X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=SL%2FController%2FRequirementSpecOrder.pm;h=8c33d6ffdbf9a8f4d681b6b04e0032f81d1fdda3;hb=afb8e14695ac06126fff2084b3b67d517663f9f6;hp=0e9785272c7e13846873e0fb2f2da43a83b633e9;hpb=4d050ca366a72bbdbcc3a0ef49b37867bee9eb59;p=kivitendo-erp.git

diff --git a/SL/Controller/RequirementSpecOrder.pm b/SL/Controller/RequirementSpecOrder.pm
index 0e9785272..8c33d6ffd 100644
--- a/SL/Controller/RequirementSpecOrder.pm
+++ b/SL/Controller/RequirementSpecOrder.pm
@@ -54,22 +54,33 @@ sub action_new {
 sub action_create {
   my ($self)         = @_;
 
+  if (!$::auth->assert($::form->{quotation} ? 'sales_quotation_edit' : 'sales_order_edit', 1)) {
+    return $self->js->flash('error', t8("You do not have the permissions to access this function."))->render($self);
+  }
+
   # 1. Update sections with selected part IDs.
   my $section_attrs  = $::form->{sections} || [];
-  my $sections       = SL::DB::Manager::RequirementSpecItem->get_all(where => [ id => [ map { $_->{id} } @{ $section_attrs } ] ]);
+  my $sections       = SL::DB::Manager::RequirementSpecItem->get_all_sorted(where => [ id => [ map { $_->{id} } @{ $section_attrs } ] ]);
   my %sections_by_id = map { ($_->{id} => $_) } @{ $sections };
 
   $sections_by_id{ $_->{id} }->update_attributes(order_part_id => $_->{order_part_id}) for @{ $section_attrs };
 
   # 2. Create actual quotation/order.
   my $order = $self->create_order(sections => $sections);
-  $order->save;
+  $order->db->with_transaction(sub {
+    $order->save;
+
+    $self->requirement_spec->orders(
+      @{ $self->requirement_spec->orders },
+      SL::DB::RequirementSpecOrder->new(order => $order, version => $self->requirement_spec->version)
+    );
+    $self->requirement_spec->save;
+
+    $self->requirement_spec->link_to_record($order);
+  }) or do {
+    $::lxdebug->message(LXDebug::WARN(), "Error creating the order object: $@");
+  };
 
-  $self->requirement_spec->orders(
-    @{ $self->requirement_spec->orders },
-    SL::DB::RequirementSpecOrder->new(order => $order, version => $self->requirement_spec->version)
-  );
-  $self->requirement_spec->save;
   $self->init_requirement_spec;
 
   # 3. Notify the user and return to list.
@@ -86,6 +97,10 @@ sub action_update {
   my $order    = $self->rs_order->order;
   my $sections = $self->requirement_spec->sections_sorted;
 
+  if (!$::auth->assert($order->quotation ? 'sales_quotation_edit' : 'sales_order_edit', 1)) {
+    return $self->js->flash('error', t8("You do not have the permissions to access this function."))->render($self);
+  }
+
   my (@orderitems, %sections_seen);
   foreach my $item (@{ $order->items_sorted }) {
     my $section = first { my $num = $_->fb_number; $item->description =~ m{\b\Q${num}\E\b} && !$sections_seen{ $_->id } } @{ $sections };
@@ -135,7 +150,13 @@ sub action_do_update {
   $order->orderitems([ @{ $order->orderitems }, @new_orderitems ]) if @new_orderitems;
 
   $order->calculate_prices_and_taxes;
-  $order->save;
+
+  $order->db->with_transaction(sub {
+    $order->save;
+    $self->requirement_spec->link_to_record($order);
+  }) or do {
+    $::lxdebug->message(LXDebug::WARN(), "Error updating the order object: $@");
+  };
 
   $self->init_requirement_spec;
 
@@ -191,7 +212,7 @@ sub action_delete {
 sub setup {
   my ($self) = @_;
 
-  $::auth->assert('sales_quotation_edit');
+  $::auth->assert('requirement_spec_edit');
   $::request->{layout}->use_stylesheet("${_}.css") for qw(jquery.contextMenu requirement_spec autocomplete_part);
   $::request->{layout}->use_javascript("${_}.js")  for qw(jquery.jstree jquery/jquery.contextMenu client_js requirement_spec);
 
@@ -243,11 +264,13 @@ sub create_order_item {
 
   if (!$section->{keep_description}) {
     $description     = '<%fb_number%> <%title%>' unless $description =~ m{<%};
-    $longdescription = '<%description%>'         unless $longdescription =~ m{<%};
+    $longdescription = '&lt;%description%&gt;'   unless $longdescription =~ m{&lt;%};
 
-    foreach my $field (\$description, \$longdescription) {
-      $$field =~ s{<% (.+?) %>}{ $section->can($1) ? $section->$1 : '<' . t8('Invalid variable #1', $1) . '>' }egx;
-    }
+    $description     =~ s{<% (.+?) %>}{ $section->can($1) ? $section->$1 : '<' . t8('Invalid variable #1', $1) . '>' }egx;
+    $longdescription =~ s{\&lt;\% description \%\&gt;}{!!!!DESCRIPTION!!!!}gx;
+    $longdescription =~ s{<[pP]> !!!!DESCRIPTION!!!! </[pP]>}{!!!!DESCRIPTION!!!!}gx;
+    $longdescription =~ s{\&lt;\% (.+?) \%\&gt;}{ $section->can($1) ? $::locale->quote_special_chars('HTML', $section->$1 // '') : '<' . t8('Invalid variable #1', $1) . '>' }egx;
+    $longdescription =~ s{!!!!DESCRIPTION!!!!}{ $section->description // '' }egx;
   }
 
   $item->assign_attributes(