Umstellung der Benutzerverwaltung von Dateien im Verzeichnis "users" auf die Verwendu...
[kivitendo-erp.git] / bin / mozilla / oe.pl
index f095c5f..de1722e 100644 (file)
@@ -1,4 +1,4 @@
-# #=====================================================================
+#=====================================================================
 # LX-Office ERP
 # Copyright (C) 2004
 # Based on SQL-Ledger Version 2.1.9
@@ -38,7 +38,7 @@ use SL::IR;
 use SL::IS;
 use SL::PE;
 use SL::ReportGenerator;
-use List::Util qw(max);
+use List::Util qw(max reduce);
 
 require "bin/mozilla/io.pl";
 require "bin/mozilla/arap.pl";
@@ -59,9 +59,25 @@ require "bin/mozilla/reportgenerator.pl";
 # $locale->text('Workflow request_quotation');
 # $locale->text('Workflow sales_quotation');
 
+my $oe_access_map = {
+  'sales_order'       => 'sales_order_edit',
+  'purchase_order'    => 'purchase_order_edit',
+  'request_quotation' => 'request_quotation_edit',
+  'sales_quotation'   => 'sales_quotation_edit',
+};
+
+sub check_oe_access {
+  my $right   = $oe_access_map->{$form->{type}};
+  $right    ||= 'DOES_NOT_EXIST';
+
+  $auth->assert($right);
+}
+
 sub set_headings {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   my ($action) = @_;
 
   if ($form->{type} eq 'purchase_order') {
@@ -99,10 +115,12 @@ sub set_headings {
 sub add {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   set_headings("add");
 
   $form->{callback} =
-    "$form->{script}?action=add&type=$form->{type}&vc=$form->{vc}&login=$form->{login}&password=$form->{password}"
+    "$form->{script}?action=add&type=$form->{type}&vc=$form->{vc}"
     unless $form->{callback};
 
   &order_links;
@@ -114,6 +132,9 @@ sub add {
 
 sub edit {
   $lxdebug->enter_sub();
+
+  check_oe_access();
+
   # show history button
   $form->{javascript} = qq|<script type="text/javascript" src="js/show_history.js"></script>|;
   #/show hhistory button
@@ -161,9 +182,11 @@ sub edit {
 
 sub order_links {
   $lxdebug->enter_sub();
+
+  check_oe_access();
+
   # get customer/vendor
-  $form->all_vc(\%myconfig, $form->{vc},
-                ($form->{vc} eq 'customer') ? "AR" : "AP");
+  $form->all_vc(\%myconfig, $form->{vc}, ($form->{vc} eq 'customer') ? "AR" : "AP");
 
   # retrieve order/quotation
   $form->{webdav}   = $webdav;
@@ -245,8 +268,7 @@ sub order_links {
   }
   $form->{intnotes} = $intnotes if $intnotes;
   ($form->{ $form->{vc} }) = split /--/, $form->{ $form->{vc} };
-  $form->{"old$form->{vc}"} =
-    qq|$form->{$form->{vc}}--$form->{"$form->{vc}_id"}|;
+  $form->{"old$form->{vc}"} = qq|$form->{$form->{vc}}--$form->{"$form->{vc}_id"}|;
 
   # build the popup menus
   if (@{ $form->{"all_$form->{vc}"} }) {
@@ -265,9 +287,8 @@ sub order_links {
     $form->{department}       = "$form->{department}--$form->{department_id}";
 
     map {
-      $form->{selectdepartment} .=
-        "<option>$_->{description}--$_->{id}</option>\n"
-    } (@{ $form->{all_departments} });
+      $form->{selectdepartment} .= "<option>$_->{description}--$_->{id}</option>\n"
+    } @{ $form->{all_departments} };
   }
 
   $form->{employee} = "$form->{employee}--$form->{employee_id}";
@@ -282,41 +303,22 @@ sub order_links {
 
 sub prepare_order {
   $lxdebug->enter_sub();
+
+  check_oe_access();
+
   $form->{formname} = $form->{type} unless $form->{formname};
 
   my $i = 0;
   foreach $ref (@{ $form->{form_details} }) {
     $form->{rowcount} = ++$i;
-
     map { $form->{"${_}_$i"} = $ref->{$_} } keys %{$ref};
   }
   for my $i (1 .. $form->{rowcount}) {
-    if ($form->{id}) {
-      $form->{"discount_$i"} =
-        $form->format_amount(\%myconfig, $form->{"discount_$i"} * 100);
-    } else {
-      $form->{"discount_$i"} =
-        $form->format_amount(\%myconfig, $form->{"discount_$i"});
-    }
-    ($dec) = ($form->{"sellprice_$i"} =~ /\.(\d+)/);
-    $dec           = length $dec;
-    $decimalplaces = ($dec > 2) ? $dec : 2;
-
-    # copy reqdate from deliverydate for invoice -> order conversion
-    $form->{"reqdate_$i"} = $form->{"deliverydate_$i"}
-      unless $form->{"reqdate_$i"};
-
-    $form->{"sellprice_$i"} =
-      $form->format_amount(\%myconfig, $form->{"sellprice_$i"},
-                           $decimalplaces);
-
-    (my $dec_qty) = ($form->{"qty_$i"} =~ /\.(\d+)/);
-    $dec_qty = length $dec_qty;
-    $form->{"qty_$i"} =
-      $form->format_amount(\%myconfig, $form->{"qty_$i"}, $dec_qty);
-
-    map { $form->{"${_}_$i"} =~ s/\"/&quot;/g }
-      qw(partnumber description unit);
+    $form->{"reqdate_$i"}   = $form->{"deliverydate_$i"} unless $form->{"reqdate_$i"};
+    $form->{"discount_$i"}  = $form->format_amount(\%myconfig, $form->{"discount_$i"} * ($form->{id} ? 100 : 1));
+    $form->{"sellprice_$i"} = $form->format_amount(\%myconfig, $form->{"sellprice_$i"});
+    $form->{"qty_$i"}       = $form->format_amount(\%myconfig, $form->{"qty_$i"});
+    map { $form->{"${_}_$i"} =~ s/\"/&quot;/g } qw(partnumber description unit);
   }
 
   $lxdebug->leave_sub();
@@ -324,9 +326,12 @@ sub prepare_order {
 
 sub form_header {
   $lxdebug->enter_sub();
+  my @custom_hiddens;
+
+  check_oe_access();
 
-  my $checkedclosed    = $form->{"closed"}    ? "checked" : "";
-  my $checkeddelivered = $form->{"delivered"} ? "checked" : "";
+  # Container for template variables. Unfortunately this has to be visible in form_footer too, so not my.
+  our %TMPL_VAR = ();
 
   $form->{employee_id} = $form->{old_employee_id} if $form->{old_employee_id};
   $form->{salesman_id} = $form->{old_salesman_id} if $form->{old_salesman_id};
@@ -336,51 +341,34 @@ sub form_header {
   $form->{employee_id} = $form->{old_employee_id} if $form->{old_employee_id};
   $form->{salesman_id} = $form->{old_salesman_id} if $form->{old_salesman_id};
 
