.= "\n<table class=\"table\" id='orders'>";
 			$html.= '<tr>';
 			$html.= '<th>'.$this->l('Order ID').'</th>';
@@ -152,7 +152,7 @@ class AdminMondialRelay extends AdminTab
 			<fieldset>
 				<legend>' . $this->l('History of labels creation') . '</legend>
 				<div style="overflow-x: auto;overflow-y: scroller; height: 300px; padding-top: 0.6em;" >
-					<form method="post" action="'.$_SERVER['REQUEST_URI'].'">
+					<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 						<table class="table" id="PS_MRHistoriqueTableList">
 							<tbody>
 								<tr>

modules/mondialrelay/classes/MRCreateTickets.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -228,7 +228,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 						'required'				=> false,
 						'value'						=> '',
 						'regexValidation' => '#^([^<>&\']{3,30})(\(cr\)[^<>&\']{0,30}){0,9}$#')));
-	
+
 	private $_orderListId = NULL;
 	private $_totalOrder = 0;
 	private $_weightList = NULL;
@@ -236,14 +236,14 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	private $_fieldsList = array();
 	private $_webServiceKey =	'';
 	private $_markCode = '';
-	
+
 	private $_resultList = array(
 		'error' => array(),
 		'success' => array());
-	
+
 	private $_webserviceURL = 'http://www.mondialrelay.fr/webservice/Web_Services.asmx?WSDL';
-	
+
-	public function __construct($params)	
+	public function __construct($params)
 	{
 		$this->_orderListId = $params['orderIdList'];
 		$this->_totalOrder = $params['totalOrder'];
@@ -251,12 +251,12 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		$this->_webServiceKey = Configuration::get('MR_KEY_WEBSERVICE');
 		$this->_markCode = Configuration::get('MR_CODE_MARQUE');
 	}
-	
+
 	public function __destruct()
 	{
 		 unset($this->_mondialRelay);
 	}
-	
+
 	/*
 	 * Build a correct weight format (NNNNN)
 	 */
@@ -266,13 +266,13 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$weight = '0'.$weight;
 		return $weight;
 	}
-	
+
 	/*
 	 * Set the default value to the order paramaters
 	 */
 	private function _setRequestDefaultValue()
 	{
-		
+
 		$this->_fields['list']['Enseigne']['value'] = Configuration::get('MR_ENSEIGNE_WEBSERVICE');
 		$this->_fields['list']['Expe_Langage']['value'] = Configuration::get('MR_LANGUAGE');
 		$this->_fields['list']['Expe_Ad1']['value'] = Configuration::get('PS_MR_SHOP_NAME');
@@ -282,19 +282,19 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		$this->_fields['list']['Expe_Ville']['value'] = Configuration::get('PS_SHOP_CITY');
 		$this->_fields['list']['Expe_CP']['value'] = Configuration::get('PS_SHOP_CODE');
 		$this->_fields['list']['Expe_CP']['params']['id_country'] = Configuration::get('PS_COUNTRY_DEFAULT');
-		
+
 		if (_PS_VERSION_ >= '1.4')
 		$this->_fields['list']['Expe_Pays']['value'] = Country::getIsoById(Configuration::get('PS_SHOP_COUNTRY_ID'));
 		else
 			$this->_fields['list']['Expe_Pays']['value'] = substr(Configuration::get('PS_SHOP_COUNTRY'), 0, 2);
-			
+
 		$this->_fields['list']['Expe_Tel1']['value'] = str_replace(array('.', ' ', '-'), '', Configuration::get('PS_SHOP_PHONE'));
 		$this->_fields['list']['Expe_Mail']['value'] = Configuration::get('PS_SHOP_EMAIL');
 		$this->_fields['list']['NbColis']['value'] = 1;
 		$this->_fields['list']['CRT_Valeur']['value'] = 0;
 		$this->_fields['list']['CRT_Devise']['value'] = 'EUR';
 	}
-	
+
 	/*
 	 * Initiate the data needed to be send properly
 	 * Can manage a list of data for multiple request
@@ -302,10 +302,10 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	public function init()
 	{
 		$this->_mondialRelay = new MondialRelay();
-		
+
 		if ($this->_totalOrder == 0)
 			throw new Exception($this->_mondialRelay->l('Please select at least one order'));
-		
+
 		$this->_setRequestDefaultValue();
 		if (count($orderListDetails = $this->_mondialRelay->getOrders($this->_orderListId)))
 		{
@@ -314,10 +314,10 @@ class MRCreateTickets implements IMondialRelayWSMethod
 				// Storage temporary
 				$base = $this->_fields;
 				$tmp = &$base['list'];
-				
+
 				$deliveriesAddress = new Address($orderDetail['id_address_delivery']);
 				$customer = new Customer($orderDetail['id_customer']);
-				
+
 				// Store the weight order set by the user
 				foreach($this->_weightList as $orderWeightInfos)
 				{
@@ -325,7 +325,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 					if (count($detail) == 2 && $detail[1] == $orderDetail['id_order'])
 						$tmp['Poids']['value'] = $this->_weightFormat($detail[0]);
 				}
-				
+
 				$destIsoCode = Country::getIsoById($deliveriesAddress->id_country);
 				$tmp['ModeCol']['value'] = $orderDetail['mr_ModeCol'];
 				$tmp['ModeLiv']['value'] = $orderDetail['mr_ModeLiv'];
@@ -343,16 +343,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 				$tmp['Dest_Tel2']['value'] = $deliveriesAddress->phone_mobile;
 				$tmp['Dest_Mail']['value'] = $customer->email;
 				$tmp['Assurance']['value'] = $orderDetail['mr_ModeAss'];
-				
+
 				if ($orderDetail['MR_Selected_Num'] != 'LD1' && $orderDetail['MR_Selected_Num'] != 'LDS')
 				{
 					$tmp['LIV_Rel_Pays']['value'] = $orderDetail['MR_Selected_Pays'];
 					$tmp['LIV_Rel']['value'] = $orderDetail['MR_Selected_Num'];
 				}
-				
+
 				// Store the necessary information to the root case table
 				$base['id_mr_selected'] = $orderDetail['id_mr_selected'];
-				
+
 				// Add the temporary values to a field list for multiple request
 				$this->_fieldsList[] = $base;
 				unset($deliveriesAddress);
@@ -361,7 +361,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$this->_generateMD5SecurityKey();
 		}
 	}
-	
+
 	/*
 	 * Generate the MD5 key for each param list
 	 */
@@ -379,24 +379,24 @@ class MRCreateTickets implements IMondialRelayWSMethod
 					// TODO : test on windows and linux server
 					$cleanedString = MRTools::replaceAccentedCharacters($valueDetailed['value']);
 					$valueDetailed['value'] = !empty($cleanedString) ? strtoupper($cleanedString) : strtoupper($valueDetailed['value']);
-					
+
 					// Call a pointer function if exist to do different test
 					if (isset($valueDetailed['methodValidation']) &&
-							method_exists('MRTools', $valueDetailed['methodValidation']) && 
+							method_exists('MRTools', $valueDetailed['methodValidation']) &&
-							isset($valueDetailed['params']) && 
+							isset($valueDetailed['params']) &&
 							MRTools::$valueDetailed['methodValidation']($valueDetailed['value'], $valueDetailed['params']))
 						$concatenationValue .= $valueDetailed['value'];
 					// Use simple Regex test given by MondialRelay
 					else if (isset($valueDetailed['regexValidation']) &&
 							preg_match($valueDetailed['regexValidation'], $valueDetailed['value'], $matches))
 						$concatenationValue .= $valueDetailed['value'];
-					// If the key is required, we set an error, else it's skipped 
+					// If the key is required, we set an error, else it's skipped
 					else if ((!strlen($valueDetailed['value']) && $valueDetailed['required']) || strlen($valueDetailed['value']))
 					{
 						if (empty($valueDetailed['value']))
 							$error = $this->_mondialRelay->l('This key').' ['.$paramName.'] '.$this->_mondialRelay->l('is empty and need to be filled');
 						else
-							$error = 'This key ['.$paramName.'] hasn\'t a valid value format : '.$valueDetailed['value']; 
+							$error = 'This key ['.$paramName.'] hasn\'t a valid value format : '.$valueDetailed['value'];
 						$this->_resultList['error'][$rootCase['list']['NDossier']['value']][] = $error;
 					}
 				}
@@ -404,7 +404,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$rootCase['list']['Security']['value'	] = strtoupper(md5($concatenationValue));
 		}
 	}
-	
+
 	/*
 	 * Update the tables used and send mail with the order history
 	 */
@@ -412,34 +412,34 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		Db::getInstance()->Execute('
 			UPDATE `'._DB_PREFIX_.'mr_selected`
-			SET `MR_poids` = \''.$params['Poids'].'\',
+			SET `MR_poids` = \''.pSQL($params['Poids']).'\',
-					`exp_number` = \''.$expeditionNum.'\',
+					`exp_number` = \''.pSQL($expeditionNum).'\',
-					`url_etiquette` = \''.$ticketURL.'\',
+					`url_etiquette` = \''.pSQL($ticketURL).'\',
-					`url_suivi` = \''.$trackingURL.'\'
+					`url_suivi` = \''.pSQL($trackingURL).'\'
 			WHERE id_mr_selected = '.(int)$id_mr_selected);
-		
+
 		// NDossier contains the id_order
 		$order = new Order($params['NDossier']);
-	  
+
 	 	// Update the database for order and orderHistory
 		$order->shipping_number = $id_mr_selected;
 		$order->update();
-		
+
 		$templateVars = array('{followup}' => $trackingURL);
-		$orderState = (Configuration::get('PS_OS_SHIPPING')) ? 
+		$orderState = (Configuration::get('PS_OS_SHIPPING')) ?
-			Configuration::get('PS_OS_SHIPPING') : 
+			Configuration::get('PS_OS_SHIPPING') :
 			_PS_OS_SHIPPING_;
-					
+
 		$history = new OrderHistory();
-		$history->id_order = (int)($params['NDossier']);
+		$history->id_order = (int)$params['NDossier'];
-		$history->changeIdOrderState($orderState, (int)($params['NDossier'])); 
+		$history->changeIdOrderState($orderState, (int)$params['NDossier']);
 		$history->id_employee = (int)Context::getContext()->employee->id;
 		$history->addWithemail(true, $templateVars);
 
