diff options
author | Mark Wells <mark@freeside.biz> | 2015-01-28 14:18:44 -0800 |
---|---|---|
committer | Mark Wells <mark@freeside.biz> | 2015-01-28 14:18:44 -0800 |
commit | 3ed9d0fa90662f037f3fb2f50632ccb34066a979 (patch) | |
tree | 16c356b51a27206e3ca5c1d7d523bef6fff0b6a0 /httemplate | |
parent | 42e878b29ae26943d7dc3acfbb7f095a56ae0a2f (diff) |
allow punctuation in tax name on tax report, #33255
Diffstat (limited to 'httemplate')
-rw-r--r-- | httemplate/search/report_tax.cgi | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/httemplate/search/report_tax.cgi b/httemplate/search/report_tax.cgi index 83f2fc5..491cd42 100644 --- a/httemplate/search/report_tax.cgi +++ b/httemplate/search/report_tax.cgi @@ -151,7 +151,7 @@ TD.rowhead { font-weight: bold; text-align: left; padding: 0px 3px } <% emt('Out of taxable region') %> </TD> <TD STYLE="text-align: right"> - <A HREF="<% $saleslink %>;out=1;taxname=<% $params{taxname} %>"> + <A HREF="<% $saleslink %>;out=1;taxname=<% encode_entities($params{'taxname'}) %>"> <% $money_sprintf->( $report->{outside } ) %> </A> </TD> @@ -188,8 +188,9 @@ if ( $cgi->param('agentnum') =~ /^(\d+)$/ ) { $agentname = $agent->agentname; } -if ( $cgi->param('taxname') =~ /^([\w ]+)$/ ) { - $params{taxname} = $1; +# allow anything in here; FS::Report::Tax will treat it as unsafe +if ( length($cgi->param('taxname')) ) { + $params{taxname} = $cgi->param('taxname'); } else { die "taxname required"; } |