-  map { $form->{$_} =~ s/\"/&quot;/g }
-    qw(ordnumber quonumber shippingpoint shipvia notes intnotes shiptoname
+  map { $form->{$_} = H($form->{$_}) }
+    qw(shippingpoint shipvia notes intnotes shiptoname
        shiptostreet shiptozipcode shiptocity shiptocountry shiptocontact
        shiptophone shiptofax shiptodepartment_1 shiptodepartment_2);
-
   # use JavaScript Calendar or not
   $form->{jsscript} = 1;
-  $jsscript = "";
-
-  $button1 = qq|
-     <td><input name=transdate id=transdate size=11 title="$myconfig{dateformat}" value="$form->{transdate}" onBlur=\"check_right_date_format(this)\">
-      <input type=button name=transdate id="trigger1" value=|
-    . $locale->text('button') . qq|></td>
+  $TMPL_VAR{button1} = qq|
+     <td nowrap><input name=transdate id=transdate size=11 title="$myconfig{dateformat}" value="$form->{transdate}" onBlur=\"check_right_date_format(this)\">
+      <input type=button name=transdate id="trigger1" value=| . $locale->text('button') . qq|></td>
     |;
-  $button2 = qq|
-     <td width="13"><input name=reqdate id=reqdate size=11 title="$myconfig{dateformat}" value="$form->{reqdate}" onBlur=\"check_right_date_format(this)\">
-      <input type=button name=reqdate name=reqdate id="trigger2" value=|
-    . $locale->text('button') . qq|></td>
+  $TMPL_VAR{button2} = qq|
+     <td nowrap width="13"><input name=reqdate id=reqdate size=11 title="$myconfig{dateformat}" value="$form->{reqdate}" onBlur=\"check_right_date_format(this)\">
+      <input type=button name=reqdate name=reqdate id="trigger2" value=| . $locale->text('button') . qq|></td>
    |;
-
   #write Trigger
-  $jsscript = Form->write_trigger(\%myconfig, "2", "transdate", "BL", "trigger1", "reqdate", "BL", "trigger2");
+  $TMPL_VAR{jsscript} = Form->write_trigger(\%myconfig, "2", "transdate", "BL", "trigger1", "reqdate", "BL", "trigger2");
 
+  # openclosed checkboxes
   my @tmp;
-
-  if (($form->{"type"} eq "sales_order") ||
-      ($form->{"type"} eq "purchase_order")) {
-    push(@tmp, qq|<input name="delivered" id="delivered" type="checkbox" class="checkbox" value="1" $checkeddelivered>
-                  <label for="delivered">| . $locale->text('Delivered') . qq|</label>|);
-  }
-
-  if ($form->{id}) {
-    push(@tmp, qq|<input name="closed" id="closed" type="checkbox" class="checkbox" value="1" $checkedclosed>
-                  <label for="closed">| . $locale->text('Closed') . qq|</label>|);
-  }
-
-  if (@tmp) {
-    $openclosed .= qq|<tr>
-                        <td colspan=| . (2 * scalar(@tmp)) . qq| align=center>| . join("\n", @tmp) . qq|
-                        </td>
-                      </tr>\n|;
-  }
+  push @tmp, sprintf qq|<input name="delivered" id="delivered" type="checkbox" class="checkbox" value="1" %s><label for="delivered">%s</label>|,
+                        $form->{"delivered"} ? "checked" : "",  $locale->text('Delivered') if $form->{"type"} =~ /_order$/;
+  push @tmp, sprintf qq|<input name="closed" id="closed" type="checkbox" class="checkbox" value="1" %s><label for="closed">%s</label>|,
+                        $form->{"closed"}    ? "checked" : "",  $locale->text('Closed')    if $form->{id};
+  $TMPL_VAR{openclosed} = sprintf qq|<tr><td colspan=%d align=center>%s</td></tr>\n|, 2 * scalar @tmp, join "\n", @tmp if @tmp;
 
   # set option selected
-  foreach $item ($form->{vc}, currency, department, ($form->{vc} eq "customer" ? customer : vendor)) {
+  foreach $item ($form->{vc}, 'currency', 'department', ($form->{vc} eq "customer" ? 'customer' : 'vendor')) {
     $form->{"select$item"} =~ s/ selected//;
     $form->{"select$item"} =~ s/option>\Q$form->{$item}\E/option selected>$form->{$item}/;
   }
@@ -391,307 +379,55 @@ sub form_header {
   #substitute \n and \r to \s (bug 543)
   $form->{"select$form->{vc}"} =~ s/[\n\r]/&nbsp;/g;
   
-  my @old_project_ids = ($form->{"globalproject_id"});
-  map({ push(@old_project_ids, $form->{"project_id_$_"})
-          if ($form->{"project_id_$_"}); } (1..$form->{"rowcount"}));
+  my @old_project_ids = ($form->{"globalproject_id"}, grep { $_ } map { $form->{"project_id_$_"} } 1..$form->{"rowcount"});
 
   my $vc = $form->{vc} eq "customer" ? "customers" : "vendors";
-  $form->get_lists("contacts"   => "ALL_CONTACTS",
-                   "shipto"     => "ALL_SHIPTO",
-                   "projects"   => {
-                     "key"      => "ALL_PROJECTS",
-                     "all"      => 0,
-                     "old_id"   => \@old_project_ids
-                   },
+  $form->get_lists("contacts"      => "ALL_CONTACTS",
+                   "shipto"        => "ALL_SHIPTO",
+                   "projects"      => { "key"      => "ALL_PROJECTS",
+                                        "all"      => 0,
+                                        "old_id"   => \@old_project_ids },
                    "employees"     => "ALL_EMPLOYEES",
                    "salesmen"      => "ALL_SALESMEN",
                    "taxzones"      => "ALL_TAXZONES",
                    "payments"      => "ALL_PAYMENTS",
                    "currencies"    => "ALL_CURRENCIES",
-                   $vc             => "ALL_" . uc($vc),
+                   $vc             => { key   => "ALL_" . uc($vc),
+                                        limit => $myconfig{vclimit} + 1 },
                    "price_factors" => "ALL_PRICE_FACTORS");
 
