SQL injection bei Zahlungsverkehr behoben

[kivitendo-erp.git] / SL / AP.pm

diff --git a/SL/AP.pm b/SL/AP.pm
index bcd6d83..8c49bb3 100644 (file)
--- a/SL/AP.pm
+++ b/SL/AP.pm
@@ -492,7 +492,7 @@ sub ap_transactions {
 
   my $where = '';
 
-  unless ( $main::auth->check_right($form->{login}, 'show_ap_transactions') ) {
+  unless ( $::auth->assert('show_ap_transactions', 1) ) {
     $where .= " AND NOT invoice = 'f' ";  # remove ap transactions from Sales -> Reports -> Invoices
   };
 
@@ -703,7 +703,7 @@ sub setup_form {
   my ($self, $form, $for_post_payments) = @_;
 
   my ($exchangerate, $i, $j, $k, $key, $akey, $ref, $index, $taxamount, $totalamount, $totaltax, $totalwithholding, $withholdingrate,
-      $taxincluded, $tax, $diff);
+      $tax, $diff);
 
   # forex
   $form->{forex} = $form->{exchangerate};
@@ -807,7 +807,6 @@ sub setup_form {
     }
   }
 
-  $form->{taxincluded}  = $taxincluded if ($form->{id});
   $form->{paidaccounts} = 1            if not defined $form->{paidaccounts};
 
   if ($form->{taxincluded} && $form->{taxrate} && $totalamount) {