From 7df65c63a5c9ad6b79c60841d0e1eb2a7df520e2 Mon Sep 17 00:00:00 2001 From: Ivan Kohler Date: Tue, 18 Nov 2014 20:10:45 -0800 Subject: fix time queue redirection after #30921 --- httemplate/misc/process/timeworked.html | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'httemplate/misc/process/timeworked.html') diff --git a/httemplate/misc/process/timeworked.html b/httemplate/misc/process/timeworked.html index 200a7511d..01752e1b7 100644 --- a/httemplate/misc/process/timeworked.html +++ b/httemplate/misc/process/timeworked.html @@ -1,7 +1,7 @@ % if ($error) { <% $cgi->redirect(popurl(2). "timeworked.html?". $cgi->query_string) %> % } else { -<% $cgi->redirect(popurl(3). "search/timeworked.html?begin=$begin;end=$end") %> +<% $cgi->redirect(popurl(3). "search/timeworked.html?begin=$begin;end=$end;category=$category") %> % } <%init> @@ -10,6 +10,9 @@ die "access denied" my($begin, $end) = FS::UI::Web::parse_beginning_ending($cgi); +( my $category = $cgi->param('category') ) =~ /^\w*$/ + or die 'illegal category';#no need for nice error messages for XSS, just avoid + my @acct_rt_transaction; foreach my $transaction ( map { /^transactionid(\d+)$/; $1; } grep /^transactionid\d+$/, $cgi->param -- cgit v1.2.1