 		unset($order);
 		unset($history);
 	}
-	
+
 	/*
 	 * Manage the return value of the webservice, handle the errors or build the
 	 * succeed message
@@ -448,11 +448,11 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		$errors = &$this->_resultList['error'][$params['NDossier']];
 		$success = &$this->_resultList['success'][$params['NDossier']];
-		
+
 		if ($client->fault)
 			$errors[] = $this->_mondialRelay->l('It seems the request isn\'t valid:').
 				$result;
-				
+
 		$result = $result['WSI2_CreationEtiquetteResult'];
 		if (($errorNumber = $result['STAT']) != 0)
 		{
@@ -470,16 +470,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 			$trackingURL = $baseURL.
 				'lg_fr/espaces/url/popup_exp_details.aspx?cmrq='.$params['Enseigne'].
 				$this->_markCode.'&nexp='.$expedition.'&crc='.$securityKey;
-				
+
 			$success['displayExpedition'] = $this->_mondialRelay->l('Expedition Number : ') . $expedition;
 			$success['displayTicketURL'] = $this->_mondialRelay->l('Ticket URL : ') . $ticketURL;
 			$success['displayTrackingURL'] = $this->_mondialRelay->l('Tracking URL: ') . $trackingURL;
 			$success['expeditionNumber'] = $expedition;
-			
+
-			$this->_updateTable($params, $expedition, $ticketURL, $trackingURL, $id_mr_selected);	
+			$this->_updateTable($params, $expedition, $ticketURL, $trackingURL, $id_mr_selected);
 		}
 	}
-	
+
 	/*
 	 * Send one or multiple request to the webservice
 	 */
@@ -489,16 +489,16 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		{
 			$client->soap_defencoding = 'UTF-8';
 			$client->decode_utf8 = false;
-			
+
 			foreach($this->_fieldsList as $rootCase)
 			{
 				$params = $this->_getSimpleParamArray($rootCase['list']);
 				$result = $client->call(
-					'WSI2_CreationEtiquette', 
+					'WSI2_CreationEtiquette',
-					$params, 
+					$params,
-					'http://www.mondialrelay.fr/webservice/', 
+					'http://www.mondialrelay.fr/webservice/',
 					'http://www.mondialrelay.fr/webservice/WSI2_CreationEtiquette');
-				
+
 				$this->_parseResult($client, $result, $params, $rootCase['id_mr_selected']);
 			}
 			unset($client);
@@ -506,7 +506,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 		else
 			throw new Exception($this->_mondialRelay->l('The Mondial Relay webservice isn\'t currently reliable'));
 	}
-	
+
 	/*
 	 * Get the values with associated fields name
 	 * @fields : array containing multiple values information
@@ -514,12 +514,12 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	private function _getSimpleParamArray($fields)
 	{
 		$params = array();
-		
+
 		foreach($fields as $keyName => $valueDetailed)
 			$params[$keyName] = $valueDetailed['value'];
 		return $params;
 	}
-	
+
 	/*
 	 * Return the fields list
 	 */
@@ -527,7 +527,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		return $this->_fieldsList['list'];
 	}
-	
+
 	/*
 	 * Return the result of one or multiple sent requests
 	 */
@@ -535,7 +535,7 @@ class MRCreateTickets implements IMondialRelayWSMethod
 	{
 		return $this->_resultList;
 	}
-	
+
 	/*
 	 * Return which number order of the list is currently managed
 	 */

modules/mondialrelay/classes/MRGetRelayPoint.php

@@ -187,7 +187,7 @@ class MRGetRelayPoint implements IMondialRelayWSMethod
 			unset($result['STAT']);
 			
 			// Clean Content
-			foreach($result as &$relayPoint)
+			foreach($result as $num => $relayPoint)
 			{
 				$totalEmptyFields = 0;
 				foreach ($relayPoint as $key => &$value)
@@ -197,11 +197,10 @@ class MRGetRelayPoint implements IMondialRelayWSMethod
  						++$totalEmptyFields;
  				}
  				if ($totalEmptyFields == count($relayPoint))
- 				{
+ 					unset($result[$num]);
- 					$errors[] = $this->_mondialRelay->l('MondialRelay can\'t find any relay point near your address. Maybe your address isn\'t properly filled ?');
- 					break;
  				}
- 			}
+ 			if (!count($result))
+ 				$errors[] = $this->_mondialRelay->l('MondialRelay can\'t find any relay point near your address. Maybe your address isn\'t properly filled ?');
 			$success = $result;
 		}
 		$this->_resultList['error'] = $errors;

modules/mondialrelay/classes/MRGetTickets.php

@@ -142,7 +142,7 @@ class MRGetTickets implements IMondialRelayWSMethod
 	{
 		$query = '
 			SELECT id FROM `'._DB_PREFIX_.'mr_historique`
-			WHERE `order`=\''.$id_order.'\'';
+			WHERE `order`='.(int)$id_order;
 		
 		$row = Db::getInstance()->getRow($query);
 		if ($row)
@@ -151,9 +151,9 @@ class MRGetTickets implements IMondialRelayWSMethod
 				UPDATE `'._DB_PREFIX_.'mr_historique`
   			SET 
   				`exp` = \''.(int)$expeditionNumber.'\',
-  				`url_a4` = \''.(string)$URLA4.'\',
+  				`url_a4` = \''.pSQL((string)$URLA4).'\',
-  				`url_a5` = \''.(string)$URLA5.'\'
+  				`url_a5` = \''.pSQL((string)$URLA5).'\'
-  			WHERE `order` = \''.$id_order.'\'';
+  			WHERE `order` = '.(int)$id_order;
 		}
 		else
 		{
@@ -161,10 +161,10 @@ class MRGetTickets implements IMondialRelayWSMethod
 				INSERT INTO '._DB_PREFIX_.'mr_historique
 				(`order`, `exp`, `url_a4`, `url_a5`)
 				VALUES (
-					\''.(int)$id_order.'\',
+					'.(int)$id_order.',
-					\''.(int)$expeditionNumber.'\',
+					'.(int)$expeditionNumber.',
-					\''.(string)$URLA4.'\',
+					\''.pSQL((string)$URLA4).'\',
-					\''.(string)$URLA5.'\')';
+					\''.pSQL((string)$URLA5).'\')';
 		}
 		Db::getInstance()->Execute($query);
 		$success['id_mr_history'] = isset($row['id']) ? $row['id'] : Db::getInstance()->Insert_ID();

modules/mondialrelay/mondialrelay.js

@@ -372,9 +372,11 @@ function PS_MRBackupDatabase()
 */
 function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
 {
+	PS_MRSelectedRelayPoint['relayPointNum'] = relayPointNumber;
+	
 	// Ajax call to add the selection in the database (compatibility for 1.3)
 	// But keep this way to add a selection better that the hook
-	$.ajax({
+	MRjQuery.ajax({
 		type: 'POST',
     url: _PS_MR_MODULE_DIR_ + 'ajax.php',
     data: {'method' : 'addSelectedCarrierToDB',
@@ -384,6 +386,7 @@ function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
     	'mrtoken' : mrtoken},
     success: function(json)
     {
+			
     },
     error: function(xhr, ajaxOptions, thrownError)
     {
@@ -398,6 +401,7 @@ function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
 function PS_MRAddSelectedCarrierInDB(id_carrier)
 {
 	PS_MRHideLastRelayPointList();
+
 	// Make the request
 	$.ajax({
 		type: 'POST',
@@ -417,12 +421,23 @@ function PS_MRAddSelectedCarrierInDB(id_carrier)
 
 function PS_MRCarrierSelectedProcess(carrierSelected, id_carrier, MRLivraisonType)
 {
+	// Reset for any carrier changement
 	if (MRLivraisonType != 'LD1' &&	MRLivraisonType != 'LDS')
+	{
 		// Seek Relay point if it doesn't a home delivery mode
 		PS_MRGetRelayPoint(carrierSelected);
+		
+		// Will have relay points
+		PS_MRSelectedRelayPoint['relayPointNum'] = 0;
+	}
 	else
+	{
 		// Simply add the selected carrier to the db, relay information will be empty
 		PS_MRAddSelectedCarrierInDB(id_carrier);
+		
+		// Won't have any relay points
+		PS_MRSelectedRelayPoint['relayPointNum'] = -1;
+}
 }
 
 /*
@@ -433,6 +448,26 @@ function PS_MRHideLastRelayPointList()
 	$('.PS_MRSelectedCarrier').fadeOut('fast');
 }
 
+/*
+** Check if the user select a carrier and a relay point if exist
+*/
+function PS_MRCheckSelectedRelayPoint()
+{
+	var input;
+	
+	// Check if the input is linked to the module and look into
+	// a temporary variable if a relay point has been selected
+	if ((input = $('input[name=id_carrier]:checked')).length &&
+		PS_MRCarrierMethodList[input.val()] != undefined &&
+		PS_MRSelectedRelayPoint['relayPointNum'] == 0)
+	{
+		//$('#PS_MRSelectCarrierError').fadeIn('fast');
+		alert(PS_MRTranslationList['errorSelection']);
+		return false;
+	}		
+	return true;
+}
+
 /*
 ** Link the generated relay point to an handle click
 ** Allow to add the selected relay point in the database
@@ -535,7 +570,7 @@ function PS_MRFetchRelayPoint(carrierSelected)
 		</td></tr>');
 	
 	fetchingRelayPoint[carrier_id] = $('#PS_MRSelectedCarrier_' + carrier_id);
-	$.ajax(
+	MRjQuery.ajax(
 	{
 		type: 'POST',
 		url: _PS_MR_MODULE_DIR_ + 'ajax.php',
@@ -748,6 +783,10 @@ function PS_MRAddGMapMarker(id_carrier, relayPointNumber, contentBlockid)
 
 $(document).ready(function()
 {
+	$('#form').submit(function()
+	{
+		return PS_MRCheckSelectedRelayPoint();
+	});
 	$('#toggleStatusOrderList').click(function()
 	{
 		toggleOrderListSelection();

modules/mondialrelay/mondialrelay.php

@@ -59,7 +59,7 @@ class MondialRelay extends Module
 	{
 		$this->name		= 'mondialrelay';
 		$this->tab		= 'shipping_logistics';
-		$this->version	= '1.7';
+		$this->version	= '1.7.3';
 
 		parent::__construct();
 
@@ -394,13 +394,20 @@ class MondialRelay extends Module
 	** Override a jQuery version included by another one us.
 	** Allow a compatibility for Presta < 1.4
 	*/
-	public static function getJqueryCompatibility()
+	public static function getJqueryCompatibility($overloadCurrent = false)
 	{
+		if ($overloadCurrent)
 		return '
 			<script type="text/javascript">
-				jq13 = jQuery.noConflict(true); 
+					current = jQuery.noConflict(true); 
 			</script>
 			<script type="text/javascript" src="'.self::$moduleURL.'/jquery-1.4.4.min.js"></script>';
+
+		return '
+			<script type="text/javascript" src="'.self::$moduleURL.'/jquery-1.4.4.min.js"></script>
+			<script type="text/javascript">
+				MRjQuery = jQuery.noConflict(true); 
+			</script>';
 	}
 	
 	public function hookNewOrder($params)
@@ -422,7 +429,8 @@ class MondialRelay extends Module
 				var _PS_MR_MODULE_DIR_ = "'.self::$moduleURL.'";
 				var mrtoken = "'.self::$MRBackToken.'";
 			</script>
-			<script type="text/javascript" src="'.$jsFilePath.'"></script>';
+			<script type="text/javascript" src="'.$jsFilePath.'"></script>'.
+			self::getJqueryCompatibility(true);
 	}
 	
 	private function _postValidation()
@@ -625,7 +633,8 @@ class MondialRelay extends Module
 							'one_page_checkout' => (Configuration::get('PS_ORDER_PROCESS_TYPE') ? Configuration::get('PS_ORDER_PROCESS_TYPE') : 0),
 							'new_base_dir' => self::$moduleURL,
 			'MRToken' => self::$MRFrontToken,
-			'carriersextra' => $carriersList));
+			'carriersextra' => $carriersList,
+			'jQueryOverload' => self::getJqueryCompatibility()));
 			
 			return $this->display(__FILE__, 'mondialrelay.tpl');
 		}
@@ -768,7 +777,7 @@ class MondialRelay extends Module
 				Db::getInstance()->Execute('
 				INSERT INTO `' . _DB_PREFIX_ . 'carrier`
 				(`url`, `name`, `active`, `is_module`, `range_behavior`)
-				VALUES(NULL, "'.pSQL('mondialrelay').'", "1", "1", "1")');
+				VALUES(NULL, "'.pSQL('mondialrelay').'", "1", "0", "1")');
 