-  my %labels;
-  my @values = (undef);
-  foreach my $item (@{ $form->{"ALL_CONTACTS"} }) {
-    push(@values, $item->{"cp_id"});
-    $labels{$item->{"cp_id"}} = $item->{"cp_name"} . ($item->{"cp_abteilung"} ? " ($item->{cp_abteilung})" : "");
-  }
-
-  my $contact;
-  if (scalar @values > 1) {
-    $contact = qq|
-    <tr>
-      <th align="right">| . $locale->text('Contact Person') . qq|</th>
-      <td>| .
-      NTI($cgi->popup_menu('-name' => 'cp_id', '-values' => \@values, '-style' => 'width: 250px',
-                           '-labels' => \%labels, '-default' => $form->{"cp_id"}))
-      . qq|
-      </td>
-    </tr>|;
-  }
-
-  %labels = ();
-  @values = ();
-
-  foreach my $item (@{ $form->{($form->{vc} eq "customer" ? "ALL_CUSTOMERS" : "ALL_VENDORS")}}) {
-    push(@values, $item->{"name"}.qq|--|.$item->{"id"});
-    $labels{$item->{"name"}.qq|--|.$item->{"id"}} = $item->{name};
-  }
-
-  $vc = qq|
-      <input type="hidden" name="$form->{vc}_id" value="| . H($form->{"$form->{vc}_id"}) . qq|">
-      <input type="hidden" name="old$form->{vc}" value="| . H($form->{"old$form->{vc}"}) . qq|">
-      <th align="right">| . $locale->text(ucfirst($form->{vc})) . qq|</th>
-      <td>| . 
-        (($myconfig{vclimit} <=  scalar(@values)) 
-              ? qq|<input type="text" value="| . H(($form->{"old$form->{vc}"} =~ /^(.*)\-\-.*$/)) . qq|" name="$form->{vc}">| 
-              : (NTI($cgi->popup_menu('-name' => "$form->{vc}", '-default' => $form->{"old$form->{vc}"}, 
-                             '-onChange' => 'document.getElementById(\'update_button\').click();',
-                             '-values' => \@values, '-labels' => \%labels, '-style' => 'width: 250px')))) . qq|
-        <input type="button" value="?" onclick="show_vc_details('$form->{vc}')">
-      </td><input type=hidden name="select$form->{vc}" value="| .
-    Q($form->{"select$form->{vc}"}) . qq|">|;
-
-  %labels = ();
-  @values = ("");
-  foreach my $item (@{ $form->{"ALL_PAYMENTS"} }) {
-    push(@values, $item->{"id"});
-    $labels{$item->{"id"}} = $item->{"description"};
-  }
-  
-  $payments = qq|
-    <th align="right">| . $locale->text('Payment Terms') . qq|</th>
-    <td>| .
-    NTI($cgi->popup_menu('-name' => 'payment_id', '-values' => \@values, '-style' => 'width: 250px',
-                         '-labels' => \%labels, '-default' => $form->{payment_id}))
-    . qq|</td>|;
-
-  %labels = ();
-  @values = ("");
-  foreach my $item (@{ $form->{"ALL_SHIPTO"} }) {
-    push(@values, $item->{"shipto_id"});
-    $labels{$item->{"shipto_id"}} = join "; ", grep { $_ } map { $item->{"shipto${_}" } } qw(name department_1 street city);
-  }
-
-  my $shipto;
-  if (scalar @values > 1) {
-    $shipto = qq|
-    <tr>
-      <th align="right">| . $locale->text('Shipping Address') . qq|</th>
-      <td>| .
-      NTI($cgi->popup_menu('-name' => 'shipto_id', '-values' => \@values, '-style' => 'width: 250px',
-                           '-labels' => \%labels, '-default' => $form->{"shipto_id"}))
-    . qq|</td>|;
-  }
-
-  %labels = ();
-  @values = ("");
-  foreach my $item (@{ $form->{"ALL_PROJECTS"} }) {
-    push(@values, $item->{"id"});
-    $labels{$item->{"id"}} = $item->{"projectnumber"};
-  }
-  my $globalprojectnumber = NTI($cgi->popup_menu('-name' => 'globalproject_id', '-values' => \@values,
-                                                 '-labels' => \%labels,
-                                                 '-default' => $form->{"globalproject_id"}));
-  
-  my $salesmen = "";
-  %labels = ();
-  @values = ();
-  if ($form->{type} =~ /^sales_/) {
-    foreach my $item (@{ $form->{"ALL_SALESMEN"} }) {
-      push(@values, $item->{"id"});
-      $labels{$item->{"id"}} = ($item->{"name"} ne "" ? $item->{"name"} : $item->{"login"});
-    }
-    $salesmen =
-      qq|<tr>
-          <th align="right">| . $locale->text('Salesman') . qq|</th>
-          <td>| .
-      NTI($cgi->popup_menu('-name' => 'salesman_id', '-default' => $form->{"salesman_id"} ? $form->{"salesman_id"} : $form->{"employee_id"},
-                           '-values' => \@values, '-labels' => \%labels))
-      . qq|</td>
-         </tr>|;
-  }
-
-  %labels = ();
-  @values = ();
-  foreach my $item (@{ $form->{"ALL_EMPLOYEES"} }) {
-    push(@values, $item->{"id"});
-    $labels{$item->{"id"}} = $item->{"name"} ne "" ? $item->{"name"} : $item->{"login"};
-  }
-
-  my $employee = qq|
-    <tr>
-      <th align="right">| . $locale->text('Employee') . qq|</th>
-      <td>| .
-        NTI($cgi->popup_menu('-name' => 'employee_id', '-default' => $form->{"employee_id"},
-                             '-values' => \@values, '-labels' => \%labels)) . qq|
-      </td>
-    </tr>|;
-
-  %labels = ();
-  @values = ();
-  foreach my $item (@{ $form->{"ALL_TAXZONES"} }) {
-    push(@values, $item->{"id"});
-    $labels{$item->{"id"}} = $item->{"description"};
-  }
-
-  $taxzone = qq|
-    <tr>
-      <th align="right">| . $locale->text('Steuersatz') . qq|</th>
-      <td>| .
-        NTI($cgi->popup_menu('-name' => 'taxzone_id', '-default' => $form->{"taxzone_id"},
-                             '-values' => \@values, '-labels' => \%labels, '-style' => 'width: 250px')) . qq|
-      </td>
-    </tr>|;
-
-  %labels = ();
-  @values = ();
-  my $i = 0;
-  foreach my $item (@{ $form->{"ALL_CURRENCIES"} }) {
-    push(@values, $item);
-    $labels{$item} = $item;
-  }
-
-  $form->{currency} = $form->{defaultcurrency} unless $form->{currency};
-  my $currencies;
-  if (scalar @values) {
-    $currencies = qq|
-    <tr>
-      <th align="right">| . $locale->text('Currency') . qq|</th>
-      <td>| .
-        NTI($cgi->popup_menu('-name' => 'currency', '-default' => $form->{"currency"},
-                             '-values' => \@values, '-labels' => \%labels)) . qq|
-      </td>
-    </tr>|;
-  }
-
-  $form->{exchangerate} = $form->format_amount(\%myconfig, $form->{exchangerate});
-  $form->{exchangerate} = "" unless $form->{exchangerate};
-
+  # label subs
+  $TMPL_VAR{sales_employee_labels} = sub { $_[0]->{name} || $_[0]->{login} };
+  $TMPL_VAR{shipto_labels} = sub { join "; ", grep { $_ } map { $_[0]->{"shipto${_}" } } qw(name department_1 street city) };
+  $TMPL_VAR{contact_labels} = sub { $_[0]->{"cp_name"} . ($_[0]->{cp_abteilung} ? " ($_[0]->{cp_abteilung})" : "") };
+
+  # vendor/customer
+  $TMPL_VAR{vc_keys} = sub { "$_[0]->{name}--$_[0]->{id}" };
+  $TMPL_VAR{vclimit} = $myconfig{vclimit};
+  $TMPL_VAR{vc_select} = "customer_or_vendor_selection_window('$form->{vc}', '', @{[ $form->{vc} eq 'vendor' ? 1 : 0 ]}, 0)";
+  push @custom_hiddens, "$form->{vc}_id";
+  push @custom_hiddens, "old$form->{vc}";
+  push @custom_hiddens, "select$form->{vc}";
+
+  # currencies and exchangerate
+  @values = map { $_ } @{ $form->{ALL_CURRENCIES} };
+  %labels = map { $_ => $_ } @{ $form->{ALL_CURRENCIES} };
+  $form->{currency}            = $form->{defaultcurrency} unless $form->{currency};
+  $TMPL_VAR{show_exchangerate} = $form->{currency} ne $form->{defaultcurrency} && $form->{exchangerate};
+  $TMPL_VAR{currencies}        = NTI($cgi->popup_menu('-name' => 'currency', '-default' => $form->{"currency"},
+                                                      '-values' => \@values, '-labels' => \%labels)) if scalar @values;
+  push @custom_hiddens, "forex";
+  push @custom_hiddens, "exchangerate" if $form->{forex};
+
+  # credit remaining
   $creditwarning = (($form->{creditlimit} != 0) && ($form->{creditremaining} < 0) && !$form->{update}) ? 1 : 0;
+  $TMPL_VAR{is_credit_remaining_negativ} = ($form->{creditremaining} =~ /-/) ? "0" : "1";
+  
+  # business
+  $TMPL_VAR{business_label} = ($form->{vc} eq "customer" ? $locale->text('Customer type') : $locale->text('Vendor type'));
 
