Vermeidung von SQL injection durch Verwendung parametrisierter Abfragen.

[kivitendo-erp.git] / SL / Form.pm

diff --git a/SL/Form.pm b/SL/Form.pm
index 842afe8..7636b16 100644 (file)
--- a/SL/Form.pm
+++ b/SL/Form.pm
@@ -433,7 +433,7 @@ function fokus(){document.$self->{fokus}.focus();}
   <script type="text/javascript" src="js/tabcontent.js">
   
   /***********************************************
-  * Tab Content script- © Dynamic Drive DHTML code library (www.dynamicdrive.com)
+  * Tab Content script- Dynamic Drive DHTML code library (www.dynamicdrive.com)
   * This notice MUST stay intact for legal use
   * Visit Dynamic Drive at http://www.dynamicdrive.com/ for full source code
   ***********************************************/
@@ -1092,7 +1092,7 @@ sub get_exchangerate {
 
   unless ($transdate) {
     $main::lxdebug->leave_sub();
-    return "";
+    return 1;
   }
 
   my $query = qq|SELECT e.$fld FROM exchangerate e
@@ -1104,7 +1104,7 @@ sub get_exchangerate {
   my ($exchangerate) = $sth->fetchrow_array;
   $sth->finish;
 
-  if ($exchangerate == 0) {
+  if (!$exchangerate) {
     $exchangerate = 1;
   }
 
@@ -1696,7 +1696,6 @@ sub all_vc {
   $main::lxdebug->leave_sub();
 }
 
-
 sub language_payment {
   $main::lxdebug->enter_sub();
 
@@ -2216,6 +2215,83 @@ sub update_status {
   $main::lxdebug->leave_sub();
 }
 
+#--- 4 locale ---#
+# $main::locale->text('SAVED') 
+# $main::locale->text('DELETED') 
+# $main::locale->text('ADDED')
+# $main::locale->text('PAYMENT POSTED')
+# $main::locale->text('POSTED')
+# $main::locale->text('POSTED AS NEW')
+# $main::locale->text('ELSE')
+# $main::locale->text('SAVED FOR DUNNING')
+# $main::locale->text('DUNNING STARTED')
+# $main::locale->text('PRINTED')
+# $main::locale->text('MAILED')
+# $main::locale->text('SCREENED')
+# $main::locale->text('invoice')
+# $main::locale->text('proforma')
+# $main::locale->text('sales_order')
+# $main::locale->text('packing_list')
+# $main::locale->text('pick_list')
+# $main::locale->text('purchase_order')
+# $main::locale->text('bin_list')
+# $main::locale->text('sales_quotation')
+# $main::locale->text('request_quotation')
+
+sub save_history {
+       $main::lxdebug->enter_sub();
+       
+       my $self = shift();
+       my $dbh = shift();
+       
+       if(!exists $self->{employee_id}) {
+               &get_employee($self, $dbh);
+       }
+       
+       my $query =
+    qq|INSERT INTO history_erp (trans_id, employee_id, addition, what_done) | .
+    qq|VALUES (?, ?, ?, ?)|;
+  my @values = (conv_i($self->{id}), conv_i($self->{employee_id}),
+                $self->{addition}, $self->{what_done});
+  do_query($self, $dbh, $query, @values);
+       
+       $main::lxdebug->leave_sub();
+}
+
+sub get_history {
+       $main::lxdebug->enter_sub();
+       
+       my $self = shift();
+       my $dbh = shift();
+       my $trans_id = shift();
+       my $restriction = shift();
+       my @tempArray;
+       my $i = 0;
+       if ($trans_id ne "") {
+               my $query =
+      qq|SELECT h.employee_id, h.itime::timestamp(0) AS itime, h.addition, h.what_done, emp.name | .
+      qq|FROM history_erp h | .
+      qq|LEFT JOIN employee emp | .
+      qq|ON emp.id = h.employee_id | .
+      qq|WHERE trans_id = ? |
+      . $restriction;
+       
+               my $sth = $dbh->prepare($query) || $self->dberror($query);
+       
+               $sth->execute($trans_id) || $self->dberror("$query ($trans_id)");
+
+               while(my $hash_ref = $sth->fetchrow_hashref()) {
+                       $hash_ref->{addition} = $main::locale->text($hash_ref->{addition});
+                       $hash_ref->{what_done} = $main::locale->text($hash_ref->{what_done});
+                       $tempArray[$i++] = $hash_ref; 
+               }
+    $main::lxdebug->leave_sub() and return \@tempArray
+      if ($i > 0 && $tempArray[0] ne "");
+       }
+       $main::lxdebug->leave_sub();
+       return 0;
+}
+
 sub save_status {
   $main::lxdebug->enter_sub();
 
@@ -2226,9 +2302,9 @@ sub save_status {
   my $formnames  = $self->{printed};
   my $emailforms = $self->{emailed};
 
-  my $query = qq|DELETE FROM status
-                 WHERE formname = '$self->{formname}'
-                AND trans_id = $self->{id}|;
+  $query = qq|DELETE FROM status
+              WHERE formname = '$self->{formname}'
+                     AND trans_id = $self->{id}|;
   $dbh->do($query) || $self->dberror($query);
 
   # this only applies to the forms