 			$get   = Db::getInstance()->getRow('SELECT * FROM `' . _DB_PREFIX_ . 'carrier` WHERE `id_carrier` = "' . Db::getInstance()->Insert_ID() . '"');
 			Db::getInstance()->Execute('UPDATE `' . _DB_PREFIX_ . 'mr_method` SET `id_carrier` = "' . (int)($get['id_carrier']) . '" WHERE `id_mr_method` = "' . pSQL($mainInsert) . '"');
@@ -806,7 +815,7 @@ class MondialRelay extends Module
 	{
 		$zones = Db::getInstance()->ExecuteS("SELECT * FROM " . _DB_PREFIX_ . "zone WHERE active = 1");
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post" >
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" >
 			<fieldset>
 				<legend><img src="../modules/mondialrelay/images/logo.gif" alt="" />'.$this->l('Add a Shipping Method').'</legend>
 				<ul>
@@ -815,7 +824,7 @@ class MondialRelay extends Module
 					</li>
 					<li>
 						<label for="mr_Name" class="shipLabel">'.$this->l('Carrier\'s name').'<sup>*</sup></label>
-						<input type="text" id="mr_Name" name="mr_Name" '.(Tools::getValue('mr_Name') ? 'value="'.Tools::getValue('mr_Name').'"' : '').'/>
+						<input type="text" id="mr_Name" name="mr_Name" '.(Tools::getValue('mr_Name') ? 'value="'.Tools::safeOutput(Tools::getValue('mr_Name')).'"' : '').'/>
 					</li>
 					<li>
 						<label for="mr_ModeCol" class="shipLabel">'.$this->l('Collection Mode').'<sup>*</sup></label>
@@ -878,7 +887,7 @@ class MondialRelay extends Module
 		WHERE c.`deleted` = 0');
 			
 		$output = '
-		<form action="' . $_SERVER['REQUEST_URI'] . '" method="post">
+		<form action="' . Tools::safeOutput($_SERVER['REQUEST_URI']) . '" method="post">
 			<fieldset class="shippingList">
 				<legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Shipping Method\'s list').'</legend>
 				<ol>';
@@ -942,7 +951,7 @@ class MondialRelay extends Module
 		
 		// Check if a request exist and if errors occured, use the post variable
 		if (Tools::isSubmit('PS_MRSubmitFieldPersonalization') && count($this->_postErrors))
-			$addr1 = Tools::getValue('Expe_ad1');
+			$addr1 = Tools::safeOutput(Tools::getValue('Expe_ad1'));
 			
 
 		if (!Configuration::get('PS_MR_SHOP_NAME'))
@@ -950,7 +959,7 @@ class MondialRelay extends Module
 				$this->l('Its seems you updated Mondialrelay without use the uninstall / install method, you have to set up this part to make working the generating ticket process').
 				'</div>';			
 		// Form
-		$form = '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">';
+		$form = '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">';
 		$form .= '
 			<fieldset class="PS_MRFormStyle">
 				<legend>
@@ -983,7 +992,7 @@ class MondialRelay extends Module
 	{
 		$this->orderState = Configuration::get('MONDIAL_RELAY_ORDER_STATE');
 	    $output = '';
-		$output .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">';
+		$output .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">';
 		$output .= '<fieldset><legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Settings').'</legend>';
 		$output .= '<label for="id_order_state">' . $this->l('Order state') . '</label>';
 		$output .= '<div class="margin-form">';
@@ -1012,7 +1021,7 @@ class MondialRelay extends Module
 	public function settingsForm()
 	{
 		$output = '
-			<form action="' . $_SERVER['REQUEST_URI'] . '" method="post" >
+			<form action="' . Tools::safeOutput($_SERVER['REQUEST_URI']) . '" method="post" >
 				<fieldset>
 					<legend><img src="../modules/mondialrelay/images/logo.gif" />'.$this->l('Mondial Relay Account Settings').'</legend>
 					<div>
@@ -1025,22 +1034,22 @@ class MondialRelay extends Module
 						<li>
 							<label for="mr_Enseigne_WebService" class="mrLabel">' . $this->l('Webservice Enseigne:') . '<sup>*</sup></label>
 							<input id="mr_Enseigne_WebService" class="mrInput" type="text" name="mr_Enseigne_WebService" value="' .
-							(Tools::getValue('mr_Enseigne_WebService') ? Tools::getValue('mr_Enseigne_WebService') : Configuration::get('MR_ENSEIGNE_WEBSERVICE')) . '"/>
+							(Tools::getValue('mr_Enseigne_WebService') ? Tools::safeOutput(Tools::getValue('mr_Enseigne_WebService')) : Configuration::get('MR_ENSEIGNE_WEBSERVICE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_code_marque" class="mrLabel">' . $this->l('Code marque:') . '<sup>*</sup></label>
 							<input id="mr_code_marque" class="mrInput" type="text" name="mr_code_marque" value="' .
-							(Tools::getValue('mr_code_marque') ? Tools::getValue('mr_code_marque') : Configuration::get('MR_CODE_MARQUE')) . '"/>
+							(Tools::getValue('mr_code_marque') ? Tools::safeOutput(Tools::getValue('mr_code_marque')) : Configuration::get('MR_CODE_MARQUE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_Key_WebService" class="mrLabel">' . $this->l('Webservice Key:') . '<sup>*</sup></label>
 							<input id="mr_Key_WebService" class="mrInput" type="text" name="mr_Key_WebService" value="' .
-							(Tools::getValue('mr_Key_WebService') ? Tools::getValue('mr_Key_WebService') : Configuration::get('MR_KEY_WEBSERVICE')) . '"/>
+							(Tools::getValue('mr_Key_WebService') ? Tools::safeOutput(Tools::getValue('mr_Key_WebService')) : Configuration::get('MR_KEY_WEBSERVICE')) . '"/>
 						</li>
 						<li>
 							<label for="mr_Langage" class="mrLabel">' . $this->l('Etiquette\'s Language:') . '<sup>*</sup></label>
 							<select id="mr_Langage" name="mr_Langage" value="'.
-							(Tools::getValue('mr_Langage') ? Tools::getValue('mr_Langage') : Configuration::get('MR_LANGUAGE')).'" >';
+							(Tools::getValue('mr_Langage') ? Tools::safeOutput(Tools::getValue('mr_Langage')) : Configuration::get('MR_LANGUAGE')).'" >';
 		$languages = Language::getLanguages();
 		foreach ($languages as $language)
 			$output .= '<option value="'.strtoupper($language['iso_code']).'" '.(strtoupper($language['iso_code']) == Configuration::get('MR_LANGUAGE') ? 'selected="selected"' : '').'>'.$language['name'].'</option>';
@@ -1050,7 +1059,7 @@ class MondialRelay extends Module
 						<li>
 							<label for="mr_weight_coef" class="mrLabel">' . $this->l('Weight Coefficient:') . '<sup>*</sup></label>
 							<input class="mrInput" type="text" name="mr_weight_coef" value="' . 
-							(Tools::getValue('mr_weight_coef') ? Tools::getValue('mr_weight_coef') : Configuration::get('MR_WEIGHT_COEF')) . '"  style="width:45px;"/>
+							(Tools::getValue('mr_weight_coef') ? Tools::safeOutput(Tools::getValue('mr_weight_coef')) : Configuration::get('MR_WEIGHT_COEF')) . '"  style="width:45px;"/>
 							<span class="indication">(' . $this->l('grammes = 1 ') . Configuration::get('PS_WEIGHT_UNIT').')</span>
 						</li>						
 						<li class="PS_MRSubmit">

modules/mondialrelay/mondialrelay.tpl

@@ -24,6 +24,8 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
+{$jQueryOverload}
+
 <link href="{$new_base_dir}/style.css" rel="stylesheet" type="text/css" media="all" /> 
 
 <script type="text/javascript">
@@ -33,9 +35,11 @@
 	var one_page_checkout = {$one_page_checkout};
 	var PS_MRTranslationList = new Array();
 	var PS_MRCarrierMethodList =  new Array();
+	var PS_MRSelectedRelayPoint = {literal}{{/literal}'carrier_id': 0, 'relayPointNum': 0{literal}}{/literal};
 	
 	PS_MRTranslationList['Select'] = "{l s='Select' mod='mondialrelay'}";
 	PS_MRTranslationList['Selected'] = "{l s='Selected' mod='mondialrelay'}";
+	PS_MRTranslationList['errorSelection'] = "{l s='Please choose a relay point' mod='mondialrelay'}";
 </script>
 
 <script type="text/javascript" src="{$new_base_dir}mondialrelay.js"></script>
@@ -43,6 +47,7 @@
 <script type="text/javascript" src="{$new_base_dir}js/gmap.js"></script>
 
 <script type="text/javascript">
+
 	$(document).ready(function() 
 	{literal}{{/literal}
 		// Bind id_carrierX to an ajax call 

modules/moneybookers/moneybookers.php

@@ -371,7 +371,7 @@ class MoneyBookers extends PaymentModule
 		$this->l('Moneybookers changes its name and becomes Skrill!').'<br /><br />
                 <div style="clear: both;"></div>
 
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" id="form-settings">
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" id="form-settings">
 			<fieldset class="width2" style="margin: 20px 0; width: 800px;">
 				<legend><img src="'.__PS_BASE_URI__.'modules/moneybookers/logo.gif" alt="" />'.$this->l('Settings').'</legend>
 				<div class="margin-form" style="margin:0; padding:0 0 1em 20px">
@@ -399,7 +399,7 @@ class MoneyBookers extends PaymentModule
 				</div>
 			</fieldset>
 		</form>
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" id="form-opening">
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" id="form-opening">
 			<fieldset class="width2" style="margin: 20px 0; width: 800px;">
 				<legend><img src="'.__PS_BASE_URI__.'modules/moneybookers/logo.gif" alt="" />'.$this->l('Open Account').'</legend>
 				'.$this->l('Start by opening a').' <b>'.$this->l('free account').'</b> '.$this->l('with Moneybookers:').'
@@ -441,7 +441,7 @@ class MoneyBookers extends PaymentModule
 			</fieldset>
 		</form>
 
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" id="form-activation"'.((!Configuration::get('MB_PARAMETERS') AND !isset($_POST['SubmitValidation'])) ? ' style="display: none;"' : '').'>
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" id="form-activation"'.((!Configuration::get('MB_PARAMETERS') AND !isset($_POST['SubmitValidation'])) ? ' style="display: none;"' : '').'>
 			<fieldset class="width2" style="margin: 20px 0; width: 800px;">
 				<legend><img src="'.__PS_BASE_URI__.'modules/moneybookers/logo.gif" alt="" />'.$this->l('Account validation').'</legend>
 				'.(Configuration::get('MB_PARAMETERS') == 1 ? '<p style="font-weight: bold; color: green;"><img src="../img/admin/ok.gif" alt="" /> '.$this->l('Your account has been activated').'</p>' : '').'
@@ -452,7 +452,7 @@ class MoneyBookers extends PaymentModule
 			</fieldset>
 		</form>
 
