Sicherheitsfix fuer die Umgehung der Anmeldung am Admin-Frotend unter Angabe von...

[kivitendo-erp.git] / bin / mozilla / oe.pl

diff --git a/bin/mozilla/oe.pl b/bin/mozilla/oe.pl
index baa041f..7aa3f2e 100644 (file)
--- a/bin/mozilla/oe.pl
+++ b/bin/mozilla/oe.pl
@@ -30,6 +30,7 @@
 # Order entry module
 # Quotation module
 #======================================================================
+use Data::Dumper;
 
 use SL::OE;
 use SL::IR;
@@ -167,9 +168,21 @@ sub order_links {
   # get customer / vendor
   if ($form->{type} =~ /(purchase_order|request_quotation|receive_order)/) {
     IR->get_vendor(\%myconfig, \%$form);
+
+    #quote all_vendor Bug 133
+    foreach $ref (@{ $form->{all_vendor} }) {
+      $ref->{name} = $form->quote($ref->{name});
+    }
+
   }
   if ($form->{type} =~ /(sales|ship)_(order|quotation)/) {
     IS->get_customer(\%myconfig, \%$form);
+
+    #quote all_vendor Bug 133
+    foreach $ref (@{ $form->{all_customer} }) {
+      $ref->{name} = $form->quote($ref->{name});
+    }
+
   }
   $form->{cp_id} = $cp_id;
 
@@ -330,6 +343,9 @@ sub form_header {
       s/option>\Q$form->{$item}\E/option selected>$form->{$item}/;
   }
 
+  #quote select[customer|vendor] Bug 133
+  $form->{"select$form->{vc}"} = $form->quote($form->{"select$form->{vc}"});
+
   #build contacts
   if ($form->{all_contacts}) {
 
@@ -1738,8 +1754,10 @@ sub save {
 
   }
 
-  $form->{$ordnumber} = $form->update_defaults(\%myconfig, $numberfld)
-    unless $form->{$ordnumber};
+  # get new number in sequence if no number is given or if saveasnew was requested
+  if (!$form->{$ordumber} || $form->{saveasnew}) {
+    $form->{$ordnumber} = $form->update_defaults(\%myconfig, $numberfld);
+  }
 
   $form->redirect(
             $form->{label} . " $form->{$ordnumber} " . $locale->text('saved!'))