Verhinderung von SQL injection durch Verwendung von parametrisierten Abfragen. Entfer...

[kivitendo-erp.git] / bin / mozilla / ct.pl

diff --git a/bin/mozilla/ct.pl b/bin/mozilla/ct.pl
index d94b9b1..a04cf5e 100644 (file)
--- a/bin/mozilla/ct.pl
+++ b/bin/mozilla/ct.pl
@@ -543,14 +543,8 @@ sub list_names {
 <input type=hidden name=password value=$form->{password}>
 
 <input class=submit type=submit name=action value="|
-    . $locale->text('Add') . qq|">|;
+    . $locale->text('Add') . qq|">
 
-  if ($form->{menubar}) {
-    require "$form->{path}/menu.pl";
-    &menubar;
-  }
-
-  print qq|
   </form>
 
 </body>
@@ -864,6 +858,7 @@ sub form_header {
   # $locale->text('Customer Number')
   # $locale->text('Vendor Number')
   $form->{fokus} = "ct.greeting";
+  $form->{jsscript} = 1;
   $form->header;
 
   print qq|
@@ -1165,9 +1160,11 @@ $shipto
     $delivery
     <tr>
       <th align=left nowrap>| . $locale->text('From') . qq|</th>
-      <td><input id=from name=from size=10 maxlength=10 value="$form->{from}"></td>
-      <th align=left nowrap>| . $locale->text('Bis') . qq|</th>
-      <td><input id=to name=to size=10 maxlength=10 value="$form->{to}"></td>
+      <td><input id=from name=from size=10 maxlength=10 value="$form->{from}">
+        <input type="button" name="fromB" id="trigger_from" value="?"></td>
+      <th align=left nowrap>| . $locale->text('To (time)') . qq|</th>
+      <td><input id=to name=to size=10 maxlength=10 value="$form->{to}">
+        <input type="button" name="toB" id="trigger_to" value="?"></td>
     </tr>       
     <tr>
      <td colspan=4>
@@ -1180,7 +1177,8 @@ $shipto
 
 </div>
 
-|;
+| . $form->write_trigger(\%myconfig, 2, "fromB", "BL", "trigger_from",
+                         "toB", "BL", "trigger_to");
 
   $lxdebug->leave_sub();
 }
@@ -1245,11 +1243,6 @@ $update_button
       . qq|">\n|;
   }
 
-  if ($form->{menubar}) {
-    require "$form->{path}/menu.pl";
-    &menubar;
-  }
-
   print qq|
 
   </form>
@@ -1378,8 +1371,16 @@ sub save {
   if ($vertreter && $form->{db} eq "customer") {
     $form->isblank("salesman_id", $locale->text("Salesman missing!"));
   }
-  print(STDERR "SHIPTO in sub save $form->{shipto_id}\n");
-  &{"CT::save_$form->{db}"}("", \%myconfig, \%$form);
+
+  my $res = &{"CT::save_$form->{db}"}("", \%myconfig, \%$form);
+
+  if (3 == $res) {
+    if ($form->{"db"} eq "customer") {
+      $form->error($locale->text('This customer number is already in use.'));
+    } else {
+      $form->error($locale->text('This vendor number is already in use.'));
+    }
+  }
 
   &edit;
   exit;