From: Moritz Bunkus <m.bunkus@linet-services.de>
Date: Fri, 11 May 2007 12:41:47 +0000 (+0000)
Subject: $form->parse_template() sowie Template.pm benutzen $form->{OUT} und $form->{tmpfile... 
X-Git-Tag: release-2.4.3^2~336
X-Git-Url: http://wagnertech.de/git?a=commitdiff_plain;h=e1e19a485c7092c6675b2a80bdf799edbaf7be3d;p=kivitendo-erp.git

$form->parse_template() sowie Template.pm benutzen $form->{OUT} und $form->{tmpfile} direkt in Systemkommandos. Deswegen muss sichergestellt sein, dass diese Variablen nur mit geprüften Werten gefüllt werden.
---

diff --git a/SL/Form.pm b/SL/Form.pm
index 5a5005eff..458667768 100644
--- a/SL/Form.pm
+++ b/SL/Form.pm
@@ -776,7 +776,18 @@ sub parse_template {
   # OUT is used for the media, screen, printer, email
   # for postscript we store a copy in a temporary file
   my $fileid = time;
-  $self->{tmpfile} ||= "$userspath/${fileid}.$self->{IN}";
+  my $prepend_userspath;
+
+  if (!$self->{tmpfile}) {
+    $self->{tmpfile}   = "${fileid}.$self->{IN}";
+    $prepend_userspath = 1;
+  }
+
+  $prepend_userspath = 1 if substr($self->{tmpfile}, 0, length $userspath) eq $userspath;
+
+  $self->{tmpfile} =~ s|.*/||;
+  $self->{tmpfile} =~ s/[^a-zA-Z0-9\._\ \-]//g;
+  $self->{tmpfile} = "$userspath/$self->{tmpfile}" if $prepend_userspath;
 
   if ($template->uses_temp_file() || $self->{media} eq 'email') {
     $out = $self->{OUT};
diff --git a/bin/mozilla/io.pl b/bin/mozilla/io.pl
index d150c2ca0..a1a9c4da0 100644
--- a/bin/mozilla/io.pl
+++ b/bin/mozilla/io.pl
@@ -1673,6 +1673,8 @@ sub print_form {
 
   $form->{templates} = "$myconfig{templates}";
 
+  delete $form->{printer_command};
+
   $form->{language} = $form->get_template_language(\%myconfig);
   $form->{printer_code} = $form->get_printer_code(\%myconfig);
 
@@ -1737,6 +1739,8 @@ sub print_form {
     $form->{"IN"} =~ s/html$/odt/;
   }
 
+  delete $form->{OUT};
+
   if ($form->{media} eq 'printer') {
     $form->{OUT} = "| $form->{printer_command} &>/dev/null";
     $form->{printed} .= " $form->{formname}";
@@ -1754,7 +1758,7 @@ sub print_form {
   $emailed = $form->{emailed};
 
   if ($form->{media} eq 'queue') {
-    %queued = split / /, $form->{queued};
+    %queued = map { s|.*/|| } split / /, $form->{queued};
 
     if ($filename = $queued{ $form->{formname} }) {
       $form->{queued} =~ s/$form->{formname} $filename//;
diff --git a/bin/mozilla/ustva.pl b/bin/mozilla/ustva.pl
index 64e509ebc..8a3b3540c 100644
--- a/bin/mozilla/ustva.pl
+++ b/bin/mozilla/ustva.pl
@@ -833,6 +833,7 @@ sub generate_ustva {
       $file .= $form->{elstersteuernummer};
       #file suffix
       $file .= '.xml';
+      $file =~ s|.*/||;
       $form->{tmpfile} = "$userspath/$file";
 
       $form->{attachment_filename} = $file;
@@ -882,6 +883,7 @@ sub generate_ustva {
       $form->{attachment_filename} = "USTVA-" . $form->{period} 
       . sprintf("%02d", $form->{year} % 100) . ".txb";
       
+      $form->{attachment_filename} =~ s|.*/||;
       $form->{tmpfile} = "$userspath/" . $form->{attachment_filename};
 
       # TODO: set Output to UTF-8 or system Preference
diff --git a/users/.openoffice.org2/user/registry/data/org/openoffice/Office/Linguistic.xcu b/users/.openoffice.org2/user/registry/data/org/openoffice/Office/Linguistic.xcu
index 0dc5b5bd6..88e41b232 100644
--- a/users/.openoffice.org2/user/registry/data/org/openoffice/Office/Linguistic.xcu
+++ b/users/.openoffice.org2/user/registry/data/org/openoffice/Office/Linguistic.xcu
@@ -7,7 +7,7 @@
  </node>
  <node oor:name="ServiceManager">
   <prop oor:name="DataFilesChangedCheckValue" oor:type="xs:int">
-   <value>-411764226</value>
+   <value>-1472371459</value>
   </prop>
   <node oor:name="HyphenatorList">
    <prop oor:name="de-AT" oor:op="replace" oor:type="xs:string">