From: Sven Schöling <s.schoeling@googlemail.com>
Date: Fri, 26 Nov 2021 09:18:50 +0000 (+0100)
Subject: datev templates escaping
X-Git-Tag: kivitendo-mebil_0.1-0~10^2~2^2~274
X-Git-Url: http://wagnertech.de/git?a=commitdiff_plain;h=f73177e81996e64ef135a46d5ff68457e45b4f0e;p=kivitendo-erp.git

datev templates escaping
---

diff --git a/templates/webpages/datev/export.html b/templates/webpages/datev/export.html
index d7bd915d4..2e1fc6219 100644
--- a/templates/webpages/datev/export.html
+++ b/templates/webpages/datev/export.html
@@ -1,8 +1,8 @@
 [%- USE T8 %]
 [%- USE L %]
-<h1>[% 'DATEX - Export Assistent' | $T8 %]</h1>
+<h1>[% 'DATEV - Export Assistent' | $T8 %]</h1>
 
-<form method='post' action='[% script %]' id='form'>
+<form method='post' action='[% script | html %]' id='form'>
 
 <table width=100%>
   <tr>
@@ -14,31 +14,31 @@
       <table>
         <tr>
           <td align=left nowrap>[% 'Beraternummer' | $T8 %]</td>
-          <td><input name=beraternr size=10 maxlength=7 value="[% beraternr %]"></td>
+          <td>[% L.input_tag("beraternr", beraternr, size=10, maxlength=7) %]</td>
 
           <td align=left nowrap>[% 'DFV-Kennzeichen' | $T8 %]</td>
-          <td><input name=dfvkz size=5 maxlength=2 value="[% dfvkz %]"></td>
+          <td>[% L.input_tag("dfvkz", dfvkz, size=5, maxlength=2) %]</td>
         </tr>
         <tr>
           <td align=left nowrap>[% 'Beratername' | $T8 %]</td>
-          <td><input name=beratername size=10 maxlength=9 value="[% beratername %]"></td>
+          <td>[% L.input_tag("beratername", berater, size=10, maxlength=9) %]</td>
 
           <td align=left nowrap>[% 'Password' | $T8 %]</td>
-          <td><input name=passwort size=5 maxlength=4 value="[% passwort %]"></td>
+          <td>[% L.input_tag("passwort", passwort, size=5, maxlength=4) %]</td>
         </tr>
         <tr>
           <td align=left nowrap>[% 'Mandantennummer' | $T8 %]</td>
-          <td><input name=mandantennr size=10 maxlength=5 value="[% mandantennr %]"></td>
+          <td>[% L.input_tag("mandantennr", mandantennr, size=10, maxlength=5) %]</td>
 
           <td align=left nowrap>[% 'Medium Number' | $T8 %]</td>
-          <td><input name=datentraegernr size=5 maxlength=3 value="[% datentraegernr %]"></td>
+          <td>[% L.input_tag("datentraegernr", datentraegernr, size=5, maxlength=3) %]</td>
         </tr>
         <tr>
           <td></td>
           <td></td>
 
           <td align=left nowrap>[% 'Abrechnungsnummer' | $T8 %]</td>
-          <td><input name=abrechnungsnr size=5 maxlength=3 value="[% abrechnungsnr %]"></td>
+          <td>[% L.input_tag("abrechnungsnr", abrechnungsnr, size=5, maxlength=3) %]</td>
         </tr>
       </table>
     </td>
diff --git a/templates/webpages/datev/export_bewegungsdaten.html b/templates/webpages/datev/export_bewegungsdaten.html
index 89bc58281..80f6c3a51 100644
--- a/templates/webpages/datev/export_bewegungsdaten.html
+++ b/templates/webpages/datev/export_bewegungsdaten.html
@@ -95,11 +95,11 @@
           [% IF show_pk_option %]
            <td align=left>[% 'Export with CV Charts' | $T8 %]</td>
            <td align=left></td>
-           <td>[% L.checkbox_tag('use_pk', value => 1, checked => 0) %]</td>
+           <td>[% L.checkbox_tag('use_pk', value = 1, checked = 0) %]</td>
           [% ELSE %]
            <td align=left><font color="gray">[% 'Export with CV Charts' | $T8 %]</font></td>
            <td align=left></td>
-           <td>[% L.checkbox_tag('use_pk', value => 1, checked => 0, disabled => 1) %] </td>
+           <td>[% L.checkbox_tag('use_pk', value = 1, checked = 0, disabled = 1) %] </td>
            <td colspan="2"><font color="gray">[% 'Hint: Not all VC Numbers are personal accounts compliant' | $T8 %]</font></td>
           [% END %]
          </tr>
@@ -121,15 +121,15 @@
   </tr>
 </table>
 
-<input type=hidden name=beraternr value="[% beraternr %]">
-<input type=hidden name=dfvkz value="[% dfvkz %]">
-<input type=hidden name=beratername value="[% beratername %]">
-<input type=hidden name=passwort value="[% passwort %]">
-<input type=hidden name=mandantennr value="[% mandantennr %]">
-<input type=hidden name=datentraegernr value="[% datentraegernr %]">
-<input type=hidden name=exportformat value="[% exportformat %]">
-<input type=hidden name=abrechnungsnr value="[% abrechnungsnr %]">
+<input type=hidden name=beraternr value="[% beraternr | html %]">
+<input type=hidden name=dfvkz value="[% dfvkz | html %]">
+<input type=hidden name=beratername value="[% beratername | html %]">
+<input type=hidden name=passwort value="[% passwort | html %]">
+<input type=hidden name=mandantennr value="[% mandantennr | html %]">
+<input type=hidden name=datentraegernr value="[% datentraegernr | html %]">
+<input type=hidden name=exportformat value="[% exportformat | html %]">
+<input type=hidden name=abrechnungsnr value="[% abrechnungsnr | html %]">
 
-<input type=hidden name=exporttype value="[% exporttype %]">
+<input type=hidden name=exporttype value="[% exporttype | html %]">
 
 </form>
diff --git a/templates/webpages/datev/net_gross_difference.html b/templates/webpages/datev/net_gross_difference.html
index 238e58b9d..f2e19e1da 100644
--- a/templates/webpages/datev/net_gross_difference.html
+++ b/templates/webpages/datev/net_gross_difference.html
@@ -21,7 +21,7 @@
 </p>
 
 <p>
- In dem gerade durchgeführten Export gab es [% net_gross_differences.size %]
+ In dem gerade durchgeführten Export gab es [% net_gross_differences.size | html %]
  solcher Fälle. Die Summe aller Abweichungen beläuft sich auf
  [% LxERP.format_amount(sum_net_gross_differences, 2) %].
 </p>