Und der eigentliche Loeschmechanismus.

[kivitendo-erp.git] / templates / webpages / ct / get_delivery_master.html

diff --git a/templates/webpages/ct/get_delivery_master.html b/templates/webpages/ct/get_delivery_master.html
index 772b83b..eac63cb 100644 (file)
--- a/templates/webpages/ct/get_delivery_master.html
+++ b/templates/webpages/ct/get_delivery_master.html
@@ -1,28 +1,27 @@
-[% USE LxERP %]
-<table width=100%>
+[% USE HTML %][% USE LxERP %]
+<table width="100%">
   <tr>
     <td>
-      <table width=100%>
-        <tr class=listheading>
-          <th class=listheading><translate>Shipping Address</translate></th>
-          <th class=listheading><translate>Invoice</translate></th>
-          <th class=listheading><translate>Order</translate></th>
-          <th class=listheading><translate>Invdate</translate></th>
-          <th class=listheading><translate>Description</translate></th>
-          <th class=listheading><translate>Qty</translate></th>
-          <th class=listheading><translate>Unit</translate></th>
-          <th class=listheading><translate>Sell Price</translate></th>
+      <table width="100%">
+        <tr class="listheading">
+          <th class="listheading"><translate>Shipping Address</translate></th>
+          <th class="listheading"><translate>Invoice</translate></th>
+          <th class="listheading"><translate>Order</translate></th>
+          <th class="listheading"><translate>Invdate</translate></th>
+          <th class="listheading"><translate>Description</translate></th>
+          <th class="listheading"><translate>Qty</translate></th>
+          <th class="listheading"><translate>Unit</translate></th>
+          <th class="listheading"><translate>Sell Price</translate></th>
         </tr>
 [%- FOREACH row = DELIVERY %]
-        <tr class=listrow[% loop.count % 2 %]>
-          
-          <td>[% row.shiptoname UNLESS loop.prev.shiptoname == row.shiptoname %]&nbsp;</td>
-          <td>[% row.invnumber   %]&nbsp;</td>
-          <td>[% row.ordnumber   %]&nbsp;</td>
-          <td>[% row.transdate   %]&nbsp;</td>
-          <td>[% row.description %]&nbsp;</td>
-          <td>[% row.qty         %]&nbsp;</td>
-          <td>[% row.unit        %]&nbsp;</td>
+        <tr class="listrow[% loop.count % 2 %]">
+          <td>[% HTML.escape(row.shiptoname) UNLESS loop.prev.shiptoname == row.shiptoname %]&nbsp;</td>
+          <td>[% HTML.escape(row.invnumber)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.ordnumber)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.transdate)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.description) %]&nbsp;</td>
+          <td>[% HTML.escape(row.qty)         %]&nbsp;</td>
+          <td>[% HTML.escape(row.unit)        %]&nbsp;</td>
           <td>[% LxERP.format_amount(row.sellprice, 2) %]&nbsp;</td>
         </tr>
 [%- END %]