X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=SL%2FBP.pm;h=867b5ca1979df76bd8b9417d60b41158e6ea2200;hb=refs%2Fheads%2Fb_3.4.1;hp=683edd44d99940104b1cb4e87f8f29d069e123e2;hpb=9659649d435c0436ce14048e56b03879ac641429;p=kivitendo-erp.git

diff --git a/SL/BP.pm b/SL/BP.pm
index 683edd44d..867b5ca19 100644
--- a/SL/BP.pm
+++ b/SL/BP.pm
@@ -34,6 +34,10 @@
 
 package BP;
 
+use SL::DBUtils;
+
+use strict;
+
 sub get_vc {
   $main::lxdebug->enter_sub();
 
@@ -43,7 +47,6 @@ sub get_vc {
   my $dbh = $form->dbconnect($myconfig);
 
   my %arap = (invoice           => 'ar',
-              packing_list      => 'ar',
               sales_order       => 'oe',
               purchase_order    => 'oe',
               sales_quotation   => 'oe',
@@ -51,36 +54,35 @@ sub get_vc {
               check             => 'ap',
               receipt           => 'ar');
 
-  $query = qq|SELECT count(*)
-	      FROM (SELECT DISTINCT ON (vc.id) vc.id
-		    FROM $form->{vc} vc, $arap{$form->{type}} a, status s
-		    WHERE a.$form->{vc}_id = vc.id
-		    AND s.trans_id = a.id
-		    AND s.formname = '$form->{type}'
-		    AND s.spoolfile IS NOT NULL) AS total|;
+  my $vc = $form->{vc} eq "customer" ? "customer" : "vendor";
+  my $arap_type = defined($arap{$form->{type}}) ? $arap{$form->{type}} : 'ar';
 
-  my $sth = $dbh->prepare($query);
-  $sth->execute || $form->dberror($query);
-  my ($count) = $sth->fetchrow_array;
-  $sth->finish;
+  my $query =
+    qq|SELECT count(*) | .
+    qq|FROM (SELECT DISTINCT ON (vc.id) vc.id FROM $vc vc, $arap_type a, status s | .
+    qq|  WHERE a.${vc}_id = vc.id  AND s.trans_id = a.id AND s.formname = ? | .
+    qq|    AND s.spoolfile IS NOT NULL) AS total|;
+
+  my ($count) = selectrow_query($form, $dbh, $query, $form->{type});
 
   # build selection list
   if ($count < $myconfig->{vclimit}) {
-    $query = qq|SELECT DISTINCT ON (vc.id) vc.id, vc.name
-                FROM $form->{vc} vc, $arap{$form->{type}} a, status s
-		WHERE a.$form->{vc}_id = vc.id
-		AND s.trans_id = a.id
-		AND s.formname = '$form->{type}'
-		AND s.spoolfile IS NOT NULL|;
-  }
-  $sth = $dbh->prepare($query);
-  $sth->execute || $form->dberror($query);
-
-  while (my $ref = $sth->fetchrow_hashref(NAME_lc)) {
-    push @{ $form->{"all_$form->{vc}"} }, $ref;
+    $query =
+      qq|SELECT DISTINCT ON (vc.id) vc.id, vc.name | .
+      qq|FROM $vc vc, $arap_type a, status s | .
+      qq|WHERE a.${vc}_id = vc.id AND s.trans_id = a.id AND s.formname = ? | .
+      qq|  AND s.spoolfile IS NOT NULL|;
+
+    my $sth = $dbh->prepare($query);
+    $sth->execute($form->{type}) || $form->dberror($query . " ($form->{type})");
+
+    $form->{"all_${vc}"} = [];
+    while (my $ref = $sth->fetchrow_hashref("NAME_lc")) {
+      push @{ $form->{"all_${vc}"} }, $ref;
+    }
+    $sth->finish;
   }
 
-  $sth->finish;
   $dbh->disconnect;
 