-  $form->{creditlimit}     = $form->format_amount(\%myconfig, $form->{creditlimit}, 0, "0");
-  $form->{creditremaining} = $form->format_amount(\%myconfig, $form->{creditremaining}, 0, "0");
-
-  $exchangerate = qq|\n<input type=hidden name=forex value=$form->{forex}>\n|;
-
-  if ($form->{currency} ne $form->{defaultcurrency}) {
-    if ($form->{forex}) {
-      $exchangerate .=
-          qq|<th align=right>| . $locale->text('Exchangerate')
-        . qq|</th><td>$form->{exchangerate}</td>
-      <input type=hidden name=exchangerate value=$form->{exchangerate}>
-|;
-    } else {
-      $exchangerate .=
-          qq|<th align=right>| . $locale->text('Exchangerate')
-        . qq|</th><td><input name=exchangerate size=10 value=$form->{exchangerate}></td>|;
-    }
-  }
-
-  if ($form->{business}) {
-    $business = qq|
-             <tr>
-          <th align="right">| . ($form->{vc} eq "customer" ? $locale->text('Customer type') : $locale->text('Vendor type')) . qq|</th>
-          <td>$form->{business}; | . $locale->text('Trade Discount') . qq| |
-      . $form->format_amount(\%myconfig, $form->{tradediscount} * 100)
-      . qq| %</td>
-        </tr>
-|;
-  }
-
-  if ($form->{max_dunning_level}) {
-    $dunning = qq|
-      <tr>
-        <th align="right">| . $locale->text('Max. Dunning Level') . qq|:</th>
-        <td>
-          <b>$form->{max_dunning_level}</b>;
-          | . $locale->text('Dunning Amount') . qq|: <b>|
-        . $form->format_amount(\%myconfig, $form->{dunning_amount},2)
-        . qq|</b>
-        </td>
-      </tr>
-|;
-  }
-
-  if ($form->{type} !~ /_quotation$/) {
-    $ordnumber = qq|
-             <tr>
-               <th width=70% align=right nowrap>| . $locale->text('Order Number') . qq|</th>
-                <td><input name=ordnumber size=11 value="$form->{ordnumber}"></td>
-             </tr>
-             <tr>
-               <th width=70% align=right nowrap>|
-      . $locale->text('Quotation Number') . qq|</th>
-                <td><input name=quonumber size=11 value="$form->{quonumber}"></td>
-             </tr>
-              <tr>
-               <th width=70% align=right nowrap>|
-      . $locale->text('Customer Order Number') . qq|</th>
-                <td><input name=cusordnumber size=11 value="$form->{cusordnumber}"></td>
-             </tr>
-             <tr>
-               <th align=right nowrap>| . $locale->text('Order Date') . qq|</th>
-                $button1
-
-             </tr>
-             <tr>
-               <th align=right nowrap=true>| . $locale->text('Required by') . qq|</th>
-                $button2
-             </tr>
-|;
-
-    $n = ($form->{creditremaining} =~ /-/) ? "0" : "1";
-
-    $creditremaining = qq|
-        $shipto
-        <tr>
-          <td align="right">| . $locale->text('Credit Limit') . qq|</td>
-          <td>$form->{creditlimit}; | . $locale->text('Remaining') . qq| <span class="plus$n">$form->{creditremaining}</span></td>
-        </tr>
-             </tr>
-|;
-  } else {
-    $reqlabel = ($form->{type} eq 'sales_quotation') ? $locale->text('Valid until') : $locale->text('Required by');
-    if ($form->{type} eq 'sales_quotation') {
-      $ordnumber = qq|
-             <tr>
-               <th width=70% align=right nowrap>|
-        . $locale->text('Quotation Number') . qq|</th>
-               <td><input name=quonumber size=11 value="$form->{quonumber}"></td>
-               <input type=hidden name=ordnumber value="$form->{ordnumber}">
-             </tr>
-|;
-    } else {
-      $ordnumber = qq|
-             <tr>
-               <th width=70% align=right nowrap>| . $locale->text('RFQ Number') . qq|</th>
-               <td><input name=quonumber size=11 value="$form->{quonumber}"></td>
-               <input type=hidden name=ordnumber value="$form->{ordnumber}">
-             </tr>
-|;
-
-    }
-
-    $ordnumber      .= qq| <tr> <th align=right nowrap>| . $locale->text('Quotation Date') . qq|</th> $button1 </tr>
-                           <tr> <th align=right nowrap=true>$reqlabel</th> $button2 </tr>\n|;
-    $creditremaining = qq| <tr> <td colspan=4></td> $shipto </tr>|;
-  }
-
-  $department = qq|
-              <tr>
-               <th align="right" nowrap>| . $locale->text('Department') . qq|</th>
-               <td colspan=3><select name=department style="width: 250px">$form->{selectdepartment}</select>
-               <input type=hidden name=selectdepartment value="$form->{selectdepartment}">
-               </td>
-             </tr> | if $form->{selectdepartment};
-
-  if ($form->{type} eq 'sales_order') {
-    $employee .= qq|\n<input type="hidden" name="customer_klass" value="$form->{customer_klass}">| if $form->{selectemployee};
-  } else {
-    $employee .= qq|\n<input type="hidden" name="customer_klass" value="$form->{customer_klass}">|;
-  }
+  push @custom_hiddens, "ordnumber"      if $form->{type} =~ /_quotation$/;
+  push @custom_hiddens, "customer_klass" if $form->{vc} eq 'customer';
 
   $credittext = $locale->text('Credit Limit exceeded!!!');
 
@@ -702,6 +438,7 @@ sub form_header {
 
   $onload .= qq|;setupDateFormat('|. $myconfig{dateformat} .qq|', '|. $locale->text("Falsches Datumsformat!") .qq|')|;
   $onload .= qq|;setupPoints('|.   $myconfig{numberformat} .qq|', '|. $locale->text("wrongformat") .qq|')|;
+  $TMPL_VAR{onload} = $onload;
   
   $form->{javascript} .= qq|<script type="text/javascript" src="js/show_form_details.js"></script>|;
   $form->{javascript} .= qq|<script type="text/javascript" src="js/show_history.js"></script>|;
@@ -709,103 +446,27 @@ sub form_header {
 
   $form->header;
 
-  print qq|
-<body onLoad="$onload">
-
-<form method=post name=oe action=$form->{script}>
-
- <script type="text/javascript" src="js/common.js"></script>
- <script type="text/javascript" src="js/delivery_customer_selection.js"></script>
- <script type="text/javascript" src="js/vendor_selection.js"></script>
- <script type="text/javascript" src="js/calculate_qty.js"></script>
-|;
-
-  $form->hide_form(qw(id action type vc formname media format proforma queued printed emailed
-                      title discount creditlimit creditremaining tradediscount business
-                      max_dunning_level dunning_amount shiptoname shiptostreet shiptozipcode
-                      shiptocity shiptocountry shiptocontact shiptophone shiptofax 
-                      shiptodepartment_1 shiptodepartment_2 shiptoemail 
-                      message email subject cc bcc taxpart taxservice taxaccounts), 
-                      map { $_.'_rate', $_.'_description' } split / /, $form->{taxaccounts} );
-  print qq|
-
-<table width=100%>
-  <tr class=listtop>
-    <th class=listtop>$form->{title}</th>
-  </tr>
-  <tr height="5"></tr>
-  <tr>
-    <td>
-      <table width="100%">
-        <tr valign=top>
-         <td>
-           <table width=100%>
-             <tr>
-        $vc
-        $contact
-             $creditremaining
-             $business
-              $dunning
-              $taxzone
-             $department
-             <tr>
-               $currencies
-               $exchangerate
-             </tr>
-             <tr>
-               <th align=right>| . $locale->text('Shipping Point') . qq|</th>
-               <td colspan=3><input name=shippingpoint size=35 value="$form->{shippingpoint}"></td>
-             </tr>
-             <tr>
-               <th align=right>| . $locale->text('Ship via') . qq|</th>
-               <td colspan=3><input name=shipvia size=35 value="$form->{shipvia}"></td>
-             </tr>
-              <tr>
-                <th align="right">| . $locale->text('Transaction description') . qq|</th>
-                <td colspan="3"><input name="transaction_description" size="35" value="| . H($form->{transaction_description}) . qq|"></td>
-              </tr>|;
-#              <tr>
-#                 <td colspan=4>
-#                   <table>
-#                     <tr>
-#                       <td colspan=2>
-#                         <button type="button" onclick="delivery_customer_selection_window('delivery_customer_string','delivery_customer_id')">| . $locale->text('Choose Customer') . qq|</button>
-#                       </td>
-#                       <td colspan=2><input type=hidden name=delivery_customer_id value="$form->{delivery_customer_id}">
-#                       <input size=45 id=delivery_customer_string name=delivery_customer_string value="$form->{delivery_customer_string}"></td>
-#                     </tr>
-#                     <tr>
-#                       <td colspan=2>
-#                         <button type="button" onclick="vendor_selection_window('delivery_vendor_string','delivery_vendor_id')">| . $locale->text('Choose Vendor') . qq|</button>
-#                       </td>
-#                       <td colspan=2><input type=hidden name=delivery_vendor_id value="$form->{delivery_vendor_id}">
-#                       <input size=45 id=vendor_string name=delivery_vendor_string value="$form->{delivery_vendor_string}"></td>
-#                     </tr>
-#                   </table>
-#                 </td>
-#               </tr>
-print qq|          </table>
-         </td>
-         <td align=right>
-           <table>
-             $openclosed
-             $employee
-        $salesmen
-             $ordnumber
-             <tr>
-          <th width="70%" align="right" nowrap>| . $locale->text('Project Number') . qq|</th>
-          <td>$globalprojectnumber</td>
-             </tr>
-           </table>
-         </td>
-       </tr>
-      </table>
-    </td>
-  </tr>
-
-$jsscript
+  $TMPL_VAR{HIDDENS} = [ map { name => $_, value => $form->{$_} },
+     qw(id action type vc formname media format proforma queued printed emailed
+        title creditlimit creditremaining tradediscount business
+        max_dunning_level dunning_amount shiptoname shiptostreet shiptozipcode
+        shiptocity shiptocountry shiptocontact shiptophone shiptofax
+        shiptodepartment_1 shiptodepartment_2 shiptoemail
+        message email subject cc bcc taxpart taxservice taxaccounts),
+        @custom_hiddens,
+        map { $_.'_rate', $_.'_description' } split / /, $form->{taxaccounts} ];  # deleted: discount
+
+  %TMPL_VAR = (
+     %TMPL_VAR,
+     is_sales        => scalar ($form->{type} =~ /^sales_/),              # these vars are exported, so that the template
+     is_order        => scalar ($form->{type} =~ /_order$/),              # may determine what to show
+     is_sales_quo    => scalar ($form->{type} =~ /sales_quotation$/),
+     is_req_quo      => scalar ($form->{type} =~ /request_quotation$/),
+     is_sales_ord    => scalar ($form->{type} =~ /sales_order$/),
+     is_pur_ord      => scalar ($form->{type} =~ /purchase_order$/),
+  );
 
