Merge branch 'master' of vc.linet-services.de:public/lx-office-erp

[mfinanz.git] / SL / VK.pm

diff --git a/SL/VK.pm b/SL/VK.pm
index 9cf8bed8b1c46df11b9e1968306e9b1115ec1506..55c46f2346f9735a09a4869314c115767ac64da3 100644 (file)
--- a/SL/VK.pm
+++ b/SL/VK.pm
@@ -77,8 +77,13 @@ sub invoice_transactions {
   # Bestandteile von Erzeugnissen herausfiltern
   $where .= " AND i.assemblyitem is not true ";
 
   # Bestandteile von Erzeugnissen herausfiltern
   $where .= " AND i.assemblyitem is not true ";
 

-  my $sortorder;
+  # filter allowed parameters for mainsort and subsort as passed by POST
+  my @databasefields = qw(description customername country partsgroup business salesman month);
+  my ($mainsort) = grep { /^$form->{mainsort}$/ } @databasefields;
+  my ($subsort) = grep { /^$form->{subsort}$/ } @databasefields;
+  die "illegal parameter for mainsort or subsort" unless $mainsort and $subsort;

 
 

+  my $sortorder;

   # sorting by month is a special case, we don't want to sort alphabetically by
   # month name, so we also extract a numerical month in the from YYYYMM to sort
   # by in case of month sorting
   # sorting by month is a special case, we don't want to sort alphabetically by
   # month name, so we also extract a numerical month in the from YYYYMM to sort
   # by in case of month sorting


@@ -88,16 +93,15 @@ sub invoice_transactions {
   if ($form->{mainsort} eq 'month') {
     $sortorder .= "nummonth,"
   } else {
   if ($form->{mainsort} eq 'month') {
     $sortorder .= "nummonth,"
   } else {

-    $sortorder .= $form->{mainsort} . ",";
+    $sortorder .= $mainsort . ",";

   };
   if ($form->{subsort} eq 'month') {
     $sortorder .= "nummonth,"
   } else {
   };
   if ($form->{subsort} eq 'month') {
     $sortorder .= "nummonth,"
   } else {

-    $sortorder .= $form->{subsort} . ",";
+    $sortorder .= $subsort . ",";

   };
   $sortorder .= 'ar.transdate,ar.invnumber';  # Default sorting order after mainsort und subsort
 
   };
   $sortorder .= 'ar.transdate,ar.invnumber';  # Default sorting order after mainsort und subsort
 

-

   if ($form->{customer_id}) {
     $where .= " AND ar.customer_id = ?";
     push(@values, $form->{customer_id});
   if ($form->{customer_id}) {
     $where .= " AND ar.customer_id = ?";
     push(@values, $form->{customer_id});