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" id="form-secret"'.((!Configuration::get('MB_PARAMETERS') AND !isset($_POST['SubmitSecret'])) ? ' style="display: none;"' : '').'>
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" id="form-secret"'.((!Configuration::get('MB_PARAMETERS') AND !isset($_POST['SubmitSecret'])) ? ' style="display: none;"' : '').'>
 			<fieldset class="width2" style="margin: 20px 0; width: 800px;">
 				<legend><img src="'.__PS_BASE_URI__.'modules/moneybookers/logo.gif" alt="" />'.$this->l('Secret word validation').'</legend>
 				'.(Configuration::get('MB_PARAMETERS_2') == 1 ? '<p style="font-weight: bold; color: green;"><img src="../img/admin/ok.gif" alt="" /> '.$this->l('Your secret word has been activated').'</p>' : '').'
@@ -473,7 +473,7 @@ class MoneyBookers extends PaymentModule
 			</fieldset>
 		</form>
 
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" id="form-settings"'.(!Configuration::get('MB_PARAMETERS') ? ' style="display: none;"' : '').'>
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" id="form-settings"'.(!Configuration::get('MB_PARAMETERS') ? ' style="display: none;"' : '').'>
 			<style type="text/css">
 				label {
 					width: 300px;

modules/newsletter/newsletter.php

@@ -115,7 +115,7 @@ class Newsletter extends Module
 				$this->_html .= $this->displayConfirmation(
 				$this->l('The .CSV file has been successfully exported.').
 				' ('.$nb.' '.$this->l('customers found').')<br />>
-				<a href="../modules/newsletter/'.strval($_POST['action']).'_'.$this->_file.'"><b>'.$this->l('Download the file').' '.$this->_file.'</b></a>
+				<a href="../modules/newsletter/'.Tools::safeOutput(strval($_POST['action'])).'_'.$this->_file.'"><b>'.$this->l('Download the file').' '.$this->_file.'</b></a>
 				<br />
 				<ol style="margin-top: 10px;">
 					<li style="color: red;">'.$this->l('WARNING: If opening this .csv file with Excel, remember to choose UTF-8 encoding or you may see strange characters.').'</li>
@@ -192,14 +192,14 @@ class Newsletter extends Module
 		</p>
         </fieldset><br />
         <fieldset class="width3"><legend>'.$this->l('Export Newsletter Subscribers').'</legend>
-        <form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+        <form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<input type="hidden" name="action" value="blockNewsletter">
 			'.$this->l('Generate a .CSV file based on BlockNewsletter subscribers data.').'.<br /><br />';
 		$this->_html .= '<br />
 		<center><input type="submit" class="button" name="submitExport" value="'.$this->l('Export .CSV file').'" /></center>
         </form></fieldset><br />
 		<fieldset class="width3"><legend>'.$this->l('Export customers').'</legend>
-        <form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+        <form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<input type="hidden" name="action" value="customers">
 			'.$this->l('Generate a .CSV file from customer account data').'.<br /><br />';
 		foreach ($this->_fieldsExport as $key => $field)

modules/ogone/ogone.php

@@ -117,17 +117,17 @@ class Ogone extends PaymentModule
 			<fieldset><legend><img src="../img/admin/contact.gif" /> '.$this->l('Settings').'</legend>
 				<label for="pspid">'.$this->l('PSPID').'</label>
 				<div class="margin-form">
-					<input type="text" id="pspid" size="20" name="OGONE_PSPID" value="'.Tools::getValue('OGONE_PSPID', Configuration::get('OGONE_PSPID')).'" />
+					<input type="text" id="pspid" size="20" name="OGONE_PSPID" value="'.Tools::safeOutput(Tools::getValue('OGONE_PSPID', Configuration::get('OGONE_PSPID'))).'" />
 				</div>
 				<div class="clear">&nbsp;</div>
 				<label for="sha-in">'.$this->l('SHA-in signature').'</label>
 				<div class="margin-form">
-					<input type="text" id="sha-in" size="20" name="OGONE_SHA_IN" value="'.Tools::getValue('OGONE_SHA_IN', Configuration::get('OGONE_SHA_IN')).'" />
+					<input type="text" id="sha-in" size="20" name="OGONE_SHA_IN" value="'.Tools::safeOutput(Tools::getValue('OGONE_SHA_IN', Configuration::get('OGONE_SHA_IN'))).'" />
 				</div>
 				<div class="clear">&nbsp;</div>
 				<label for="sha-out">'.$this->l('SHA-out signature').'</label>
 				<div class="margin-form">
-					<input type="text" id="sha-out" size="20" name="OGONE_SHA_OUT" value="'.Tools::getValue('OGONE_SHA_OUT', Configuration::get('OGONE_SHA_OUT')).'" />
+					<input type="text" id="sha-out" size="20" name="OGONE_SHA_OUT" value="'.Tools::safeOutput(Tools::getValue('OGONE_SHA_OUT', Configuration::get('OGONE_SHA_OUT'))).'" />
 				</div>
 				<div class="clear">&nbsp;</div>
 				<label>'.$this->l('Mode').'</label>

modules/paysafecard/PrepaidServices.php

@@ -328,7 +328,7 @@ abstract class PSCPrepaidServices extends PaymentModule
 		}
 		$currencies_configuration .= '</table>';
 
-		return '<form enctype="multipart/form-data" action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		return '<form enctype="multipart/form-data" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 					<fieldset>
 					<legend><img src="../img/admin/cog.gif" alt="" />'.$this->getL('configuration').'</legend>
 					<label>'.$this->getL('environment').'</label>

modules/productscategory/productscategory.php

@@ -74,7 +74,7 @@ class productsCategory extends Module
 			$this->_html .= $this->displayConfirmation($this->l('Settings updated successfully'));
 		}
 		$this->_html .= '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 		<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 			<label>'.$this->l('Display price on products').'</label>
 			<div class="margin-form">

modules/producttooltip/producttooltip.php

@@ -87,7 +87,7 @@ class ProductToolTip extends Module
 
 		/* Configuration form */
 		$output = '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 		<fieldset class="width2" style="float: left;">
 			<legend><img src="'.__PS_BASE_URI__.'modules/producttooltip/logo.gif" alt="" />'.$this->l('Product tooltips').'</legend>
 			<p>

modules/referralprogram/referralprogram.php

@@ -241,16 +241,16 @@ class ReferralProgram extends Module
 		$currencies = Currency::getCurrencies();
 
 		$this->_html .= '
-		<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+		<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 		<fieldset class="width3">
 			<legend><img src="'._PS_ADMIN_IMG_.'prefs.gif" alt="'.$this->l('Settings').'" />'.$this->l('Settings').'</legend>
 			<p>
 				<label class="t" for="order_quantity">'.$this->l('Minimum number of orders a sponsored friend must place to get their voucher:').'</label>
-				<input type="text" name="order_quantity" id="order_quantity" value="'.Tools::getValue('order_quantity', Configuration::get('REFERRAL_ORDER_QUANTITY')).'" style="width: 50px; text-align: right;" />
+				<input type="text" name="order_quantity" id="order_quantity" value="'.Tools::safeOutput(Tools::getValue('order_quantity', Configuration::get('REFERRAL_ORDER_QUANTITY'))).'" style="width: 50px; text-align: right;" />
 			</p>
 			<p>
 				<label class="t" for="nb_friends">'.$this->l('Number of friends in the referral program invitation form (customer account, referral program section):').'</label>
-				<input type="text" name="nb_friends" id="nb_friends" value="'.Tools::getValue('nb_friends', Configuration::get('REFERRAL_NB_FRIENDS')).'" style="width: 50px; text-align: right;" />
+				<input type="text" name="nb_friends" id="nb_friends" value="'.Tools::safeOutput(Tools::getValue('nb_friends', Configuration::get('REFERRAL_NB_FRIENDS'))).'" style="width: 50px; text-align: right;" />
 			</p>
 			<p>
 				<label class="t">'.$this->l('Voucher type:').'</label>
@@ -260,7 +260,7 @@ class ReferralProgram extends Module
 				<input type="radio" name="discount_type" id="discount_type2" value="2" onclick="$(\'#voucherbycurrency\').show(); $(\'#voucherbypercentage\').hide();" '.(Tools::getValue('discount_type', Configuration::get('REFERRAL_DISCOUNT_TYPE')) == 2 ? 'checked="checked"' : '').' />
 				<label class="t" for="discount_type2">'.$this->l('Voucher offering a fixed amount (by currency)').'</label>
 			</p>
-			<p id="voucherbypercentage"'.(Configuration::get('REFERRAL_DISCOUNT_TYPE') == 2 ? ' style="display: none;"' : '').'><label class="t">'.$this->l('Percentage:').'</label> <input type="text" id="discount_value_percentage" name="discount_value_percentage" value="'.Tools::getValue('discount_value_percentage', Configuration::get('REFERRAL_PERCENTAGE')).'" style="width: 50px; text-align: right;" /> %</p>
+			<p id="voucherbypercentage"'.(Configuration::get('REFERRAL_DISCOUNT_TYPE') == 2 ? ' style="display: none;"' : '').'><label class="t">'.$this->l('Percentage:').'</label> <input type="text" id="discount_value_percentage" name="discount_value_percentage" value="'.Tools::safeOutput(Tools::getValue('discount_value_percentage', Configuration::get('REFERRAL_PERCENTAGE'))).'" style="width: 50px; text-align: right;" /> %</p>
 			<table id="voucherbycurrency" cellpadding="5" style="border: 1px solid #BBB;'.(Configuration::get('REFERRAL_DISCOUNT_TYPE') == 1 ? ' display: none;' : '').'" border="0">
 				<tr>
 					<th style="width: 80px;">'.$this->l('Currency').'</th>
@@ -271,7 +271,7 @@ class ReferralProgram extends Module
 			$this->_html .= '
 			<tr>
 				<td>'.(Configuration::get('PS_CURRENCY_DEFAULT') == $currency['id_currency'] ? '<span style="font-weight: bold;">' : '').htmlentities($currency['name'], ENT_NOQUOTES, 'utf-8').(Configuration::get('PS_CURRENCY_DEFAULT') == $currency['id_currency'] ? '<span style="font-weight: bold;">' : '').'</td>
-				<td><input type="text" name="discount_value['.(int)($currency['id_currency']).']" id="discount_value['.(int)($currency['id_currency']).']" value="'.Tools::getValue('discount_value['.(int)($currency['id_currency']).']', Configuration::get('REFERRAL_DISCOUNT_VALUE_'.(int)($currency['id_currency']))).'" style="width: 50px; text-align: right;" /> '.$currency['sign'].'</td>
+				<td><input type="text" name="discount_value['.(int)($currency['id_currency']).']" id="discount_value['.(int)($currency['id_currency']).']" value="'.Tools::safeOutput(Tools::getValue('discount_value['.(int)($currency['id_currency']).']', Configuration::get('REFERRAL_DISCOUNT_VALUE_'.(int)($currency['id_currency'])))).'" style="width: 50px; text-align: right;" /> '.$currency['sign'].'</td>
 			</tr>';
 			
