fixed #7253

ChurchCRM · Feb 24, 2025 · 75d2e8c · 75d2e8c
1 parent 8a01a0b
commit 75d2e8c
Showing 1 changed file with 5 additions and 9 deletions.
diff --git a/src/DonatedItemEditor.php b/src/DonatedItemEditor.php
@@ -10,9 +10,9 @@
 use ChurchCRM\Utils\InputUtils;
 use ChurchCRM\Utils\RedirectUtils;
 
-$iDonatedItemID = InputUtils::legacyFilterInputArr($_GET, 'DonatedItemID', 'int');
+$iDonatedItemID = InputUtils::filterInt(InputUtils::legacyFilterInputArr($_GET, 'DonatedItemID', 'int'));
 $linkBack = InputUtils::legacyFilterInputArr($_GET, 'linkBack');
-$iCurrentFundraiser = InputUtils::legacyFilterInputArr($_GET, 'CurrentFundraiser');
+$iCurrentFundraiser = InputUtils::filterInt(InputUtils::legacyFilterInputArr($_GET, 'CurrentFundraiser'));
 
 if ($iDonatedItemID > 0) {
     $sSQL = "SELECT * FROM donateditem_di WHERE di_ID = '$iDonatedItemID'";
@@ -21,17 +21,13 @@
     $iCurrentFundraiser = $theDonatedItem['di_FR_ID'];
 }
 
-if ($iCurrentFundraiser) {
-    $_SESSION['iCurrentFundraiser'] = $iCurrentFundraiser;
-} else {
-    $iCurrentFundraiser = $_SESSION['iCurrentFundraiser'];
-}
-
-// Get the current fundraiser data
 if ($iCurrentFundraiser) {
     $sSQL = 'SELECT * from fundraiser_fr WHERE fr_ID = ' . $iCurrentFundraiser;
     $rsDeposit = RunQuery($sSQL);
     extract(mysqli_fetch_array($rsDeposit));
+    $_SESSION['iCurrentFundraiser'] = $iCurrentFundraiser;
+} else {
+    $iCurrentFundraiser = $_SESSION['iCurrentFundraiser'];
 }
 
 $sPageTitle = gettext('Donated Item Editor');