   $main::lxdebug->leave_sub();
@@ -94,14 +96,15 @@ sub payment_accounts {
   # connect to database
   my $dbh = $form->dbconnect($myconfig);
 
-  my $query = qq|SELECT DISTINCT ON (s.chart_id) c.accno, c.description
-                 FROM status s, chart c
-		 WHERE s.chart_id = c.id
-		 AND s.formname = '$form->{type}'|;
+  my $query =
+    qq|SELECT DISTINCT ON (s.chart_id) c.accno, c.description | .
+    qq|FROM status s, chart c | .
+    qq|WHERE s.chart_id = c.id AND s.formname = ?|;
   my $sth = $dbh->prepare($query);
-  $sth->execute || $form->dberror($query);
+  $sth->execute($form->{type}) || $form->dberror($query . " ($form->{type})");
 
-  while (my $ref = $sth->fetchrow_hashref(NAME_lc)) {
+  $form->{accounts} = [];
+  while (my $ref = $sth->fetchrow_hashref("NAME_lc")) {
     push @{ $form->{accounts} }, $ref;
   }
 
@@ -119,29 +122,34 @@ sub get_spoolfiles {
   # connect to database
   my $dbh = $form->dbconnect($myconfig);
 
-  my ($query, $arap);
+  my ($query, $arap, @values);
   my $invnumber = "invnumber";
 
+  my $vc = $form->{vc} eq "customer" ? "customer" : "vendor";
+
   if ($form->{type} eq 'check' || $form->{type} eq 'receipt') {
 
     $arap = ($form->{type} eq 'check') ? "ap" : "ar";
     my ($accno) = split /--/, $form->{account};
 
-    $query = qq|SELECT a.id, s.spoolfile, vc.name, ac.transdate, a.invnumber,
-                a.invoice, '$arap' AS module
-                FROM status s, chart c, $form->{vc} vc, $arap a, acc_trans ac
-		WHERE s.formname = '$form->{type}'
-		AND s.chart_id = c.id
-		AND c.accno = '$accno'
-		AND s.trans_id = a.id
-		AND a.$form->{vc}_id = vc.id
-		AND ac.trans_id = s.trans_id
-		AND ac.chart_id = c.id
-		AND NOT ac.fx_transaction|;
-  } else {
+    $query =
+      qq|SELECT a.id, s.spoolfile, vc.name, ac.transdate, a.invnumber, | .
+      qq|  a.invoice, '$arap' AS module | .
+      qq|FROM status s, chart c, $vc vc, $arap a, acc_trans ac | .
+      qq|WHERE s.formname = ? | .
+      qq|  AND s.chart_id = c.id | .
+      qq|  AND c.accno = ? | .
+      qq|  AND s.trans_id = a.id | .
+      qq|  AND a.${vc}_id = vc.id | .
+      qq|  AND ac.trans_id = s.trans_id | .
+      qq|  AND ac.chart_id = c.id | .
+      qq|  AND NOT ac.fx_transaction|;
+    @values = ($form->{type}, $accno);
 
+  } else {
     $arap = "ar";
     my $invoice = "a.invoice";
+    my $quonumber = "a.quonumber";
 
     if ($form->{type} =~ /_(order|quotation)$/) {
       $invnumber = "ordnumber";
@@ -149,52 +157,72 @@ sub get_spoolfiles {
       $invoice   = '0';
     }
 
-    $query = qq|SELECT a.id, a.$invnumber AS invnumber, a.ordnumber,
-		a.quonumber, a.transdate, $invoice AS invoice,
-		'$arap' AS module, vc.name, s.spoolfile
-		FROM $arap a, $form->{vc} vc, status s
-		WHERE s.trans_id = a.id
-		AND s.spoolfile IS NOT NULL
-		AND s.formname = '$form->{type}'
-		AND a.$form->{vc}_id = vc.id|;
-  }
+    if ($form->{type} eq 'packing_list') {
+      $invnumber = "donumber";
+      $arap      = "delivery_orders";
+      $invoice   = '0';
+      $quonumber = '0';
+    }
 