-|;
+  print $form->parse_html_template("oe/orders_header", { %TMPL_VAR });
 
   $lxdebug->leave_sub();
 }
@@ -813,300 +474,78 @@ $jsscript
 sub form_footer {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{invtotal} = $form->{invsubtotal};
 
-  if (($rows = $form->numtextrows($form->{notes}, 25, 8)) < 2) {
-    $rows = 2;
-  }
-  if (($introws = $form->numtextrows($form->{intnotes}, 35, 8)) < 2) {
-    $introws = 2;
-  }
-  $rows = ($rows > $introws) ? $rows : $introws;
-  $notes =
-    qq|<textarea name=notes rows=$rows cols=25 wrap=soft>$form->{notes}</textarea>|;
-  $intnotes =
-    qq|<textarea name=intnotes rows=$rows cols=35 wrap=soft>$form->{intnotes}</textarea>|;
+  $rows    = max 2, $form->numtextrows($form->{notes}, 25, 8);
+  $introws = max 2, $form->numtextrows($form->{intnotes}, 35, 8);
+  $rows    = max $rows, $introws;
 
-  $form->{taxincluded} = ($form->{taxincluded}) ? "checked" : "";
-
-  $taxincluded = "";
-  if ($form->{taxaccounts}) {
-    $taxincluded = qq|
-             <input name=taxincluded class=checkbox type=checkbox value=1 $form->{taxincluded}> <b>|
-      . $locale->text('Tax Included') . qq|</b><br><br>
-|;
-  }
+  $TMPL_VAR{notes} = qq|<textarea name=notes rows=$rows cols=25 wrap=soft>$form->{notes}</textarea>|;
+  $TMPL_VAR{intnotes} = qq|<textarea name=intnotes rows=$rows cols=35 wrap=soft>$form->{intnotes}</textarea>|;
 
   if (!$form->{taxincluded}) {
 
     foreach $item (split / /, $form->{taxaccounts}) {
       if ($form->{"${item}_base"}) {
-        $form->{invtotal} += $form->{"${item}_total"} =
-          $form->round_amount(
-                             $form->{"${item}_base"} * $form->{"${item}_rate"},
-                             2);
-        $form->{"${item}_total"} =
-          $form->format_amount(\%myconfig, $form->{"${item}_total"}, 2);
-
-        $tax .= qq|
+        $form->{invtotal} += $form->{"${item}_total"} = $form->round_amount( $form->{"${item}_base"} * $form->{"${item}_rate"}, 2);
+        $form->{"${item}_total"} = $form->format_amount(\%myconfig, $form->{"${item}_total"}, 2);
+
+        $TMPL_VAR{tax} .= qq|
              <tr>
-               <th align=right>$form->{"${item}_description"}&nbsp;|
-                                   . $form->{"${item}_rate"} * 100 .qq|%</th>
+               <th align=right>$form->{"${item}_description"}&nbsp;| . $form->{"${item}_rate"} * 100 .qq|%</th>
                <td align=right>$form->{"${item}_total"}</td>
-             </tr>
-|;
+             </tr> |;
       }
     }
 
-    $form->{invsubtotal} =
-      $form->format_amount(\%myconfig, $form->{invsubtotal}, 2, 0);
-
-    $subtotal = qq|
-             <tr>
-               <th align=right>| . $locale->text('Subtotal') . qq|</th>
-               <td align=right>$form->{invsubtotal}</td>
-             </tr>
-|;
+    $form->{invsubtotal} = $form->format_amount(\%myconfig, $form->{invsubtotal}, 2, 0);
 
-  }
-
-  if ($form->{taxincluded}) {
+  } else {
     foreach $item (split / /, $form->{taxaccounts}) {
       if ($form->{"${item}_base"}) {
-        $form->{"${item}_total"} =
-          $form->round_amount(
-                           ($form->{"${item}_base"} * $form->{"${item}_rate"} /
-                              (1 + $form->{"${item}_rate"})
-                           ),
-                           2);
-        $form->{"${item}_netto"} =
-          $form->round_amount(
-                          ($form->{"${item}_base"} - $form->{"${item}_total"}),
-                          2);
-        $form->{"${item}_total"} =
-          $form->format_amount(\%myconfig, $form->{"${item}_total"}, 2);
-        $form->{"${item}_netto"} =
-          $form->format_amount(\%myconfig, $form->{"${item}_netto"}, 2);
-
-        $tax .= qq|
+        $form->{"${item}_total"} = $form->round_amount( ($form->{"${item}_base"} * $form->{"${item}_rate"} / (1 + $form->{"${item}_rate"})), 2);
+        $form->{"${item}_netto"} = $form->round_amount( ($form->{"${item}_base"} - $form->{"${item}_total"}), 2);
+        $form->{"${item}_total"} = $form->format_amount(\%myconfig, $form->{"${item}_total"}, 2);
+        $form->{"${item}_netto"} = $form->format_amount(\%myconfig, $form->{"${item}_netto"}, 2);
+
+        $TMPL_VAR{tax} .= qq|
              <tr>
-               <th align=right>Enthaltene $form->{"${item}_description"}&nbsp;|
-                                   . $form->{"${item}_rate"} * 100 .qq|%</th>
+               <th align=right>Enthaltene $form->{"${item}_description"}&nbsp;| . $form->{"${item}_rate"} * 100 .qq|%</th>
                <td align=right>$form->{"${item}_total"}</td>
              </tr>
              <tr>
                <th align=right>Nettobetrag</th>
                <td align=right>$form->{"${item}_netto"}</td>
-             </tr>
-|;
+             </tr> |;
       }
     }
-
   }
 
