From f73177e81996e64ef135a46d5ff68457e45b4f0e Mon Sep 17 00:00:00 2001
From: =?utf8?q?Sven=20Sch=C3=B6ling?= <s.schoeling@googlemail.com>
Date: Fri, 26 Nov 2021 10:18:50 +0100
Subject: [PATCH] datev templates escaping

---
 templates/webpages/datev/export.html          | 18 +++++++--------
 .../webpages/datev/export_bewegungsdaten.html | 22 +++++++++----------
 .../webpages/datev/net_gross_difference.html  |  2 +-
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/templates/webpages/datev/export.html b/templates/webpages/datev/export.html
index d7bd915d4..2e1fc6219 100644
--- a/templates/webpages/datev/export.html
+++ b/templates/webpages/datev/export.html
@@ -1,8 +1,8 @@
 [%- USE T8 %]
 [%- USE L %]
-<h1>[% 'DATEX - Export Assistent' | $T8 %]</h1>
+<h1>[% 'DATEV - Export Assistent' | $T8 %]</h1>
 
-<form method='post' action='[% script %]' id='form'>
+<form method='post' action='[% script | html %]' id='form'>
 
 <table width=100%>
   <tr>
@@ -14,31 +14,31 @@
       <table>
         <tr>
           <td align=left nowrap>[% 'Beraternummer' | $T8 %]</td>
-          <td><input name=beraternr size=10 maxlength=7 value="[% beraternr %]"></td>
+          <td>[% L.input_tag("beraternr", beraternr, size=10, maxlength=7) %]</td>
 
           <td align=left nowrap>[% 'DFV-Kennzeichen' | $T8 %]</td>
-          <td><input name=dfvkz size=5 maxlength=2 value="[% dfvkz %]"></td>
+          <td>[% L.input_tag("dfvkz", dfvkz, size=5, maxlength=2) %]</td>
         </tr>
         <tr>
           <td align=left nowrap>[% 'Beratername' | $T8 %]</td>
-          <td><input name=beratername size=10 maxlength=9 value="[% beratername %]"></td>
+          <td>[% L.input_tag("beratername", berater, size=10, maxlength=9) %]</td>
 
           <td align=left nowrap>[% 'Password' | $T8 %]</td>
-          <td><input name=passwort size=5 maxlength=4 value="[% passwort %]"></td>
+          <td>[% L.input_tag("passwort", passwort, size=5, maxlength=4) %]</td>
         </tr>
         <tr>
           <td align=left nowrap>[% 'Mandantennummer' | $T8 %]</td>
-          <td><input name=mandantennr size=10 maxlength=5 value="[% mandantennr %]"></td>
+          <td>[% L.input_tag("mandantennr", mandantennr, size=10, maxlength=5) %]</td>
 
           <td align=left nowrap>[% 'Medium Number' | $T8 %]</td>
-          <td><input name=datentraegernr size=5 maxlength=3 value="[% datentraegernr %]"></td>
+          <td>[% L.input_tag("datentraegernr", datentraegernr, size=5, maxlength=3) %]</td>
         </tr>
         <tr>
           <td></td>
           <td></td>
 
           <td align=left nowrap>[% 'Abrechnungsnummer' | $T8 %]</td>
-          <td><input name=abrechnungsnr size=5 maxlength=3 value="[% abrechnungsnr %]"></td>
+          <td>[% L.input_tag("abrechnungsnr", abrechnungsnr, size=5, maxlength=3) %]</td>
         </tr>
       </table>
     </td>
diff --git a/templates/webpages/datev/export_bewegungsdaten.html b/templates/webpages/datev/export_bewegungsdaten.html
index 89bc58281..80f6c3a51 100644
--- a/templates/webpages/datev/export_bewegungsdaten.html
+++ b/templates/webpages/datev/export_bewegungsdaten.html
@@ -95,11 +95,11 @@
           [% IF show_pk_option %]
            <td align=left>[% 'Export with CV Charts' | $T8 %]</td>
            <td align=left></td>
-           <td>[% L.checkbox_tag('use_pk', value => 1, checked => 0) %]</td>
+           <td>[% L.checkbox_tag('use_pk', value = 1, checked = 0) %]</td>
           [% ELSE %]
            <td align=left><font color="gray">[% 'Export with CV Charts' | $T8 %]</font></td>
            <td align=left></td>
-           <td>[% L.checkbox_tag('use_pk', value => 1, checked => 0, disabled => 1) %] </td>
+           <td>[% L.checkbox_tag('use_pk', value = 1, checked = 0, disabled = 1) %] </td>
            <td colspan="2"><font color="gray">[% 'Hint: Not all VC Numbers are personal accounts compliant' | $T8 %]</font></td>
           [% END %]
          </tr>
@@ -121,15 +121,15 @@
   </tr>
 </table>
 
-<input type=hidden name=beraternr value="[% beraternr %]">
-<input type=hidden name=dfvkz value="[% dfvkz %]">
-<input type=hidden name=beratername value="[% beratername %]">
-<input type=hidden name=passwort value="[% passwort %]">
-<input type=hidden name=mandantennr value="[% mandantennr %]">
-<input type=hidden name=datentraegernr value="[% datentraegernr %]">
-<input type=hidden name=exportformat value="[% exportformat %]">
-<input type=hidden name=abrechnungsnr value="[% abrechnungsnr %]">
+<input type=hidden name=beraternr value="[% beraternr | html %]">
+<input type=hidden name=dfvkz value="[% dfvkz | html %]">
+<input type=hidden name=beratername value="[% beratername | html %]">
+<input type=hidden name=passwort value="[% passwort | html %]">
+<input type=hidden name=mandantennr value="[% mandantennr | html %]">
+<input type=hidden name=datentraegernr value="[% datentraegernr | html %]">
+<input type=hidden name=exportformat value="[% exportformat | html %]">
+<input type=hidden name=abrechnungsnr value="[% abrechnungsnr | html %]">
 
-<input type=hidden name=exporttype value="[% exporttype %]">
+<input type=hidden name=exporttype value="[% exporttype | html %]">
 
 </form>
diff --git a/templates/webpages/datev/net_gross_difference.html b/templates/webpages/datev/net_gross_difference.html
index 238e58b9d..f2e19e1da 100644
--- a/templates/webpages/datev/net_gross_difference.html
+++ b/templates/webpages/datev/net_gross_difference.html
@@ -21,7 +21,7 @@
 </p>
 
 <p>
- In dem gerade durchgeführten Export gab es [% net_gross_differences.size %]
+ In dem gerade durchgeführten Export gab es [% net_gross_differences.size | html %]
  solcher Fälle. Die Summe aller Abweichungen beläuft sich auf
  [% LxERP.format_amount(sum_net_gross_differences, 2) %].
 </p>
-- 
2.20.1