X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=SL%2FCP.pm;h=46cebfebf5dea4aa28849dd60295f0c551525686;hb=1eaf497886107c359dbc2a185f4bede9b7e7f6ea;hp=9b37bd7c4adb761614966d6618eca4088bbd37b8;hpb=546480e0d8c4684288967aa54b80207d5c57a71a;p=kivitendo-erp.git

diff --git a/SL/CP.pm b/SL/CP.pm
index 9b37bd7c4..46cebfebf 100644
--- a/SL/CP.pm
+++ b/SL/CP.pm
@@ -74,8 +74,7 @@ sub paymentaccounts {
     qq|FROM chart | .
     qq|WHERE link LIKE ? |.
     qq|ORDER BY accno|;
-  my $sth = prepare_execute_query($form, $dbh, $query,
-                                  $form->{ARAP} eq "AR" ? "AR" : "AP" );
+  my $sth = prepare_execute_query($form, $dbh, $query, '%' . $ARAP . '%');
 
   $form->{PR}{ $form->{ARAP} } = ();
   $form->{PR}{"$form->{ARAP}_paid"} = ();
@@ -159,10 +158,12 @@ sub get_openinvoices {
   my $buysell = $form->{vc} eq 'customer' ? "buy" : "sell";
   my $arap = $form->{arap} eq "ar" ? "ar" : "ap";
 
+  my $curr_null = $form->{curreny} ? '' : ' OR a.curr IS NULL'; # fix: after sql-injection fix, curr is inserted as NULL, before that as ''
+
   my $query =
      qq|SELECT a.id, a.invnumber, a.transdate, a.amount, a.paid, a.curr | .
 	   qq|FROM $arap a | .
-     qq|WHERE (a.${vc}_id = ?) AND (a.curr = ?) AND NOT (a.amount = paid)|;
+     qq|WHERE (a.${vc}_id = ?) AND (a.curr = ? $curr_null) AND NOT (a.amount = paid)|;
 		 qq|ORDER BY a.id|;
   my $sth = prepare_execute_query($form, $dbh, $query,
                                   conv_i($form->{"${vc}_id"}),
@@ -332,7 +333,6 @@ sub process_payment {
 
       $form->{"paid_$i"} =
         $form->round_amount($form->{"paid_$i"} * $exchangerate, 2);
-
       $pth->execute($form->{"id_$i"}) || $form->dberror;
       ($amount) = $pth->fetchrow_array;
       $pth->finish;
@@ -350,6 +350,14 @@ sub process_payment {
       $query = qq|UPDATE $arap SET $paid, datepaid = ? WHERE id = ?|;
 		  @values = (conv_date($form->{datepaid}), conv_i($form->{"id_$i"}));
       do_query($form, $dbh, $query, @values);
+      # saving the history
+      $form->{id} = $form->{"id_$i"};
+      if(!exists $form->{addition}) {
+        $form->{snumbers} = qq|invnumber_| . $form->{"invnumber_$i"};
+        $form->{addition} = "POSTED";
+        $form->save_history($form->dbconnect($myconfig));
+      }
+      # /saving the history 
     }
   }