   $form->{oldinvtotal} = $form->{invtotal};
-  $form->{invtotal}    =
-    $form->format_amount(\%myconfig, $form->{invtotal}, 2, 0);
-
-  print qq|
-  <tr>
-    <td>
-      <table width=100%>
-       <tr valign=bottom>
-         <td>
-           <table>
-             <tr>
-               <th align=left>| . $locale->text('Notes') . qq|</th>
-               <th align=left>| . $locale->text('Internal Notes') . qq|</th>
-             </tr>
-             <tr valign=top>
-               <td>$notes</td>
-               <td>$intnotes</td>
-             </tr>
-         <tr>
-    $payments
-           </tr>
-      </table>
-         </td>
-          <td>
-            <table>
-|;
-
-  if ($form->{type} =~ /^sales_/) {
-    print qq|
-            <tr>
-              <th  align=left>| . $locale->text('Ertrag') . qq|</th>
-              <td>| .  $form->format_amount(\%myconfig, $form->{marge_total}, 2, 0) . qq|</td>
-            </tr>
-            <tr>
-              <th  align=left>| . $locale->text('Ertrag prozentual') . qq|</th>
-              <td>| .  $form->format_amount(\%myconfig, $form->{marge_percent}, 2, 0) . qq| %</td>
-            </tr>
-|;
-  }
-
-  print qq|
-            <input type=hidden name="marge_total" value="$form->{"marge_total"}">
-            <input type=hidden name="marge_percent" value="$form->{"marge_percent"}">
-            </table>
-          </td>
-         <td align=right>
-           $taxincluded
-           <table>
-             $subtotal
-             $tax
-             <tr>
-               <th align=right>| . $locale->text('Total') . qq|</th>
-               <td align=right>$form->{invtotal}</td>
-             </tr>
-           </table>
-         </td>
-       </tr>
-      </table>
-    </td>
-  </tr>
-<input type=hidden name=oldinvtotal value=$form->{oldinvtotal}>
-<input type=hidden name=oldtotalpaid value=$totalpaid>
-  <tr>
-    <td><hr size=3 noshade></td>
-  </tr>
-|;
 
-  if ($webdav) {
-    $webdav_list = qq|
+  print $form->parse_html_template("oe/orders_footer", {
+     %TMPL_VAR,
+     webdav          => $webdav,
+     print_options   => print_options(inline => 1),
+     label_edit      => $locale->text("Edit the $form->{type}"),
+     label_workflow  => $locale->text("Workflow $form->{type}"),
+  });
 
-  <tr>
-    <th class=listtop align=left>Dokumente im Webdav-Repository</th>
-  </tr>
-    <table width=100%>
-      <td align=left width=30%><b>Dateiname</b></td>
-      <td align=left width=70%><b>Webdavlink</b></td>
-|;
-    foreach $file (@{ $form->{WEBDAV} }) {
-      $webdav_list .= qq|
-      <tr>
-        <td align="left">$file->{name}</td>
-        <td align="left"><a href="$file->{link}">$file->{type}</a></td>
-      </tr>
-|;
-    }
-    $webdav_list .= qq|
-    </table>
-  </tr>
-  <tr>
-    <td><hr size=3 noshade></td>
-  </tr>
-|;
-
-    print $webdav_list;
-  }
-
-  print qq|
-  <tr>
-    <td>
-|;
-  print_options();
-
-  print qq|
-    </td>
-  </tr>
-</table>
-
-| . $locale->text("Edit the $form->{type}") . qq|<br>
-<input class=submit type=submit name=action id=update_button value="|
-    . $locale->text('Update') . qq|">
-<input class=submit type=submit name=action value="|
-    . $locale->text('Ship to') . qq|">
-<input class=submit type=submit name=action value="|
-    . $locale->text('Print') . qq|">
-<input class=submit type=submit name=action value="|
-    . $locale->text('E-mail') . qq|">
-<input class=submit type=submit name=action value="|
-    . $locale->text('Save') . qq|">
-<input class=submit type=submit name=action value="|
-    . $locale->text('Save and Close') . qq|">
-|;
-
-  if (($form->{id})) {
-    print qq|
-       <input type="button" class="submit" onclick="set_history_window(|
-       . Q($form->{id})
-       . qq|);" name="history" id="history" value="|
-       . $locale->text('history')
-       . qq|">
-
-<br>| . $locale->text("Workflow $form->{type}") . qq|<br>
-<input class=submit type=submit name=action value="|
-      . $locale->text('Save as new') . qq|">
-<input class=submit type=submit name=action value="|
-      . $locale->text('Delete') . qq|">|;
-    if (($form->{type} =~ /sales_quotation$/)) {
-      print qq|
-<input class=submit type=submit name=action value="|
-        . $locale->text('Sales Order') . qq|">|;
-    }
-    if ($form->{type} =~ /request_quotation$/) {
-      print qq|
-<input class=submit type=submit name=action value="|
-        . $locale->text('Purchase Order') . qq|">|;
-    }
-    print qq|
-<input class=submit type=submit name=action value="|
-      . $locale->text('Invoice') . qq|">
-|;
-
-    if ($form->{type} =~ /sales_order$/) {
-      print qq|
-<br>$form->{heading} als neue Vorlage verwenden f&uuml;r<br>
-<input class=submit type=submit name=action value="|
-        . $locale->text('Purchase Order') . qq|">
-<input class=submit type=submit name=action value="|
-        . $locale->text('Quotation') . qq|">
-|;
-
-    } elsif ($form->{type} =~ /purchase_order$/) {
-      print qq|
-<br>$form->{heading} als neue Vorlage verwenden f&uuml;r<br>
-<input class=submit type=submit name=action value="|
-        . $locale->text('Sales Order') . qq|">
-<input class=submit type=submit name=action value="|
-        . $locale->text('Request for Quotation') . qq|">
-|;
-
-    } else {
-      print qq|
-<br>$form->{heading} als neue Vorlage verwenden f&uuml;r<br>
-<input class=submit type=submit name=action value="|
-        . $locale->text('Order') . qq|">
-|;
-    }
-  }
-
-  $form->hide_form("saved_xyznumber");
-
-  print qq|
-
-<input type=hidden name=rowcount value=$form->{rowcount}>
-
-<input name=callback type=hidden value="$form->{callback}">
-
-<input type=hidden name=login value=$form->{login}>
-<input type=hidden name=password value=$form->{password}>
-
-</form>
-
-</body>
-</html>
-|;
   $lxdebug->leave_sub();
 }
 
 sub update {
   $lxdebug->enter_sub();
+  
+  my ($recursive_call) = shift;
+
+  check_oe_access();
 
   set_headings($form->{"id"} ? "edit" : "add");
 
-  map { $form->{$_} = $form->parse_amount(\%myconfig, $form->{$_}) } qw(exchangerate creditlimit creditremaining);
+  map { $form->{$_} = $form->parse_amount(\%myconfig, $form->{$_}) } qw(exchangerate creditlimit creditremaining) unless $recursive_call;
   $form->{update} = 1;
       
   $payment_id = $form->{payment_id} if $form->{payment_id};
@@ -1120,11 +559,11 @@ sub update {
   $form->{exchangerate} = $exchangerate if 
     $form->{forex} = $exchangerate = $form->check_exchangerate(\%myconfig, $form->{currency}, $form->{transdate}, $buysell);
 
-  # for pricegroups
-  $i = $form->{rowcount};
-
   $exchangerate = $form->{exchangerate} || 1;
 
+##################### process items ######################################
+  # for pricegroups
+  $i = $form->{rowcount};
   if (   ($form->{"partnumber_$i"} eq "")
       && ($form->{"description_$i"} eq "")
       && ($form->{"partsgroup_$i"}  eq "")) {
@@ -1134,13 +573,10 @@ sub update {
 
   } else {
 
-    if (   $form->{type} eq 'purchase_order'
-        || $form->{type} eq 'request_quotation') {
-      IR->retrieve_item(\%myconfig, \%$form);
-    }
-    if (   $form->{type} eq 'sales_order' 
-        || $form->{type} eq 'sales_quotation') {
+    if ($form->{type} =~ /^sales/) {
       IS->retrieve_item(\%myconfig, \%$form);
+    } else {
+      IR->retrieve_item(\%myconfig, \%$form);
     }
 
     my $rows = scalar @{ $form->{item_list} };
@@ -1192,8 +628,7 @@ sub update {
         &set_pricegroup($i);
       }
 
