Der direkte Zugriff per Webbrowser auf einige Verzeichniss muss verhindert werden.

[kivitendo-erp.git] / bin / mozilla / ir.pl

diff --git a/bin/mozilla/ir.pl b/bin/mozilla/ir.pl
index a9b8aee..466d44b 100644 (file)
--- a/bin/mozilla/ir.pl
+++ b/bin/mozilla/ir.pl
@@ -76,6 +76,11 @@ sub invoice_links {
 
   $form->create_links("AP", \%myconfig, "vendor");
 
+  #quote all_vendor Bug 133
+  foreach $ref (@{ $form->{all_vendor} }) {
+    $ref->{name} = $form->quote($ref->{name});
+  }
+
   if ($form->{all_vendor}) {
     unless ($form->{vendor_id}) {
       $form->{vendor_id} = $form->{all_vendor}->[0]->{id};
@@ -107,7 +112,7 @@ sub invoice_links {
   }
 
   # currencies
-  @curr = split /:/, $form->{currencies};
+  @curr = split(/:/, $form->{currencies});
   chomp $curr[0];
   $form->{defaultcurrency} = $curr[0];
 
@@ -116,7 +121,7 @@ sub invoice_links {
   $form->{oldvendor} = "$form->{vendor}--$form->{vendor_id}";
 
   # vendors
-  if ($form->{all_vendor}) {
+  if (@{ $form->{all_vendor} }) {
     $form->{vendor} = "$form->{vendor}--$form->{vendor_id}";
     map { $form->{selectvendor} .= "<option>$_->{name}--$_->{id}\n" }
       (@{ $form->{all_vendor} });
@@ -184,6 +189,7 @@ sub prepare_invoice {
 
     map { $form->{$_} =~ s/\"/&quot;/g } qw(invnumber ordnumber quonumber);
 
+    my $i = 0;
     foreach $ref (@{ $form->{invoice_details} }) {
       $i++;
       map { $form->{"${_}_$i"} = $ref->{$_} } keys %{$ref};
@@ -219,6 +225,12 @@ sub form_header {
       s/option>\Q$form->{$item}\E/option selected>$form->{$item}/;
   }
 
+  $form->{radier} =
+    ($form->current_date(\%myconfig) eq $form->{gldate}) ? 1 : 0;
+
+  #quote selectvendor Bug 133
+  $form->{"selectvendor"} = $form->quote($form->{"selectvendor"});
+
   $form->{exchangerate} =
     $form->format_amount(\%myconfig, $form->{exchangerate});
 
@@ -267,10 +279,11 @@ sub form_header {
     foreach $item (@{ $form->{TAXZONE} }) {
       if ($item->{id} == $form->{taxzone_id}) {
         $form->{selecttaxzone} .=
-          "<option value=$item->{id} selected>$item->{description}</option>";
+          "<option value=$item->{id} selected>" . H($item->{description}) .
+          "</option>";
       } else {
         $form->{selecttaxzone} .=
-          "<option value=$item->{id}>$item->{description}</option>";
+          "<option value=$item->{id}>" . H($item->{description}) . "</option>";
       }
 
     }
@@ -280,11 +293,6 @@ sub form_header {
       $form->{selecttaxzone} =~ s/value=$form->{taxzone_id}/value=$form->{taxzone_id} selected/;
     }
   }
-  if ($form->{rowcount} >1) {
-    $form->{selecttaxzone} =~ /<option value=\d+ selected>.*?<\/option>/;
-    $form->{selecttaxzone} = $&;
-  }
-  
 
   $taxzone = qq|
              <tr>
@@ -346,6 +354,8 @@ sub form_header {
       qq|<td width="13"><input name=duedate size=11 title="$myconfig{dateformat}" value=$form->{duedate}></td>|;
   }
 
+  $form->{"javascript"} .= qq|<script type="text/javascript" src="js/show_form_details.js"></script>|;
+
   $form->header;
 
   print qq|
@@ -661,6 +671,7 @@ sub form_footer {
        </tr>
 |;
 
+  my @triggers = ();
   $form->{paidaccounts}++ if ($form->{"paid_$form->{paidaccounts}"});
   for $i (1 .. $form->{paidaccounts}) {
 
@@ -673,8 +684,10 @@ sub form_footer {
       s/option>\Q$form->{"AP_paid_$i"}\E/option selected>$form->{"AP_paid_$i"}/;
 
