Vermeidung von SQL injection durch Verwendung parametrisierter Abfragen.

[kivitendo-erp.git] / SL / RP.pm

diff --git a/SL/RP.pm b/SL/RP.pm
index 4ccabce..4c817f8 100644 (file)
--- a/SL/RP.pm
+++ b/SL/RP.pm
@@ -34,7 +34,6 @@
 
 package RP;
 
-
 sub balance_sheet {
   $main::lxdebug->enter_sub();
 
@@ -919,6 +918,7 @@ sub get_accounts_g {
   my $project;
   my $where    = "1 = 1";
   my $glwhere  = "";
+  my $prwhere  = "";
   my $subwhere = "";
   my $item;
 
@@ -926,6 +926,7 @@ sub get_accounts_g {
     if ($form->{method} eq 'cash') {
       $subwhere .= " AND transdate >= '$fromdate'";
       $glwhere = " AND ac.transdate >= '$fromdate'";
+      $prwhere = " AND ar.transdate >= '$fromdate'";
     } else {
       $where .= " AND ac.transdate >= '$fromdate'";
     }
@@ -934,6 +935,7 @@ sub get_accounts_g {
   if ($todate) {
     $where    .= " AND ac.transdate <= '$todate'";
     $subwhere .= " AND transdate <= '$todate'";
+    $prwhere  .= " AND ar.transdate <= '$todate'";
   }
 
   if ($department_id) {
@@ -1026,8 +1028,7 @@ sub get_accounts_g {
                 JOIN parts p ON (ac.parts_id = p.id)
                 JOIN chart c on (p.income_accno_id = c.id)
                 $dpt_join
-       -- use transdate from subwhere
-                WHERE 1 = 1 $subwhere
+                WHERE 1 = 1 $prwhere
                 AND c.category = 'I'
                 $dpt_where
                 AND ac.trans_id IN
@@ -1051,7 +1052,7 @@ sub get_accounts_g {
                 JOIN parts p ON (ac.parts_id = p.id)
                 JOIN chart c on (p.expense_accno_id = c.id)
                 $dpt_join
-                WHERE 1 = 1 $subwhere
+                WHERE 1 = 1 $prwhere
                 AND c.category = 'E'
                 $dpt_where
                 AND ac.trans_id IN
@@ -1105,8 +1106,7 @@ sub get_accounts_g {
                 JOIN parts p ON (ac.parts_id = p.id)
                 JOIN chart c on (p.income_accno_id = c.id)
                 $dpt_join
-       -- use transdate from subwhere
-                WHERE 1 = 1 $subwhere
+                WHERE 1 = 1 $prwhere
                 AND c.category = 'I'
                 $dpt_where
                 $project
@@ -1121,7 +1121,7 @@ sub get_accounts_g {
                 JOIN parts p ON (ac.parts_id = p.id)
                 JOIN chart c on (p.expense_accno_id = c.id)
                 $dpt_join
-                WHERE 1 = 1 $subwhere
+                WHERE 1 = 1 $prwhere
                 AND c.category = 'E'
                 $dpt_where
                 $project
@@ -1134,6 +1134,7 @@ sub get_accounts_g {
   my @accno;
   my $accno;
   my $ref;
+
   #print $query;
   my $sth = $dbh->prepare($query);
   $sth->execute || $form->dberror($query);
@@ -2045,8 +2046,8 @@ sub payments {
 
   my $sortorder = join ', ',
     $form->sort_columns(qw(name invnumber ordnumber transdate source));
-    $sortorder = $form->{sort} if $form->{sort};
-    
+  $sortorder = $form->{sort} if $form->{sort};
+
   # cycle through each id
   foreach my $accno (split(/ /, $form->{paymentaccounts})) {
 
@@ -2143,14 +2144,15 @@ sub bwa {
     $form->{ "$key" . "gesamtleistung" } = 0;
     $form->{ "$key" . "gesamtkosten" }   = 0;
 
-
     foreach $category (@categories) {
 
       if (defined($form->{$category}{$key})) {
         $form->{"$key$category"} =
           $form->format_amount($myconfig,
                                $form->round_amount($form->{$category}{$key}, 2
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
       }
     }
     foreach $item (@gesamtleistung) {
@@ -2173,7 +2175,7 @@ sub bwa {
     $form->{ "$key" . "ergebnisvorsteuern" } =
       $form->{ "$key" . "betriebsergebnis" } -
       $form->{ "$key" . "neutraleraufwand" } +
-       $form->{ "$key" . "neutralertrag" };
+      $form->{ "$key" . "neutralertrag" };
     $form->{ "$key" . "ergebnis" } =
       $form->{ "$key" . "ergebnisvorsteuern" } + $form->{35}{$key};
 
@@ -2188,7 +2190,9 @@ sub bwa {
                                     $form->{ "$key" . "gesamtleistung" } * 100
                                  ),
                                  $form->{decimalplaces}
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
         }
       }
       foreach $item (@ergebnisse) {
@@ -2199,7 +2203,9 @@ sub bwa {
                                      $form->{ "$key" . "gesamtleistung" } * 100
                                  ),
                                  $form->{decimalplaces}
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
       }
     }
 