-      &display_form;
-
+      display_form();
     } else {
 
       # ok, so this is a new part
@@ -1204,14 +639,16 @@ sub update {
           && ($form->{"description_$i"} eq "")) {
         $form->{rowcount}--;
         $form->{"discount_$i"} = "";
-        display_form();
 
+        display_form();
       } else {
         $form->{"id_$i"}   = 0;
         new_item();
       }
     }
   }
+##################### process items ######################################
+
 
   $lxdebug->leave_sub();
 }
@@ -1219,6 +656,8 @@ sub update {
 sub search {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   if ($form->{type} eq 'purchase_order') {
     $form->{title} = $locale->text('Purchase Orders');
     $form->{vc}    = 'vendor';
@@ -1343,11 +782,7 @@ sub search {
   my $employee_block = qq|
     <tr>
       <th align="right">| . $locale->text('Employee') . qq|</th>
-      <td>| .
-        NTI($cgi->popup_menu('-name'   => 'employee_id',
-                             '-values' => \@values,
-                             '-labels' => \%labels)) . qq|
-      </td>
+      <td>| .  NTI($cgi->popup_menu('-name'   => 'employee_id', '-values' => \@values, '-labels' => \%labels)) . qq|</td>
     </tr>
     <tr>
       <th align="right">| . $locale->text('Salesman') . qq|</th>
@@ -1394,12 +829,12 @@ sub search {
           <th align=right>$vc_label</th>
           <td colspan=3>$vc</td>
         </tr>
-       $department
+$department
         <tr>
           <th align=right>$ordlabel</th>
           <td colspan=3><input name="$ordnumber" size=20></td>
         </tr>
-  $employee_block
+$employee_block
         <tr>
           <th align="right">| . $locale->text('Transaction description') . qq|</th>
           <td colspan="3"><input name="transaction_description" size=20></td>
@@ -1409,10 +844,8 @@ sub search {
           <td colspan="3">$projectnumber</td>
         </tr>
         <tr>
-          <th align=right>| . $locale->text('From') . qq|</th>
-          $button1
-          <th align=right>| . $locale->text('Bis') . qq|</th>
-          $button2
+          <th align=right>| . $locale->text('From') . qq|</th> $button1
+          <th align=right>| . $locale->text('Bis') . qq|</th> $button2
         </tr>
         <input type=hidden name=sort value=transdate>
         <tr>
@@ -1420,53 +853,40 @@ sub search {
           <td colspan=5>
            <table>
         <tr>
-          <td><input type="checkbox" name="open" value="1" id="open" checked>
-            <label for="open">| . $locale->text("Open") . qq|</td>
-          <td><input type="checkbox" name="closed" value="1" id="closed">
-            <label for="closed">| . $locale->text("Closed") . qq|</td>
+          <td><input type="checkbox" name="open" value="1" id="open" checked> <label for="open">| . $locale->text("Open") . qq|</td>
+          <td><input type="checkbox" name="closed" value="1" id="closed"> <label for="closed">| . $locale->text("Closed") . qq|</td>
         </tr>
         $delivered
              <tr>
-               <td><input name="l_id" class=checkbox type=checkbox value=Y>
-               | . $locale->text('ID') . qq|</td>
+               <td><input name="l_id" class=checkbox type=checkbox value=Y> | . $locale->text('ID') . qq|</td>
                <td><input name="l_$ordnumber" class=checkbox type=checkbox value=Y checked> $ordlabel</td>
-               <td><input name="l_transdate" class=checkbox type=checkbox value=Y checked> |
-    . $locale->text('Date') . qq|</td>
-               <td><input name="l_reqdate" class=checkbox type=checkbox value=Y checked> |
-    . $locale->text('Required by') . qq|</td>
+             </tr>
+             <tr>
+               <td><input name="l_transdate" class=checkbox type=checkbox value=Y checked> | . $locale->text('Date') . qq|</td>
+               <td><input name="l_reqdate" class=checkbox type=checkbox value=Y checked> | . $locale->text('Required by') . qq|</td>
              </tr>
              <tr>
                <td><input name="l_name" class=checkbox type=checkbox value=Y checked> $vc_label</td>
                <td><input name="l_employee" class=checkbox type=checkbox value=Y checked> $employee</td>
                
-               <td><input name="l_shipvia" class=checkbox type=checkbox value=Y> |
-    . $locale->text('Ship via') . qq|</td>
+               <td><input name="l_shipvia" class=checkbox type=checkbox value=Y> | . $locale->text('Ship via') . qq|</td>
              </tr>
              <tr>
-               <td><input name="l_netamount" class=checkbox type=checkbox value=Y> |
-    . $locale->text('Amount') . qq|</td>
-               <td><input name="l_tax" class=checkbox type=checkbox value=Y> |
-    . $locale->text('Tax') . qq|</td>
-               <td><input name="l_amount" class=checkbox type=checkbox value=Y checked> |
-    . $locale->text('Total') . qq|</td>
+               <td><input name="l_netamount" class=checkbox type=checkbox value=Y> | . $locale->text('Amount') . qq|</td>
+               <td><input name="l_tax" class=checkbox type=checkbox value=Y> | . $locale->text('Tax') . qq|</td>
+               <td><input name="l_amount" class=checkbox type=checkbox value=Y checked> | . $locale->text('Total') . qq|</td>
              </tr>
              <tr>
-               <td><input name="l_marge_total" class=checkbox type=checkbox value=Y> |
-    .             $locale->text('Ertrag') . qq|</td>
-               <td><input name="l_marge_percent" class=checkbox type=checkbox value=Y> |
-    .             $locale->text('Ertrag prozentual') . qq|</td>
+               <td><input name="l_marge_total" class=checkbox type=checkbox value=Y> | .             $locale->text('Ertrag') . qq|</td>
+               <td><input name="l_marge_percent" class=checkbox type=checkbox value=Y> | .             $locale->text('Ertrag prozentual') . qq|</td>
              </tr>
              <tr>
-          <td><input name="l_globalprojectnumber" class=checkbox type=checkbox value=Y> |
-          . $locale->text('Project Number') . qq|</td>
-          <td><input name="l_transaction_description" class=checkbox type=checkbox value=Y> |
-          . $locale->text('Transaction description') . qq|</td>
+          <td><input name="l_globalprojectnumber" class=checkbox type=checkbox value=Y> | . $locale->text('Project Number') . qq|</td>
+          <td><input name="l_transaction_description" class=checkbox type=checkbox value=Y> | . $locale->text('Transaction description') . qq|</td>
              </tr>
              <tr>
-               <td><input name="l_subtotal" class=checkbox type=checkbox value=Y> |
-    . $locale->text('Subtotal') . qq|</td>
-                <td><input name="l_salesman" class="checkbox" type="checkbox" value="Y"> |
-    . $locale->text('Salesman') . qq|</td>
+               <td><input name="l_subtotal" class=checkbox type=checkbox value=Y> | . $locale->text('Subtotal') . qq|</td>
+                <td><input name="l_salesman" class="checkbox" type="checkbox" value="Y"> | . $locale->text('Salesman') . qq|</td>
              </tr>
            </table>
           </td>
@@ -1481,8 +901,6 @@ $jsscript
 
 <br>
 <input type=hidden name=nextsub value=orders>
-<input type=hidden name=login value=$form->{login}>
-<input type=hidden name=password value=$form->{password}>
 <input type=hidden name=vc value=$form->{vc}>
 <input type=hidden name=type value=$form->{type}>
 
@@ -1518,6 +936,8 @@ sub create_subtotal_row {
 sub orders {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $ordnumber = ($form->{type} =~ /_order$/) ? "ordnumber" : "quonumber";
 