 		$this->_html .= '
@@ -320,7 +320,7 @@ class ReferralProgram extends Module
 			<script type="text/javascript" src="'.__PS_BASE_URI__.'js/tiny_mce/tiny_mce.js"></script>
 			<script type="text/javascript" src="'.__PS_BASE_URI__.'js/tinymce.inc.js"></script>
 			<script language="javascript">id_language = Number('.$defaultLanguage.');</script>
-		<form method="post" action="'.$_SERVER['REQUEST_URI'].'" enctype="multipart/form-data">
+		<form method="post" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" enctype="multipart/form-data">
 			<fieldset>
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" /> '.$this->l('Conditions of the referral program').'</legend>';
 		foreach ($languages AS $language)

modules/reverso/reverso.php

@@ -95,7 +95,7 @@ class Reverso extends Module
 
 		$this->_html .=
 			'<br /><fieldset><legend>'.$this->l('Configuration').'</legend>
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post">
 			<label for="serial">'.$this->l('Serial number').' :</label>
 			<div class="margin-form">
 				<input type="text" name="reverso_serial" value="'.$conf['REVERSO_SERIAL'].'" />

modules/secuvad/secuvad.php

@@ -607,7 +607,7 @@ class Secuvad extends Module
 	private function _setFormConfigure()
 	{
 		$this->_html .= '
-		<form method="POST" action="'.$_SERVER['REQUEST_URI'].'">
+		<form method="POST" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 			<fieldset style="width:430px;margin-right:10px;margin-bottom:10px;">
 				<legend><img src="'._PS_BASE_URL_.__PS_BASE_URI__.'/modules/'.$this->name.'/logo.gif" alt="" /> '.$this->l('Company').'</legend>
 				
@@ -645,7 +645,7 @@ class Secuvad extends Module
 			$categories[1]['infos'] = array('name' => $this->l('Home'), 'id_parent' => 0, 'level_depth' => 0);
 			
 			$this->_html .= '
-			<form method="POST" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="POST" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<fieldset style="width:900px;margin-right:10px;margin-bottom:10px;">
 					<legend><img src="'._PS_BASE_URL_.__PS_BASE_URI__.'/modules/'.$this->name.'/logo.gif" alt="" /> '.$this->l('Secuvad categories').'</legend>
 					
@@ -664,7 +664,7 @@ class Secuvad extends Module
 			';
 			
 			$this->_html .= '
-			<form method="POST" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="POST" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<fieldset style="width:430px;margin-right:10px;margin-bottom:10px;">
 					<legend><img src="'._PS_BASE_URL_.__PS_BASE_URI__.'/modules/'.$this->name.'/logo.gif" alt="" /> '.$this->l('Secuvad Payment').'</legend>
 					
@@ -699,7 +699,7 @@ class Secuvad extends Module
 			';
 			
 			$this->_html .= '
-			<form method="POST" action="'.$_SERVER['REQUEST_URI'].'">
+			<form method="POST" action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'">
 				<fieldset style="width:430px;margin-right:10px;margin-bottom:10px;">
 					<legend><img src="'._PS_BASE_URL_.__PS_BASE_URI__.'/modules/'.$this->name.'/logo.gif" alt="" /> '.$this->l('Secuvad Carrier').'</legend>
 					
@@ -786,7 +786,7 @@ class Secuvad extends Module
 	{
 		$this->_html .= '
 		<h3>'.$this->l('In order to use the Secuvad module, please fill in this form, then click "Register".').'</h3>
-		<form method="POST" action="'.($lock ? $this->_getSecuvadRegisterURL() : $_SERVER['REQUEST_URI']).'">';
+		<form method="POST" action="'.($lock ? $this->_getSecuvadRegisterURL() : Tools::safeOutput($_SERVER['REQUEST_URI'])).'">';
 		if ($lock)
 		{
 			foreach (Tools::getValue('categories') as $category)

modules/sekeywords/sekeywords.php

@@ -125,7 +125,7 @@ class SEKeywords extends ModuleGraph
 			$table .= '</tbody></table></div>';
 			$this->_html .= '<center>'.$this->engine(array('type' => 'pie')).'</center>
 			<br class="clear" />
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br class="clear" />
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br class="clear" />
 			<form action="'.Tools::htmlentitiesUTF8($_SERVER['REQUEST_URI']).'" method="post">
 				'.$this->l('Filter by keyword').' <input type="text" name="SEK_FILTER_KW" value="'.Tools::htmlentitiesUTF8(Configuration::get('SEK_FILTER_KW')).'" />
 				'.$this->l('and min occurrences').' <input type="text" name="SEK_MIN_OCCURENCES" value="'.(int)(Configuration::get('SEK_MIN_OCCURENCES')).'" />

modules/shopimporter/ajax.php

@@ -32,10 +32,10 @@ if (Tools::isSubmit('checkAndSaveConfig'))
 	$shopImporter = new shopImporter();
 	foreach($shopImporter->supportedImports as $key => $import)
 		if (array_key_exists('alterTable', $import))
-			$columns = Db::getInstance()->ExecuteS('SHOW COLUMNS FROM `'._DB_PREFIX_.pSQL($import['table']).'`');
+			$columns = Db::getInstance()->ExecuteS('SHOW COLUMNS FROM `'._DB_PREFIX_.bqSQL($import['table']).'`');
 			foreach ($columns as $column)
 				if ($column['Field'] == $import['identifier'].'_'.$moduleName)
-					Db::getInstance()->Execute('ALTER IGNORE TABLE `'._DB_PREFIX_.pSQL($import['table']).'` DROP `'.pSQL($import['identifier'].'_'.$moduleName).'`');
+					Db::getInstance()->Execute('ALTER IGNORE TABLE `'._DB_PREFIX_.bqSQL($import['table']).'` DROP `'.bqSQL($import['identifier'].'_'.$moduleName).'`');
 	if ($link = @mysql_connect(Tools::getValue('server'), Tools::getValue('user'), Tools::getValue('password')))
 	{
 		if (!@mysql_select_db(Tools::getValue('database'), $link))

modules/shopimporter/shopimporter.php

@@ -701,7 +701,7 @@ class shopimporter extends ImportModule
 			{
 				$this->saveMatchId(strtolower($className), (int)$object->id, (int)$id);
 				if ($className == 'Customer')
-					Db::getInstance()->Execute('UPDATE '._DB_PREFIX_.'customer SET passwd_'.Tools::getValue('moduleName').' = \''.$password.'\' WHERE id_customer = '.(int)$object->id);
+					Db::getInstance()->Execute('UPDATE '._DB_PREFIX_.'customer SET `passwd_'.bqSQL(Tools::getValue('moduleName')).'̀  = \''.pSQL($password).'\' WHERE id_customer = '.(int)$object->id);
 				if (array_key_exists('hasImage', $this->supportedImports[strtolower($className)]) AND Tools::isSubmit('images_'.$className))
 					$this->copyImg($item, $className);
 			}
@@ -795,7 +795,7 @@ class shopimporter extends ImportModule
 								$associatFields .= (int)$match[$association['fields'][1]][$v].'), ';
 							}
 				if ($associatFields != '')
-					Db::getInstance()->Execute('INSERT INTO `'._DB_PREFIX_.pSQL($tableAssociation).'` (`'.$associatFieldsName.'`) VALUES '.rtrim($associatFields, ', '));
+					Db::getInstance()->Execute('INSERT INTO `'._DB_PREFIX_.bqSQL($tableAssociation).'` (`'.$associatFieldsName.'`) VALUES '.rtrim($associatFields, ', '));
 			}
 		}
 	}
@@ -805,7 +805,7 @@ class shopimporter extends ImportModule
 		$table = $this->supportedImports[$className]['table'];
 		$moduleName = Tools::getValue('moduleName');
 		$identifier = $this->supportedImports[$className]['identifier'];
-		Db::getInstance()->Execute('UPDATE '._DB_PREFIX_.pSQL($table).' SET `'.pSQL($identifier).'_'.pSQL($moduleName).'` =  '.(int)$matchId.' WHERE `'.pSQL($identifier).'` = '.(int)$psId);
+		Db::getInstance()->Execute('UPDATE `'._DB_PREFIX_.bqSQL($table).'` SET `'.bqSQL($identifier).'_'.bqSQL($moduleName).'` =  '.(int)$matchId.' WHERE `'.bqSQL($identifier).'` = '.(int)$psId);
 	}
 
 	private function getMatchId($className)
@@ -813,7 +813,7 @@ class shopimporter extends ImportModule
 		$table = $this->supportedImports[$className]['table'];
 		$moduleName = Tools::getValue('moduleName');
 		$identifier = $this->supportedImports[$className]['identifier'];
-		$returns = Db::getInstance()->ExecuteS('SELECT `'.pSQL($identifier).'_'.pSQL($moduleName).'`, `'.pSQL($identifier).'` FROM '._DB_PREFIX_.pSQL($table).' WHERE `'.pSQL($identifier).'_'.pSQL($moduleName).'` != 0 ');
+		$returns = Db::getInstance()->ExecuteS('SELECT `'.bqSQL($identifier).'_'.bqSQL($moduleName).'`, `'.bqSQL($identifier).'` FROM `'._DB_PREFIX_.bqSQL($table).'` WHERE `'.bqSQL($identifier).'_'.bqSQL($moduleName).'` != 0 ');
 		$match = array();
 		foreach($returns as $return)
 			$match[$return[$identifier.'_'.$moduleName]] = $return[$identifier];
@@ -924,19 +924,19 @@ class shopimporter extends ImportModule
 		$queryTmp = '';
 		$from = $this->supportedImports[$className]['table'];
 		$result = array();
-		$result = Db::getInstance()->getRow('SELECT * FROM `'._DB_PREFIX_.pSQL($from).'`');
+		$result = Db::getInstance()->getRow('SELECT * FROM `'._DB_PREFIX_.bqSQL($from).'`');
 		if (!$result)
 			$result = array();
 		foreach ($this->supportedImports[$className]['alterTable'] AS $name => $type)
 		{
 			$moduleName = Tools::getValue('moduleName');
-			Db::getInstance()->ExecuteS("SHOW COLUMNS FROM `"._DB_PREFIX_.pSQL($from)."` LIKE '".pSQL($name).'_'.pSQL($moduleName)."'");
+			Db::getInstance()->ExecuteS("SHOW COLUMNS FROM `"._DB_PREFIX_.bqSQL($from)."` LIKE '".pSQL($name).'_'.pSQL($moduleName)."'");
 			if (!Db::getInstance()->numRows() AND !array_key_exists($name.'_'.$moduleName, $result))
 					$queryTmp .= ' ADD `'.$name.'_'.$moduleName.'` '.$type.' NOT NULL,';
 		}
 		if (!empty($queryTmp))
 		{
-			$query = 'ALTER TABLE  `'._DB_PREFIX_.pSQL($from).'` ';
+			$query = 'ALTER TABLE  `'._DB_PREFIX_.bqSQL($from).'` ';
 			$query .= rtrim($queryTmp, ',');
 			Db::getInstance()->Execute($query);
 		}
@@ -981,7 +981,7 @@ class shopimporter extends ImportModule
 			foreach($this->supportedImports AS $table => $conf)
 				if ($conf['identifier'] == $key2)
 					$from = $this->supportedImports[$table]['table'];
-			$return = Db::getInstance()->ExecuteS('SELECT `'.pSQL($key2).'_'.pSQL($moduleName).'`, `'.pSQL($key2).'` FROM `'._DB_PREFIX_.pSQL($from).'` WHERE `'.pSQL($key2).'_'.pSQL($moduleName).'` != 0');
+			$return = Db::getInstance()->ExecuteS('SELECT `'.bqSQL($key2).'_'.bqSQL($moduleName).'`, `'.bqSQL($key2).'` FROM `'._DB_PREFIX_.bqSQL($from).'` WHERE `'.bqSQL($key2).'_'.bqSQL($moduleName).'` != 0');
 			if (!empty($return))
 				foreach($return AS $name => $val)
 					$match[$key][$val[$key2.'_'.$moduleName]] = $val[$key2];
@@ -993,7 +993,7 @@ class shopimporter extends ImportModule
 	{
 		$id = $this->supportedImports[$table]['identifier'];
 		$moduleName = Tools::getValue('moduleName');
-		$return = Db::getInstance()->ExecuteS('SELECT `'.pSQL($id).'_'.pSQL($moduleName).'`, `'.pSQL($id).'` FROM `'._DB_PREFIX_.pSQL($table).'` WHERE `'.pSQL($id).'_'.pSQL($moduleName).'` != 0');
+		$return = Db::getInstance()->ExecuteS('SELECT `'.bqSQL($id).'_'.bqSQL($moduleName).'`, `'.bqSQL($id).'` FROM `'._DB_PREFIX_.bqSQL($table).'` WHERE `'.bqSQL($id).'_'.bqSQL($moduleName).'` != 0');
 		$match = array();
 		foreach($return AS $name => $val)
 				$match[$val[$id.'_'.$moduleName]] = $val[$id];
@@ -1003,7 +1003,7 @@ class shopimporter extends ImportModule
 	private function getMatchIdLang($order = 1)
 	{
 		$moduleName = Tools::getValue('moduleName');
-		$return = Db::getInstance()->ExecuteS('SELECT `id_lang`, `id_lang_'.pSQL($moduleName).'` FROM `'._DB_PREFIX_.'lang'.'` WHERE `id_lang_'.pSQL($moduleName).'` != 0');
+		$return = Db::getInstance()->ExecuteS('SELECT `id_lang`, `id_lang_'.bqSQL($moduleName).'` FROM `'._DB_PREFIX_.'lang'.'` WHERE `id_lang_'.bqSQL($moduleName).'` != 0');
 		$match = array();
 		foreach($return AS $name => $val)
 			if ((bool)$order)
@@ -1183,7 +1183,7 @@ class shopimporter extends ImportModule
 										{
 											$newId = Language::getIdByIso($iso);
 											Db::getInstance()->Execute('UPDATE  `'._DB_PREFIX_.'lang`
-																		SET  `id_lang_'.pSQL($moduleName).'` =  '.(int)$language['id_lang'].'
+																		SET  `id_lang_'.bqSQL($moduleName).'` =  '.(int)$language['id_lang'].'
 																		WHERE  `id_lang` = '.(int)$newId);
 										}
 									}
@@ -1206,7 +1206,7 @@ class shopimporter extends ImportModule
 			{
 				$newId = Language::getIdByIso($iso);
 				Db::getInstance()->Execute('UPDATE  `'._DB_PREFIX_.'lang`
-											SET  `id_lang_'.pSQL($moduleName).'` =  '.(int)$language['id_lang'].'
+											SET  `id_lang_'.bqSQL($moduleName).'` =  '.(int)$language['id_lang'].'
 											WHERE  `id_lang` = '.(int)$newId);
 			}
 		}
@@ -1290,7 +1290,7 @@ class shopimporter extends ImportModule
 			case 'customer' :
 			case 'zone' :
 			case 'state' :
-				Db::getInstance()->Execute('TRUNCATE TABLE `'._DB_PREFIX_.pSQL($table));
+				Db::getInstance()->Execute('TRUNCATE TABLE `'._DB_PREFIX_.bqSQL($table).'`');
 				break;
 		}
 		return true;

