X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;ds=sidebyside;f=templates%2Fwebpages%2Fct%2Fget_delivery_master.html;h=eac63cb76e4834fd7a9080e3a7649e0bb5a6a640;hb=ee82a6ce45291872bfb41d178352b61a9b9be957;hp=772b83ba45dc5481156f09653b052ff14028068d;hpb=ab1df08bfae3ef3361c7b5e4e16d91ae3cb34961;p=kivitendo-erp.git

diff --git a/templates/webpages/ct/get_delivery_master.html b/templates/webpages/ct/get_delivery_master.html
index 772b83ba4..eac63cb76 100644
--- a/templates/webpages/ct/get_delivery_master.html
+++ b/templates/webpages/ct/get_delivery_master.html
@@ -1,28 +1,27 @@
-[% USE LxERP %]
-<table width=100%>
+[% USE HTML %][% USE LxERP %]
+<table width="100%">
   <tr>
     <td>
-      <table width=100%>
-        <tr class=listheading>
-          <th class=listheading><translate>Shipping Address</translate></th>
-          <th class=listheading><translate>Invoice</translate></th>
-          <th class=listheading><translate>Order</translate></th>
-          <th class=listheading><translate>Invdate</translate></th>
-          <th class=listheading><translate>Description</translate></th>
-          <th class=listheading><translate>Qty</translate></th>
-          <th class=listheading><translate>Unit</translate></th>
-          <th class=listheading><translate>Sell Price</translate></th>
+      <table width="100%">
+        <tr class="listheading">
+          <th class="listheading"><translate>Shipping Address</translate></th>
+          <th class="listheading"><translate>Invoice</translate></th>
+          <th class="listheading"><translate>Order</translate></th>
+          <th class="listheading"><translate>Invdate</translate></th>
+          <th class="listheading"><translate>Description</translate></th>
+          <th class="listheading"><translate>Qty</translate></th>
+          <th class="listheading"><translate>Unit</translate></th>
+          <th class="listheading"><translate>Sell Price</translate></th>
         </tr>
 [%- FOREACH row = DELIVERY %]
-        <tr class=listrow[% loop.count % 2 %]>
-          
-          <td>[% row.shiptoname UNLESS loop.prev.shiptoname == row.shiptoname %]&nbsp;</td>
-          <td>[% row.invnumber   %]&nbsp;</td>
-          <td>[% row.ordnumber   %]&nbsp;</td>
-          <td>[% row.transdate   %]&nbsp;</td>
-          <td>[% row.description %]&nbsp;</td>
-          <td>[% row.qty         %]&nbsp;</td>
-          <td>[% row.unit        %]&nbsp;</td>
+        <tr class="listrow[% loop.count % 2 %]">
+          <td>[% HTML.escape(row.shiptoname) UNLESS loop.prev.shiptoname == row.shiptoname %]&nbsp;</td>
+          <td>[% HTML.escape(row.invnumber)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.ordnumber)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.transdate)   %]&nbsp;</td>
+          <td>[% HTML.escape(row.description) %]&nbsp;</td>
+          <td>[% HTML.escape(row.qty)         %]&nbsp;</td>
+          <td>[% HTML.escape(row.unit)        %]&nbsp;</td>
           <td>[% LxERP.format_amount(row.sellprice, 2) %]&nbsp;</td>
         </tr>
 [%- END %]