   ($form->{ $form->{vc} }, $form->{"${form->{vc}}_id"}) = split(/--/, $form->{ $form->{vc} });
@@ -1596,7 +1016,7 @@ sub orders {
     'transaction_description' => { 'text' => $locale->text('Transaction description'), },
     'open'                    => { 'text' => $locale->text('Open'), },
     'delivered'               => { 'text' => $locale->text('Delivered'), },
-    'marge_total'                   => { 'text' => $locale->text('Ertrag'), },
+    'marge_total'             => { 'text' => $locale->text('Ertrag'), },
     'marge_percent'           => { 'text' => $locale->text('Ertrag prozentual'), }
   );
 
@@ -1738,6 +1158,8 @@ sub orders {
 sub check_delivered_flag {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   if (($form->{type} ne 'sales_order') && ($form->{type} ne 'purchase_order')) {
     return $lxdebug->leave_sub();
   }
@@ -1764,6 +1186,8 @@ sub check_delivered_flag {
 sub save_and_close {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{defaultcurrency} = $form->get_default_currency(\%myconfig);
 
   if ($form->{type} =~ /_order$/) {
@@ -1863,6 +1287,8 @@ sub save_and_close {
 sub save {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{defaultcurrency} = $form->get_default_currency(\%myconfig);
 
 
@@ -1964,6 +1390,8 @@ sub save {
 sub delete {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->header;
 
   if ($form->{type} =~ /_order$/) {
@@ -1984,6 +1412,7 @@ sub delete {
   map { delete $form->{$_} } qw(action header);
 
   foreach $key (keys %$form) {
+    next if (($key eq 'login') || ($key eq 'password') || ('' ne ref $form->{$key}));
     $form->{$key} =~ s/\"/&quot;/g;
     print qq|<input type=hidden name=$key value="$form->{$key}">\n|;
   }
@@ -2010,6 +1439,8 @@ sub delete {
 sub delete_order_quotation {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   if ($form->{type} =~ /_order$/) {
     $msg = $locale->text('Order deleted!');
     $err = $locale->text('Cannot delete order!');
@@ -2036,6 +1467,9 @@ sub delete_order_quotation {
 sub invoice {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+  $auth->assert($form->{type} eq 'purchase_order' || $form->{type} eq 'request_quotation' ? 'vendor_invoice_edit' : 'invoice_edit');
+
   $form->{old_employee_id} = $form->{employee_id};
   $form->{old_salesman_id} = $form->{salesman_id};
 
@@ -2200,6 +1634,9 @@ sub invoice {
 
 sub backorder_exchangerate {
   $lxdebug->enter_sub();
+
+  check_oe_access();
+
   my ($orddate, $buysell) = @_;
 
   $form->header;
@@ -2214,6 +1651,7 @@ sub backorder_exchangerate {
   map { delete $form->{$_} } qw(action header exchangerate);
 
   foreach $key (keys %$form) {
+    next if (($key eq 'login') || ($key eq 'password') || ('' ne ref $form->{$key}));
     $form->{$key} =~ s/\"/&quot;/g;
     print qq|<input type=hidden name=$key value="$form->{$key}">\n|;
   }
@@ -2222,9 +1660,6 @@ sub backorder_exchangerate {
 
   print qq|
 
-<input type=hidden name=login value=$form->{login}>
-<input type=hidden name=password value=$form->{password}>
-
 <input type=hidden name=exchangeratedate value=$orddate>
 <input type=hidden name=buysell value=$buysell>
 
@@ -2350,6 +1785,8 @@ sub create_backorder {
 sub save_as_new {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{saveasnew} = 1;
   $form->{closed}    = 0;
   map { delete $form->{$_} } qw(printed emailed queued);
@@ -2372,6 +1809,8 @@ sub save_as_new {
 sub check_for_direct_delivery_yes {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{direct_delivery_checked} = 1;
   delete @{$form}{grep /^shipto/, keys %{ $form }};
   map { s/^CFDD_//; $form->{$_} = $form->{"CFDD_${_}"} } grep /^CFDD_/, keys %{ $form };
@@ -2383,6 +1822,8 @@ sub check_for_direct_delivery_yes {
 sub check_for_direct_delivery_no {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{direct_delivery_checked} = 1;
   delete @{$form}{grep /^shipto/, keys %{ $form }};
   purchase_order();
@@ -2393,6 +1834,8 @@ sub check_for_direct_delivery_no {
 sub check_for_direct_delivery {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   if ($form->{direct_delivery_checked}
       || (!$form->{shiptoname} && !$form->{shiptostreet} && !$form->{shipto_id})) {
     $lxdebug->leave_sub();
@@ -2407,7 +1850,7 @@ sub check_for_direct_delivery {
   }
 
   delete $form->{action};
-  $form->{VARIABLES} = [ map { { "key" => $_, "value" => $form->{$_} } } grep { ref $_ eq "" } keys %{ $form } ];
+  $form->{VARIABLES} = [ map { { "key" => $_, "value" => $form->{$_} } } grep { ($_ ne 'login') && ($_ ne 'password') && (ref $_ eq "") } keys %{ $form } ];
 
   $form->header();
   print $form->parse_html_template("oe/check_for_direct_delivery");
@@ -2420,6 +1863,9 @@ sub check_for_direct_delivery {
 sub purchase_order {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+  $auth->assert('purchase_order_edit');
+
   if ($form->{type} eq 'sales_order') {
     check_for_direct_delivery();
   }
@@ -2447,6 +1893,9 @@ sub purchase_order {
 sub sales_order {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+  $auth->assert('sales_order_edit');
+
   if (   $form->{type} eq 'sales_quotation'
       || $form->{type} eq 'request_quotation') {
     OE->close_order(\%myconfig, $form);
@@ -2470,6 +1919,9 @@ sub sales_order {
 sub poso {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+  $auth->assert('purchase_order_edit | sales_order_edit');
+
   $form->{transdate} = $form->current_date(\%myconfig);
   delete $form->{duedate};
 
@@ -2510,6 +1962,8 @@ sub poso {
 sub e_mail {
   $lxdebug->enter_sub();
 
+  check_oe_access();
+
   $form->{print_and_save} = 1;
 
   $print_post = 1;
@@ -2518,10 +1972,7 @@ sub e_mail {
 
   save();
 
-  my %saved_vars;
-  map({ $saved_vars{$_} = $form->{$_}; } qw(id ordnumber quonumber));
-  restore_form($saved_form);
-  map({ $form->{$_} = $saved_vars{$_}; } qw(id ordnumber quonumber));
+  restore_form($saved_form, 0, qw(id ordnumber quonumber));
 
   edit_e_mail();
 
@@ -2535,3 +1986,40 @@ sub yes {
 sub no {
   call_sub($form->{no_nextsub});
 }
+
+######################################################################################################
+# IO ENTKOPPLUNG
+# ###############################################################################################
+sub display_form {
+  $lxdebug->enter_sub();
+
+  check_oe_access();
+
+  $form->{"taxaccounts"} =~ s/\s*$//;
+  $form->{"taxaccounts"} =~ s/^\s*//;
+  foreach my $accno (split(/\s*/, $form->{"taxaccounts"})) {
+    map({ delete($form->{"${accno}_${_}"}); } qw(rate description taxnumber));
+  }
+  $form->{"taxaccounts"} = "";
+
+  for my $i (1 .. $form->{"rowcount"}) {
+    IC->retrieve_accounts(\%myconfig, $form, $form->{"id_$i"}, $i, 1) if $form->{"id_$i"};
+  }
+
+  $form->{rowcount}++;
+  $form->{"project_id_$form->{rowcount}"} = $form->{globalproject_id};
+
+  $form->language_payment(\%myconfig);
+
+  Common::webdav_folder($form) if ($webdav);
+
+  &form_header;
+
+  # create rows
+  display_row($form->{rowcount}) if $form->{rowcount};
+
+  &form_footer;
+
+  $lxdebug->leave_sub();
+}
+