     # format amounts
-    $form->{"paid_$i"} =
-      $form->format_amount(\%myconfig, $form->{"paid_$i"}, 2);
+    if ($form->{"paid_$i"}) {
+      $form->{"paid_$i"} =
+        $form->format_amount(\%myconfig, $form->{"paid_$i"}, 2);
+    }
     $form->{"exchangerate_$i"} =
       $form->format_amount(\%myconfig, $form->{"exchangerate_$i"});
 
@@ -698,7 +711,8 @@ sub form_footer {
     $column_data{"AP_paid_$i"}      =
       qq|<td align=center><select name="AP_paid_$i">$form->{"selectAP_paid_$i"}</select></td>|;
     $column_data{"datepaid_$i"} =
-      qq|<td align=center><input name="datepaid_$i" size=11 title="$myconfig{dateformat}" value=$form->{"datepaid_$i"}></td>|;
+      qq|<td align=center><input name="datepaid_$i" id="datepaid_$i" size=11 title="$myconfig{dateformat}" value=$form->{"datepaid_$i"}>
+         <input type="button" name="datepaid_$i" id="trigger_datepaid_$i" value="?"></td>|;
     $column_data{"source_$i"} =
       qq|<td align=center><input name="source_$i" size=11 value=$form->{"source_$i"}></td>|;
     $column_data{"memo_$i"} =
@@ -709,6 +723,7 @@ sub form_footer {
     print qq|
        </tr>
 |;
+    push(@triggers, "datepaid_$i", "BL", "trigger_datepaid_$i");
   }
 
   print qq|
@@ -735,22 +750,28 @@ sub form_footer {
     print qq|<input class=submit type=submit name=action value="|
       . $locale->text('Storno') . qq|">
 | unless ($form->{storno});
+    if ($form->{radier}) {
+    print qq|
+    <input class=submit type=submit name=action value="|
+      . $locale->text('Delete') . qq|">
+|;
+  }
+    print qq|<input class=submit type=submit name=action value="|
+      . $locale->text('Use As Template') . qq|">
+|;
 
-  } else {
-    if ($invdate > $closedto) {
-      print qq|<input class=submit type=submit name=action value="|
-        . $locale->text('Update') . qq|">
-      <input class=submit type=submit name=action value="|
-        . $locale->text('Post') . qq|">|;
-    }
   }
 
-  if ($form->{menubar}) {
-    require "$form->{path}/menu.pl";
-    &menubar;
+  print qq|<input class=submit type=submit name=action id=update_button value="|
+    . $locale->text('Update') . qq|">|;
+
+  if (!$form->{id} && ($invdate > $closedto)) {
+    print qq| <input class=submit type=submit name=action value="|
+      . $locale->text('Post') . qq|">|;
   }
 
-  print qq|
+  print $form->write_trigger(\%myconfig, scalar(@triggers) / 3, @triggers) .
+    qq|
 
 <input type=hidden name=rowcount value=$form->{rowcount}>
 
@@ -815,8 +836,6 @@ sub update {
 
   } else {
 
-    $form->{"selected_unit_$i"} = $form->{"unit_$i"};
-
     IR->retrieve_item(\%myconfig, \%$form);
 
     my $rows = scalar @{ $form->{item_list} };
@@ -902,13 +921,24 @@ sub storno {
   $form->{storno} = 1;
   $form->{id} = "";
   $form->{invnumber} = "Storno zu " . $form->{invnumber};
-  $form->{rowcount}--;
 
   &post();
   $lxdebug->leave_sub();
 
 }
 
+sub use_as_template {
+  $lxdebug->enter_sub();
+
+  map { delete $form->{$_} } qw(printed emailed queued invnumber invdate deliverydate id datepaid_1 source_1 memo_1 paid_1 exchangerate_1 AP_paid_1 storno);
+  $form->{paidaccounts} = 1;
+  $form->{rowcount}--;
+  $form->{invdate} = $form->current_date(\%myconfig);
+  &display_form;
+
+  $lxdebug->leave_sub();
+}
+
 sub post_payment {
   $lxdebug->enter_sub();
   for $i (1 .. $form->{paidaccounts}) {
@@ -985,6 +1015,8 @@ sub post {
 
   $form->{id} = 0 if $form->{postasnew};
 
+
+  relink_accounts();
   $form->redirect(  $locale->text('Invoice')
                   . " $form->{invnumber} "
                   . $locale->text('posted!'))