-  if ($form->{"$form->{vc}_id"}) {
-    $query .= qq| AND a.$form->{vc}_id = $form->{"$form->{vc}_id"}|;
-  } else {
-    if ($form->{ $form->{vc} }) {
-      my $name = $form->like(lc $form->{ $form->{vc} });
-      $query .= " AND lower(vc.name) LIKE '$name'";
+    $query =
+      qq|SELECT a.id, a.$invnumber AS invnumber, a.ordnumber, $quonumber, | .
+      qq|  a.transdate, $invoice AS invoice, '$arap' AS module, vc.name, | .
+      qq|  s.spoolfile | .
+      qq|FROM $arap a, ${vc} vc, status s | .
+      qq|WHERE s.trans_id = a.id | .
+      qq|  AND s.spoolfile IS NOT NULL | .
+    ($form->{type} eq 'packing_list'
+    ? qq|  AND s.formname IN (?, ?) |
+    : qq|  AND s.formname = ? |) .
+      qq|  AND a.${vc}_id = vc.id|;
+    @values = ($form->{type});
+
+    if ($form->{type} eq 'packing_list') {
+      @values = qw(sales_delivery_order purchase_delivery_order);
     }
   }
-  if ($form->{invnumber}) {
-    my $number = $form->like(lc $form->{invnumber});
-    $query .= " AND lower(a.invnumber) LIKE '$number'";
-  }
-  if ($form->{ordnumber}) {
-    my $ordnumber = $form->like(lc $form->{ordnumber});
-    $query .= " AND lower(a.ordnumber) LIKE '$ordnumber'";
+
+  if ($form->{"${vc}_id"}) {
+    $query .= qq| AND a.${vc}_id = ?|;
+    push(@values, conv_i($form->{"${vc}_id"}));
+  } elsif ($form->{ $vc }) {
+    $query .= " AND vc.name ILIKE ?";
+    push(@values, like($form->{ $vc }));
   }
-  if ($form->{quonumber}) {
-    my $quonumber = $form->like(lc $form->{quonumber});
-    $query .= " AND lower(a.quonumber) LIKE '$quonumber'";
+  foreach my $column (qw(invnumber ordnumber quonumber donumber)) {
+    if ($form->{$column}) {
+      $query .= " AND a.$column ILIKE ?";
+      push(@values, like($form->{$column}));
+    }
   }
 
-   if ($form->{type} =~ /(invoice|sales_order|sales_quotation|packing_list|puchase_order|request_quotation)$/) {
-    $query .= " AND a.transdate >= '$form->{transdatefrom}'" if $form->{transdatefrom};
-    $query .= " AND a.transdate <= '$form->{transdateto}'" if $form->{transdateto};
+  if ($form->{type} =~ /(invoice|sales_order|sales_quotation|purchase_order|request_quotation|packing_list)$/) {
+    if ($form->{transdatefrom}) {
+      $query .= " AND a.transdate >= ?";
+      push(@values, $form->{transdatefrom});
+    }
+    if ($form->{transdateto}) {
+      $query .= " AND a.transdate <= ?";
+      push(@values, $form->{transdateto});
+    }
   }
 
-  my @a = (transdate, $invnumber, name);
+  my @a = ("transdate", $invnumber, "name");
   my $sortorder = join ', ', $form->sort_columns(@a);
-  $sortorder = $form->{sort} if $form->{sort};
 
-  $query .= " ORDER by $sortorder";
+  if (grep({ $_ eq $form->{sort} }
+           qw(transdate invnumber ordnumber quonumber donumber name))) {
+    $sortorder = $form->{sort};
+  }
+
+  $query .= " ORDER BY $sortorder";
 
   my $sth = $dbh->prepare($query);
-  $sth->execute || $form->dberror($query);
+  $sth->execute(@values) ||
+    $form->dberror($query . " (" . join(", ", @values) . ")");
 