modules/socolissimo/socolissimo.php

@@ -211,7 +211,7 @@ class Socolissimo extends CarrierModule
 
 	private function _displayForm()
 	{
-		$this->_html .= '<form action="'.$_SERVER['REQUEST_URI'].'" method="post" class="form">
+		$this->_html .= '<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" class="form">
 		<fieldset><legend><img src="'.$this->_path.'logo.gif" alt="" /> '.$this->l('Description').'</legend>'.
 		$this->l('SoColissimo is a service offered by La Poste, which allows you to offer buyers 5 modes of delivery.').' :
 		<br/><br/><ul style ="list-style:disc outside none;margin-left:30px;">
@@ -234,13 +234,13 @@ class Socolissimo extends CarrierModule
 
 		<label>'.$this->l('ID So').' : </label>
 		<div class="margin-form">
-		<input type="text" name="id_user" value="'.Tools::getValue('id_user', Configuration::get('SOCOLISSIMO_ID')).'" />
+		<input type="text" name="id_user" value="'.Tools::safeOutput(Tools::getValue('id_user', Configuration::get('SOCOLISSIMO_ID'))).'" />
 		<p>' . $this->l('Id user for back office SoColissimo.') . '</p>
 		</div>
 
 		<label>'.$this->l('Key').' : </label>
 		<div class="margin-form">
-		<input type="text" name="key" value="'.Tools::getValue('key', Configuration::get('SOCOLISSIMO_KEY')).'" />
+		<input type="text" name="key" value="'.Tools::safeOutput(Tools::getValue('key', Configuration::get('SOCOLISSIMO_KEY'))).'" />
 		<p>'.$this->l('Secure key for back office SoColissimo.').'</p>
 		</div>
 

modules/statsbestmanufacturers/statsbestmanufacturers.php

@@ -104,7 +104,7 @@ class StatsBestManufacturers extends ModuleGrid
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
 			'.$this->engine($engineParams).'
-			<br /><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>
+			<br /><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>
 		</fieldset>';
 		return $this->_html;
 	}

modules/statsbestsuppliers/statsbestsuppliers.php

@@ -103,7 +103,7 @@ class StatsBestSuppliers extends ModuleGrid
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
 			'.$this->engine($engineParams).'
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 		</fieldset>';
 		return $this->_html;
 	}

modules/statsbestvouchers/statsbestvouchers.php

@@ -104,7 +104,7 @@ class StatsBestVouchers extends ModuleGrid
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
 			'.$this->engine($engineParams).'
-			<br /><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>
+			<br /><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>
 		</fieldset>';
 		return $this->_html;
 	}

modules/statscarrier/statscarrier.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -42,18 +42,18 @@ class StatsCarrier extends ModuleGraph
         $this->version = 1.0;
 		$this->author = 'PrestaShop';
 		$this->need_instance = 0;
-		
+
 		parent::__construct();
-		
+
         $this->displayName = $this->l('Carrier distribution');
         $this->description = $this->l('Display the carriers distribution');
     }
-	
+
 	public function install()
 	{
 		return (parent::install() AND $this->registerHook('AdminStatsModules'));
 	}
-		
+
 	public function hookAdminStatsModules($params)
 	{
 		$sql = 'SELECT COUNT(o.`id_order`) as total
@@ -68,7 +68,7 @@ class StatsCarrier extends ModuleGraph
 				$this->csvExport(array('type' => 'pie', 'option' => Tools::getValue('id_order_state')));
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post" style="float: right;">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" style="float: right;">
 				<select name="id_order_state">
 					<option value="0"'.((!Tools::getValue('id_order_state')) ? ' selected="selected"' : '').'>'.$this->l('All').'</option>';
 		foreach ($states AS $state)
@@ -77,23 +77,23 @@ class StatsCarrier extends ModuleGraph
 				<input type="submit" name="submitState" value="'.$this->l('Filter').'" class="button" />
 			</form>
 			<p><img src="../img/admin/down.gif" />'.$this->l('This graph represents the carrier distribution for your orders. You can also limit it to orders in one state.').'</p>
-			'.($result['total'] ? $this->engine(array('type' => 'pie', 'option' => Tools::getValue('id_order_state'))).'<br /><br />	<a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>' : $this->l('No valid orders for this period.')).'
+			'.($result['total'] ? $this->engine(array('type' => 'pie', 'option' => Tools::getValue('id_order_state'))).'<br /><br />	<a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a>' : $this->l('No valid orders for this period.')).'
 		</fieldset>';
 		return $this->_html;
 	}
-	
+
 	public function setOption($option, $layers = 1)
 	{
 		$this->_option = (int)($option);
 	}
-	
+
 	protected function getData($layers)
 	{
 		$stateQuery = '';
 		if ((int)($this->_option))
 			$stateQuery = 'AND (SELECT oh.id_order_state FROM `'._DB_PREFIX_.'order_history` oh WHERE o.id_order = oh.id_order ORDER BY oh.date_add DESC, oh.id_order_history DESC LIMIT 1) = '.(int)($this->_option);
 		$this->_titles['main'] = $this->l('Percentage of orders by carrier');
-		
+
 		$sql = 'SELECT c.name, COUNT(DISTINCT o.`id_order`) as total
 				FROM `'._DB_PREFIX_.'carrier` c
 				LEFT JOIN `'._DB_PREFIX_.'orders` o ON o.id_carrier = c.id_carrier

modules/statscheckup/statscheckup.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -39,7 +39,7 @@ class StatsCheckUp extends Module
 		$this->need_instance = 0;
 
         parent::__construct();
-		
+
         $this->displayName = $this->l('Catalog evaluation');
         $this->description = $this->l('Quick evaluation of your catalog quality.');
     }
@@ -51,7 +51,7 @@ class StatsCheckUp extends Module
 				Configuration::updateValue($confname, (int)$confdefault);
 		return (parent::install() && $this->registerHook('AdminStatsModules'));
 	}
-	
+
     function hookAdminStatsModules()
     {
 		if (Tools::isSubmit('submitCheckup'))
@@ -73,7 +73,7 @@ class StatsCheckUp extends Module
 		$db = Db::getInstance(_PS_USE_SQL_SLAVE_);
 		$employee = Context::getContext()->employee;
 		$prop30 = ((strtotime($employee->stats_date_to.' 23:59:59') - strtotime($employee->stats_date_from.' 00:00:00')) / 60 / 60 / 24) / 30;
-		
+
 		$shopID = $this->context->shop->getID();
 		$shopGroupID = $this->context->shop->getGroupID();
 
