// Code cleaning

admin-dev/themes/default/template/controllers/stats/calendar.tpl

@@ -34,10 +34,10 @@
 					<input type="submit" name="submitDateMonthPrev" class="button submitDateMonthPrev" value="{$translations.Month}-1">
 					<input type="submit" name="submitDateYearPrev" class="button submitDateYearPrev" value="{$translations.Year}-1">
 					<p><span>{if isset($translations.From)}{$translations.From}{else}{l s='From:'}{/if}</span>
-						<input type="text" name="datepickerFrom" id="datepickerFrom" value="{$datepickerFrom}" class="datepicker">
+						<input type="text" name="datepickerFrom" id="datepickerFrom" value="{$datepickerFrom|escape}" class="datepicker">
 					</p>
 					<p><span>{if isset($translations.To)}{$translations.To}{else}<span>{l s='From:'}</span>{/if}</span>
-						<input type="text" name="datepickerTo" id="datepickerTo" value="{$datepickerTo}" class="datepicker">
+						<input type="text" name="datepickerTo" id="datepickerTo" value="{$datepickerTo|escape}" class="datepicker">
 					</p>
 					<input type="submit" name="submitDatePicker" id="submitDatePicker" class="button" value="{if isset($translations.Save)}{$translations.Save}{else}{l s='Save'}{/if}" />
 				</form>

controllers/admin/AdminOrdersController.php

@@ -501,9 +501,20 @@ class AdminOrdersControllerCore extends AdminController
 				else
 				{
 					$productList = Tools::getValue('id_order_detail');
+					if ($productList)
+						$productList = array_map('intval', $productList);
+					
 					$customizationList = Tools::getValue('id_customization');
+					if ($customizationList)
+						$customizationList = array_map('intval', $customizationList);
+						
 					$qtyList = Tools::getValue('cancelQuantity');
+					if ($qtyList)
+						$qtyList = array_map('intval', $qtyList);
+						
 					$customizationQtyList = Tools::getValue('cancelCustomizationQuantity');
+					if ($customizationQtyList)
+						$customizationQtyList = array_map('intval', $customizationQtyList);
 
 					$full_product_list = $productList;
 					$full_quantity_list = $qtyList;

modules/blocklink/blocklink.php

@@ -394,8 +394,8 @@ class BlockLink extends Module
 	 	{
 			$this->_html .= '
 			<script type="text/javascript">
-				var currentUrl = \''.AdminController::$currentIndex.'&configure='.$this->name.'\';
-				var token=\''.Tools::getValue('token').'\';
+				var currentUrl = \''.addslashes(AdminController::$currentIndex.'&configure='.$this->name).'\';
+				var token=\''.addslashes(Tools::getValue('token')).'\';
 				var links = new Array();';
 			foreach ($links as $link)
 	 		{

modules/blocksupplier/blocksupplier.php

@@ -110,7 +110,7 @@ class BlockSupplier extends Module
 					<label class="t" for="text_list_on"> <img src="../img/admin/enabled.gif" alt="'.$this->l('Enabled').'" title="'.$this->l('Enabled').'" /></label>
 					<input type="radio" name="text_list" id="text_list_off" value="0" '.(!Tools::getValue('text_list', Configuration::get('SUPPLIER_DISPLAY_TEXT')) ? 'checked="checked" ' : '').'/>
 					<label class="t" for="text_list_off"> <img src="../img/admin/disabled.gif" alt="'.$this->l('Disabled').'" title="'.$this->l('Disabled').'" /></label>
-					&nbsp;&nbsp;&nbsp;'.$this->l('Display').' <input type="text" size="2" name="text_nb" value="'.Tools::getValue('text_nb', Configuration::get('SUPPLIER_DISPLAY_TEXT_NB')).'" /> '.$this->l('elements').'
+					&nbsp;&nbsp;&nbsp;'.$this->l('Display').' <input type="text" size="2" name="text_nb" value="'.(int)Tools::getValue('text_nb', Configuration::get('SUPPLIER_DISPLAY_TEXT_NB')).'" /> '.$this->l('elements').'
 					<p class="clear">'.$this->l('To display suppliers as a plain-text list').'</p>
 				</div>
 				<label>'.$this->l('Use a drop-down list').'</label>

modules/statsforecast/statsforecast.php

@@ -130,7 +130,7 @@ class StatsForecast extends Module
 		$this->_html .= '<div>
 		<div class="blocStats"><h2 class="icon-'.$this->name.'"><span></span>'.$this->displayName.'</h2>
 			<p>'.$this->l('All amounts are without taxes.').'</p>
-			<form id="granularity" action="'.$ru.'#granularity" method="post">
+			<form id="granularity" action="'.Tools::safeOutput($ru).'#granularity" method="post">
 				<input type="hidden" name="submitGranularity" value="1" />
 				'.$this->l('Mode:').' <select name="stats_granularity" onchange="this.form.submit();" style="width:100px">
 					<option value="10">'.$this->l('Day').'</option>