-  while (my $ref = $sth->fetchrow_hashref(NAME_lc)) {
+  $form->{SPOOL} = [];
+  while (my $ref = $sth->fetchrow_hashref("NAME_lc")) {
     push @{ $form->{SPOOL} }, $ref;
   }
 
@@ -207,7 +235,9 @@ sub get_spoolfiles {
 sub delete_spool {
   $main::lxdebug->enter_sub();
 
-  my ($self, $myconfig, $form, $spool) = @_;
+  my ($self, $myconfig, $form) = @_;
+
+  my $spool = $::lx_office_conf{paths}->{spool};
 
   # connect to database, turn AutoCommit off
   my $dbh = $form->dbconnect_noauto($myconfig);
@@ -215,13 +245,11 @@ sub delete_spool {
   my $query;
 
   if ($form->{type} =~ /(check|receipt)/) {
-    $query = qq|DELETE FROM status
-                WHERE spoolfile = ?|;
+    $query = qq|DELETE FROM status WHERE spoolfile = ?|;
   } else {
-    $query = qq|UPDATE status SET
-                 spoolfile = NULL,
-		 printed = '1'
-                 WHERE spoolfile = ?|;
+    $query =
+      qq|UPDATE status SET spoolfile = NULL, printed = '1' | .
+      qq|WHERE spoolfile = ?|;
   }
   my $sth = $dbh->prepare($query) || $form->dberror($query);
 
@@ -238,9 +266,8 @@ sub delete_spool {
 
   if ($rc) {
     foreach my $i (1 .. $form->{rowcount}) {
-      $_ = qq|$spool/$form->{"spoolfile_$i"}|;
       if ($form->{"checked_$i"}) {
-        unlink;
+        unlink(qq|$spool/$form->{"spoolfile_$i"}|);
       }
     }
   }
@@ -253,22 +280,25 @@ sub delete_spool {
 sub print_spool {
   $main::lxdebug->enter_sub();
 
-  my ($self, $myconfig, $form, $spool) = @_;
+  my ($self, $myconfig, $form, $output) = @_;
+
+  my $spool = $::lx_office_conf{paths}->{spool};
 
   # connect to database
   my $dbh = $form->dbconnect($myconfig);
 
-  my $query = qq|UPDATE status SET
-		 printed = '1'
-                 WHERE formname = '$form->{type}'
-		 AND spoolfile = ?|;
+  my $query =
+    qq|UPDATE status SET printed = '1' | .
+    qq|WHERE formname = ? AND spoolfile = ?|;
   my $sth = $dbh->prepare($query) || $form->dberror($query);
 
   foreach my $i (1 .. $form->{rowcount}) {
     if ($form->{"checked_$i"}) {
-      open(OUT, $form->{OUT}) or $form->error("$form->{OUT} : $!");
+      # $output is safe ( = does not come directly from the browser).
+      open(OUT, $output) or $form->error("$output : $!");
 
-      $spoolfile = qq|$spool/$form->{"spoolfile_$i"}|;
+      $form->{"spoolfile_$i"} =~ s|.*/||;
+      my $spoolfile = qq|$spool/$form->{"spoolfile_$i"}|;
 
       # send file to printer
       open(IN, $spoolfile) or $form->error("$spoolfile : $!");
@@ -279,7 +309,8 @@ sub print_spool {
       close(IN);
       close(OUT);
 
-      $sth->execute($form->{"spoolfile_$i"}) || $form->dberror($query);
+      $sth->execute($form->{type}, $form->{"spoolfile_$i"}) ||
+        $form->dberror($query . " ($form->{type}, " . $form->{"spoolfile_$i"} . ")");
       $sth->finish;
 
     }