@@ -146,20 +146,20 @@ class StatsCheckUp extends Module
 			table.checkup td {padding:5px 10px}
 			table.checkup2 td {text-align:right}
 		</style>
-		<form action="'.AdminTab::$currentIndex.'&token='.Tools::getValue('token').'&module='.$this->name.'" method="post" class="checkup">
+		<form action="'.AdminTab::$currentIndex.'&token='.Tools::safeOutput(Tools::getValue('token')).'&module='.$this->name.'" method="post" class="checkup">
 		<table class="table checkup" border="0" cellspacing="0" cellspacing="0">
 			<tr><th></th><th>'.$arrayColors[0].' '.$this->l('Not enough').'</th><th>'.$arrayColors[2].' '.$this->l('Alright').'</th></tr>';
 		foreach ($arrayConf as $conf => $translations)
 			$html .= '<tr>
 				<th>'.$translations['name'].'</th>
-				<td>'.$this->l('lower than').' <input type="text" name="CHECKUP_'.$conf.'_LT" value="'.Tools::getValue('CHECKUP_'.$conf.'_LT', Configuration::get('CHECKUP_'.$conf.'_LT')).'" /> '.$translations['text'].'
+				<td>'.$this->l('lower than').' <input type="text" name="CHECKUP_'.$conf.'_LT" value="'.Tools::safeOutput(Tools::getValue('CHECKUP_'.$conf.'_LT', Configuration::get('CHECKUP_'.$conf.'_LT'))).'" /> '.$translations['text'].'
-				<td>'.$this->l('greater than').' <input type="text" name="CHECKUP_'.$conf.'_GT" value="'.Tools::getValue('CHECKUP_'.$conf.'_GT', Configuration::get('CHECKUP_'.$conf.'_GT')).'" /> '.$translations['text'].'
+				<td>'.$this->l('greater than').' <input type="text" name="CHECKUP_'.$conf.'_GT" value="'.Tools::safeOutput(Tools::getValue('CHECKUP_'.$conf.'_GT', Configuration::get('CHECKUP_'.$conf.'_GT'))).'" /> '.$translations['text'].'
 			</tr>';
 		$html .= '</table>
 			<div><input type="submit" name="submitCheckup" class="button" value="'.$this->l('   Save   ').'" /></div>
 		</form>
 		<div class="clear">&nbsp;</div>
-		<form action="'.AdminTab::$currentIndex.'&token='.Tools::getValue('token').'&module='.$this->name.'" method="post">
+		<form action="'.AdminTab::$currentIndex.'&token='.Tools::safeOutput(Tools::getValue('token')).'&module='.$this->name.'" method="post">
 			'.$this->l('Order by').'
 			<select name="submitCheckupOrder" onchange="this.form.submit();" style="width:100px">
 				<option value="1">'.$this->l('ID').'</option>
@@ -203,7 +203,7 @@ class StatsCheckUp extends Module
 			}
 			$scores['average'] = array_sum($scores) / $divisor;
 			$scores['average'] = ($scores['average'] < 1 ? 0 : ($scores['average'] > 1.5 ? 2 : 1));
-			
+
 			$html .= '<tr>
 				<td>'.$row['id_product'].'</td>
 				<td style="text-align:left"><a href="index.php?tab=AdminCatalog&updateproduct&id_product='.$row['id_product'].'&token='.$tokenProducts.'">'.Tools::substr($row['name'], 0, 42).'</a></td>

modules/statsequipment/statsequipment.php

@@ -111,10 +111,10 @@ class StatsEquipment extends ModuleGraph
 			<center>
 				<p><img src="../img/admin/down.gif" />'.$this->l('Determine the percentage of web browsers used by your customers.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'wb')).'<br /><br />
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=browser"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=browser"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 				<p><img src="../img/admin/down.gif" />'.$this->l('Determine the percentage of operating systems used by your customers.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'os')).'
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=os"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>';
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=os"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>';
 				
 		if ($equipment)
 		{

modules/statsforecast/statsforecast.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -47,9 +47,9 @@ class StatsForecast extends Module
         $this->version = 1.0;
 		$this->author = 'PrestaShop';
 		$this->need_instance = 0;
-		
+
         parent::__construct();
-		
+
         $this->displayName = $this->l('Stats Dashboard');
         $this->description = '';
     }
@@ -58,25 +58,25 @@ class StatsForecast extends Module
 	{
 		return (parent::install() && $this->registerHook('AdminStatsModules'));
 	}
-	
+
 	public function getContent()
 	{
 		Tools::redirectAdmin('index.php?tab=AdminStats&module=statsforecast&token='.Tools::getAdminTokenLite('AdminStats'));
 	}
-	
+
 	public function hookAdminStatsModules()
 	{
 		$ru = AdminTab::$currentIndex.'&module='.$this->name.'&token='.Tools::getValue('token');
-		
+
 		$db = Db::getInstance();
-		
+
 		if (!isset($this->context->cookie->stats_granularity))
 			$this->context->cookie->stats_granularity = 10;
 		if (Tools::isSubmit('submitIdZone'))
-			$this->context->cookie->stats_id_zone = Tools::getValue('stats_id_zone');
+			$this->context->cookie->stats_id_zone = (int)Tools::getValue('stats_id_zone');
 		if (Tools::isSubmit('submitGranularity'))
 			$this->context->cookie->stats_granularity = Tools::getValue('stats_granularity');
-		
+
 		$currency = $this->context->currency;
 		$employee = $this->context->employee;
 
@@ -89,7 +89,7 @@ class StatsForecast extends Module
 		$interval = ($to - $from) / 60 / 60 / 24;
 		$interval2 = ($to2 - $from) / 60 / 60 / 24;
 		$prop30 = $interval / $interval2;
-		
+
 		if ($this->context->cookie->stats_granularity == 7)
 			$intervalAvg = $interval2 / 30;
 		if ($this->context->cookie->stats_granularity == 4)
@@ -98,7 +98,7 @@ class StatsForecast extends Module
 			$intervalAvg = $interval2;
 		if ($this->context->cookie->stats_granularity == 42)
 			$intervalAvg = $interval2 / 7;
-		
+
 		define('PS_BASE_URI', '/');
 		$result = $db->getRow('SELECT UNIX_TIMESTAMP(\'2009-06-05\') as t1, UNIX_TIMESTAMP(\''.$employee->stats_date_from.'\') as t2');
 		$from = max($result['t1'], $result['t2']);
@@ -110,7 +110,7 @@ class StatsForecast extends Module
 		$dateFromGInvoice = ($this->context->cookie->stats_granularity != 42
 			? 'SUBSTRING(invoice_date, 1, '.(int)$this->context->cookie->stats_granularity.')'
 			: 'IFNULL(MAKEDATE(YEAR(invoice_date),DAYOFYEAR(invoice_date)-WEEKDAY(invoice_date)), CONCAT(YEAR(invoice_date),"-01-01*"))');
-		
+
 		$sql = 'SELECT
 					'.$dateFromGInvoice.' as fix_date,
 					COUNT(DISTINCT o.id_order) as countOrders,
@@ -137,7 +137,7 @@ class StatsForecast extends Module
 
 		while ($row = $db->nextRow($result))
 			$dataTable[strtotime($row['fix_date'])] = $row;
-		
+
 		$this->_html .= '<div style="float:left;width:660px">
 		<fieldset><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
 			<p style="float:left">'.$this->l('All amounts are without taxes.').'</p>
@@ -192,7 +192,7 @@ class StatsForecast extends Module
 		{
 			$discountToday = (isset($discountArray[$row['fix_date']]) ? $discountArray[$row['fix_date']] : 0);
 			$visitsToday = (int)(isset($visitArray[$row['fix_date']]) ? $visitArray[$row['fix_date']] : 0);
-			
+
 			$dateFromGReg = ($this->context->cookie->stats_granularity != 42
 				? 'LIKE \''.$row['fix_date'].'%\''
 				: 'BETWEEN \''.substr($row['fix_date'], 0, 10).' 00:00:00\' AND DATE_ADD(\''.substr($row['fix_date'], 0, 8).substr($row['fix_date'], 8, 2).' 23:59:59\', INTERVAL 7 DAY)');
@@ -215,7 +215,7 @@ class StatsForecast extends Module
 				<td align="right">'.Tools::displayPrice($discountToday, $currency).'</td>
 				<td align="right" >'.Tools::displayPrice($totalHT, $currency).'</td>
 			</tr>';
-			
+
 			$this->t1 += $visitsToday;
 			$this->t2 += (int)($row['registrations']);
 			$this->t3 += (int)($row['countOrders']);
@@ -313,7 +313,7 @@ class StatsForecast extends Module
 					AND o.date_add BETWEEN '.ModuleGraph::getDateBetween()
 					.$this->sqlShopRestriction(Shop::SHARE_ORDER, 'o');
 		$orders = Db::getInstance()->getValue($sql);
-		
+
 		$this->_html .= '<div class="clear">&nbsp;</div>
 		<fieldset><legend><img src="../modules/'.$this->name.'/funnel.png" /> '.$this->l('Conversion').'</legend>
 			<span style="float:left;text-align:center;margin-right:10px;padding-top:15px">'.$this->l('Visitors').'<br />'.$visitors.'</span>
@@ -348,13 +348,13 @@ class StatsForecast extends Module
 			'.$this->l('Turn your visitors into money:').'
 			<br />'.$this->l('Each visitor yields').' <b>'.Tools::displayPrice($ca['ventil']['total'] / max(1, $visitors), $currency).'.</b>
 			<br />'.$this->l('Each registered visitor yields').' <b>'.Tools::displayPrice($ca['ventil']['total'] / max(1, $customers), $currency).'</b>.
-		</fieldset>';		
+		</fieldset>';
-		
+
 		$from = strtotime($employee->stats_date_from.' 00:00:00');
 		$to = strtotime($employee->stats_date_to.' 23:59:59');
 		$interval = ($to - $from) / 60 / 60 / 24;
 		$prop5000 = 5000 / 30 * $interval;
-		
+
 		$this->_html .= '
 		<div class="clear">&nbsp;</div>';
 		$this->_html .= '<fieldset><legend id="payment"><img src="../img/t/AdminPayment.gif" />'.$this->l('Payment distibution').'</legend>
@@ -477,7 +477,7 @@ class StatsForecast extends Module
 		$this->_html .= '</table>
 		</fieldset>
 		</div>';
-		
+
 		return $this->_html;
 	}
 
@@ -490,7 +490,7 @@ class StatsForecast extends Module
 		if ((int)$this->context->cookie->stats_id_zone)
 		{
 			$join =  ' LEFT JOIN `'._DB_PREFIX_.'address` a ON o.id_address_invoice = a.id_address LEFT JOIN `'._DB_PREFIX_.'country` co ON co.id_country = a.id_country';
-			$where = ' AND co.id_zone = '.$this->context->cookie->stats_id_zone.' ';
+			$where = ' AND co.id_zone = '.(int)$this->context->cookie->stats_id_zone.' ';
 		}
 
 		$sql = 'SELECT SUM(od.`product_price` * od.`product_quantity` / o.conversion_rate) as orderSum, COUNT(*) AS orderQty, cl.name, AVG(od.`product_price` / o.conversion_rate) as priveAvg
@@ -526,7 +526,7 @@ class StatsForecast extends Module
 					'.$this->sqlShopRestriction(Shop::SHARE_ORDER, 'o');
 			$ca['lang'] = Db::getInstance()->getRow($sql);
 			arsort($ca['lang']);
-			
+
 			$sql = 'SELECT '.$langValues.'
 					FROM `'._DB_PREFIX_.'orders` o
 					WHERE o.valid = 1

modules/statslive/statslive.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -37,13 +37,13 @@ class StatsLive extends Module
         $this->version = 1.0;
 		$this->author = 'PrestaShop';
 		$this->need_instance = 0;
-		
+
         parent::__construct();
-		
+
         $this->displayName = $this->l('Visitors online');
         $this->description = $this->l('Display the list of customers and visitors currently online.');
     }
-	
+
 	public function install()
 	{
 		return (parent::install() AND $this->registerHook('AdminStatsModules'));
@@ -51,7 +51,7 @@ class StatsLive extends Module
 
 	/**
 	 * Get the number of online customers
-	 * 
+	 *
 	 * @return array(array, int) array of online customers entries, number of online customers
 	 */
 	private function getCustomersOnline()
@@ -74,7 +74,7 @@ class StatsLive extends Module
 