@@ -2213,7 +2219,9 @@ sub bwa {
                                       $form->{ "$key" . "gesamtkosten" } * 100
                                    ),
                                    $form->{decimalplaces}
-                                 ), $form->{decimalplaces}, '0');
+                                 ),
+                                 $form->{decimalplaces},
+                                 '0');
         }
       }
       foreach $item (@ergebnisse) {
@@ -2224,7 +2232,9 @@ sub bwa {
                                       $form->{ "$key" . "gesamtkosten" } * 100
                                    ),
                                    $form->{decimalplaces}
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
       }
     }
 
@@ -2233,11 +2243,13 @@ sub bwa {
         if (defined($form->{$category}{$key})) {
           $form->{ "$key" . "pk" . "$category" } =
             $form->format_amount(
-                      $myconfig,
-                      $form->round_amount(
-                        ($form->{$category}{$key} / $form->{10}{$key} * 100), 
-                        $form->{decimalplaces}
-                      ), $form->{decimalplaces}, '0');
+                        $myconfig,
+                        $form->round_amount(
+                          ($form->{$category}{$key} / $form->{10}{$key} * 100),
+                          $form->{decimalplaces}
+                        ),
+                        $form->{decimalplaces},
+                        '0');
         }
       }
       foreach $item (@ergebnisse) {
@@ -2248,7 +2260,9 @@ sub bwa {
                                                    $form->{10}{$key} * 100
                                                 ),
                                                 $form->{decimalplaces}
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
       }
     }
 
@@ -2257,11 +2271,13 @@ sub bwa {
         if (defined($form->{$category}{$key})) {
           $form->{ "$key" . "auf" . "$category" } =
             $form->format_amount(
-                       $myconfig,
-                       $form->round_amount(
-                         ($form->{$category}{$key} / $form->{4}{$key} * 100), 
-                         $form->{decimalplaces}
-                       ), $form->{decimalplaces}, '0');
+                         $myconfig,
+                         $form->round_amount(
+                           ($form->{$category}{$key} / $form->{4}{$key} * 100),
+                           $form->{decimalplaces}
+                         ),
+                         $form->{decimalplaces},
+                         '0');
         }
       }
       foreach $item (@ergebnisse) {
@@ -2272,16 +2288,20 @@ sub bwa {
                                                    $form->{4}{$key} * 100
                                                 ),
                                                 $form->{decimalplaces}
-                               ), $form->{decimalplaces}, '0');
+                               ),
+                               $form->{decimalplaces},
+                               '0');
       }
     }
 
     foreach $item (@ergebnisse) {
       $form->{ "$key" . "$item" } =
         $form->format_amount($myconfig,
-                             $form->round_amount($form->{ "$key" . "$item" }, 
-                             $form->{decimalplaces}
-                             ), $form->{decimalplaces}, '0');
+                             $form->round_amount($form->{ "$key" . "$item" },
+                                                 $form->{decimalplaces}
+                             ),
+                             $form->{decimalplaces},
+                             '0');
     }
 
   }
@@ -2301,7 +2321,7 @@ sub ustva {
   my $last_period     = 0;
   my $category        = "pos_ustva";
   my @categories_cent = qw(51r 511 86r 861 97r 971 93r 931
-                           96 66 43 45 53 62 65 67);
+    96 66 43 45 53 62 65 67);
   my @categories_euro = qw(48 51 86 91 97 93 94);
   $form->{decimalplaces} *= 1;
 
@@ -2339,7 +2359,7 @@ sub ustva {
   #   }
   #
   #    }
-  
+
   #
   # Berechnung der USTVA Formularfelder
   #
@@ -2347,8 +2367,9 @@ sub ustva {
   $form->{"86r"} = $form->{"861"};
   $form->{"97r"} = $form->{"971"};
   $form->{"93r"} = $form->{"931"};
+
   #$form->{"96"}  = $form->{"94"} * 0.16;
-  $form->{"43"}  =
+  $form->{"43"} =
     $form->{"51r"} + $form->{"86r"} + $form->{"97r"} + $form->{"93r"} +
     $form->{"96"};
   $form->{"45"} = $form->{"43"};
@@ -2359,12 +2380,14 @@ sub ustva {
 
   foreach $item (@categories_cent) {
     $form->{$item} =
-      $form->format_amount($myconfig, $form->round_amount($form->{$item}, 2), 2, '0');
+      $form->format_amount($myconfig, $form->round_amount($form->{$item}, 2),
+                           2, '0');
   }
 
   foreach $item (@categories_euro) {
     $form->{$item} =
-      $form->format_amount($myconfig, $form->round_amount($form->{$item}, 0), 0, '0');
+      $form->format_amount($myconfig, $form->round_amount($form->{$item}, 0),
+                           0, '0');
   }
 
   $dbh->disconnect;