 	/**
 	 * Get the number of online visitors
-	 * 
+	 *
 	 * @return array(array, int) array of online visitors entries, number of online visitors
 	 */
 	private function getVisitorsOnline()
@@ -101,20 +101,20 @@ class StatsLive extends Module
 					INNER JOIN `'._DB_PREFIX_.'guest` g ON c.id_guest = g.id_guest
 					WHERE (g.id_customer IS NULL OR g.id_customer = 0)
 						'.$this->sqlShopRestriction(false, 'c').'
-						AND c.`date_add` > "'.date('Y-m-d H:i:s', strtotime('-15 minutes')).'"
+						AND TIME_TO_SEC(TIMEDIFF(NOW(), c.`date_add`)) < 900
 					ORDER BY c.date_add DESC';
 		}
-		
+
 		$results = Db::getInstance(_PS_USE_SQL_SLAVE_)->ExecuteS($sql);
 		return array($results, Db::getInstance()->NumRows());
 	}
-	
+
 	public function hookAdminStatsModules($params)
 	{
 		list($customers, $totalCustomers) = $this->getCustomersOnline();
 		list($visitors, $totalVisitors) = $this->getVisitorsOnline();
 		$irow = 0;
-		
+
 		echo '<script type="text/javascript" language="javascript">
 			$("#calendar").next().remove();
 			$("#calendar").remove();

modules/statsnewsletter/statsnewsletter.php

@@ -67,7 +67,7 @@ class StatsNewsletter extends ModuleGraph
 				<p>'.$this->l('Registrations from visitors:').' '.(int)($totals['visitors']).'</p>
 				<p>'.$this->l('Both:').' '.(int)($totals['both']).'</p>
 				<center>'.$this->engine(array('type' => 'line', 'layers' => 3)).'</center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 			</fieldset>';
 		}
 		else

modules/statsorigin/statsorigin.php

@@ -90,7 +90,7 @@ class StatsOrigin extends ModuleGraph
 			$this->_html .= '
 			<center><p><img src="../img/admin/down.gif" />'. $this->l('Here is the percentage of the 10 most popular referrer websites by which visitors went through to get to your shop.').'</p>
 			'.$this->engine(array('type' => 'pie')).'</center>
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=top"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=top"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
 			<div style="overflow-y: scroll; height: 600px;">
 			<center>
 			<table class="table " border="0" cellspacing="0" cellspacing="0">

modules/statspersonalinfos/statspersonalinfos.php

@@ -74,20 +74,20 @@ class StatsPersonalInfos extends ModuleGraph
 
 				<center><p><img src="../img/admin/down.gif" />'.$this->l('Gender distribution allows you to determine the percentage of men and women among your customers.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'gender')).'<br /></center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=gender"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=gender"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 				<br class="clear" /><br />
 				<center><p><img src="../img/admin/down.gif" />'.$this->l('Age ranges allows you to determine in which age range your customers are.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'age')).'<br /></center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=age"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=age"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
 				<center><p><img src="../img/admin/down.gif" />'.$this->l('Country distribution allows you to determine in which part of the world your customers are shopping from.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'country')).'<br /></center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=country"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=country"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
 				<center><p><img src="../img/admin/down.gif" />'.$this->l('Currency ranges allows you to determine which currencies your customers are using.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'currency')).'<br /></center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=currency"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=currency"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br /><br />
 				<center><p><img src="../img/admin/down.gif" />'.$this->l('Language distribution allows you to determine the general languages your customers are using on your shop.').'</p>
 				'.$this->engine(array('type' => 'pie', 'option' => 'language')).'<br /></center>
-				<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+				<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=language"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 			</center>';
 		}
 		else

modules/statsproduct/statsproduct.php

@@ -1,6 +1,6 @@
 <?php
 /*
-* 2007-2011 PrestaShop 
+* 2007-2011 PrestaShop
 *
 * NOTICE OF LICENSE
 *
@@ -44,7 +44,7 @@ class StatsProduct extends ModuleGraph
 		$this->need_instance = 0;
 
         parent::__construct();
-		
+
         $this->displayName = $this->l('Product details');
         $this->description = $this->l('Get detailed statistics for each product.');
     }
@@ -150,17 +150,17 @@ class StatsProduct extends ModuleGraph
 	{
 		$id_category = (int)(Tools::getValue('id_category'));
 		$currency = Context::getContext()->currency;
-		
+
 		if (Tools::getValue('export'))
 			if (!Tools::getValue('exportType'))
 				$this->csvExport(array('layers' => 2, 'type' => 'line', 'option' => '42'));
-		
+
 		$this->_html = '<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>';
 		if ($id_product = (int)(Tools::getValue('id_product')))
 		{
 			if (Tools::getValue('export'))
 				if (Tools::getValue('exportType') == 1)
-					$this->csvExport(array('layers' => 2, 'type' => 'line', 'option' => '1-'.$id_product));	
+					$this->csvExport(array('layers' => 2, 'type' => 'line', 'option' => '1-'.$id_product));
 				elseif (Tools::getValue('exportType') == 2)
 					$this->csvExport(array('type' => 'pie', 'option' => '3-'.$id_product));
 			$product = new Product($id_product, false, $this->context->language->id);
@@ -174,10 +174,10 @@ class StatsProduct extends ModuleGraph
 			<p>'.$this->l('Conversion rate:').' '.number_format($totalViewed ? $totalBought / $totalViewed : 0, 2).'</p>
 			<center>'.$this->engine(array('layers' => 2, 'type' => 'line', 'option' => '1-'.$id_product)).'</center>
 			<br />
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>';
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>';
 			if ($hasAttribute = $product->hasAttributes() AND $totalBought)
 				$this->_html .= '<h3 class="space">'.$this->l('Attribute sales distribution').'</h3><center>'.$this->engine(array('type' => 'pie', 'option' => '3-'.$id_product)).'</center><br />
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1&exportType=2"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br />';
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1&exportType=2"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p><br />';
 			if ($totalBought)
 			{
 				$sales = $this->getSales($id_product, $this->context->language->id);
@@ -208,7 +208,7 @@ class StatsProduct extends ModuleGraph
 						<td>'.Tools::displayprice($sale['total'], $currency).'</td>
 					</tr>';
 				$this->_html .= '</tbody></table></div>';
-				
+
 				$crossSelling = $this->getCrossSales($id_product, $this->context->language->id);
 				if (count($crossSelling))
 				{
@@ -263,12 +263,14 @@ class StatsProduct extends ModuleGraph
 					<th>'.$this->l('Stock').'</th>
 				</tr>
 			</thead><tbody>';
-			foreach ($this->getProducts($this->context->language->id) AS $product)
+
-				$this->_html .= '<tr><td>'.$product['reference'].'</td><td><a href="'.AdminTab::$currentIndex.'&token='.Tools::getValue('token').'&module='.$this->name.'&id_product='.$product['id_product'].'">'.$product['name'].'</a></td><td>'.$product['quantity'].'</td></tr>';
+			foreach ($this->getProducts($this->context->language->id) as $product)
+				$this->_html .= '<tr><td>'.$product['reference'].'</td><td><a href="'.AdminTab::$currentIndex.'&token='.Tools::safeOutput(Tools::getValue('token')).'&module='.$this->name.'&id_product='.$product['id_product'].'">'.$product['name'].'</a></td><td>'.$product['quantity'].'</td></tr>';
+
 			$this->_html .= '</tbody></table><br /></div><br />
-				<a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a><br />';
+				<a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a><br />';
 		}
-		
+
 		$this->_html .= '</fieldset><br />
 		<fieldset class="width3"><legend><img src="../img/admin/comment.gif" /> '.$this->l('Guide').'</legend>
 		<h2>'.$this->l('Number of purchases compared to number of viewings').'</h2>
@@ -331,7 +333,7 @@ class StatsProduct extends ModuleGraph
 						GROUP BY od.`product_attribute_id`';
 				$this->_titles['main'] = $this->l('Attributes');
 			break;
-				
+
 			case 42:
 				$this->_titles['main'][1] = $this->l('Ref.');
 				$this->_titles['main'][2] = $this->l('Name');
@@ -358,7 +360,7 @@ class StatsProduct extends ModuleGraph
 		else
 		{
 			$product = new Product($this->_id_product, false, (int)($this->getLang()));
-			
+
 			$combArray = array();
 			$assocNames = array();
 			$combinaisons = $product->getAttributeCombinaisons((int)($this->getLang()));
@@ -372,7 +374,7 @@ class StatsProduct extends ModuleGraph
 				$list = rtrim($list, ', ');
 				$assocNames[$id_product_attribute] = $list;
 			}
-		
+
 			$result = Db::getInstance(_PS_USE_SQL_SLAVE_)->ExecuteS($this->_query);
 			foreach ($result as $row)
 			{

modules/statsregistrations/statsregistrations.php

@@ -116,7 +116,7 @@ class StatsRegistrations extends ModuleGraph
 			</p>
 			<p>'.$this->l('Total customer accounts:').' '.$totalRegistrations.'</p>
 			<center>'.$this->engine(array('type' => 'line')).'</center>
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 		</fieldset><br />
 		<fieldset class="width3"><legend><img src="../img/admin/comment.gif" /> '.$this->l('Guide').'</legend>
 			<h2>'.$this->l('Number of customer accounts created').'</h2>

modules/statssales/statssales.php

@@ -68,7 +68,7 @@ class StatsSales extends ModuleGraph
 			
 		$this->_html = '
 		<fieldset class="width3"><legend><img src="../modules/'.$this->name.'/logo.gif" /> '.$this->displayName.'</legend>
-			<form action="'.$_SERVER['REQUEST_URI'].'" method="post" style="float: right; margin-left: 10px;">
+			<form action="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'" method="post" style="float: right; margin-left: 10px;">
 				<select name="id_country">
 					<option value="0"'.((!Tools::getValue('id_order_state')) ? ' selected="selected"' : '').'>'.$this->l('All').'</option>';
 		foreach (Country::getCountries($this->context->language->id) AS $country)
@@ -82,15 +82,15 @@ class StatsSales extends ModuleGraph
 			<p>'.$this->l('Orders placed:').' '.(int)($totals['orderCount']).'</p>
 			<p>'.$this->l('Products bought:').' '.(int)($totals['products']).'</p>
 			<center>'.$this->engine(array('type' => 'line', 'option' => '1-'.(int)Tools::getValue('id_country'), 'layers' => 2)).'</center>
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=1"><img src="../img/admin/asterisk.gif" alt="" />'.$this->l('CSV Export').'</a></p>
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=1"><img src="../img/admin/asterisk.gif" alt="" />'.$this->l('CSV Export').'</a></p>
 			<p>'.$this->l('Sales:').' '.Tools::displayPrice($totals['orderSum'], $currency).'</p>
 			<center>'.$this->engine(array('type' => 'line', 'option' => '2-'.(int)Tools::getValue('id_country'))).'</center></p>
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=2"><img src="../img/admin/asterisk.gif" alt="" />'.$this->l('CSV Export').'</a></p>
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=2"><img src="../img/admin/asterisk.gif" alt="" />'.$this->l('CSV Export').'</a></p>
 			<p class="space"><img src="../img/admin/down.gif" />
 				'.$this->l('You can see the order state distribution below.').'
 			</p><br />
 			'.($totals['orderCount'] ? $this->engine(array('type' => 'pie', 'option' => '3-'.(int)Tools::getValue('id_country'))) : $this->l('No orders for this period.')).'</center>
-			<p><a href="'.$_SERVER['REQUEST_URI'].'&export=3"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
+			<p><a href="'.Tools::safeOutput($_SERVER['REQUEST_URI']).'&export=3"><img src="../img/admin/asterisk.gif" />'.$this->l('CSV Export').'</a></p>
 		</fieldset>
 		<br class="clear" />
 		<fieldset class="width3"><legend><img src="../img/admin/comment.gif" /> '.$this->l('Guide').'</legend>