create_unique_session_value hat immer falsch auf Eindeutigkeit der Nummer geprüft

[mfinanz.git] / SL / Form.pm

diff --git a/SL/Form.pm b/SL/Form.pm
index dfff9b4f7bd6444c6d24e0dc965704bad51309d4..64412e15e87b7a61912b121091db82d952ec6e11 100644 (file)
--- a/SL/Form.pm
+++ b/SL/Form.pm
@@ -258,6 +258,16 @@ sub new {
 
   bless $self, $type;
 
 
   bless $self, $type;
 

+  $main::lxdebug->leave_sub();
+
+  return $self;
+}
+
+sub read_cgi_input {
+  $main::lxdebug->enter_sub();
+
+  my ($self) = @_;
+

   $self->_input_to_hash($ENV{QUERY_STRING}) if $ENV{QUERY_STRING};
   $self->_input_to_hash($ARGV[0])           if @ARGV && $ARGV[0];
 
   $self->_input_to_hash($ENV{QUERY_STRING}) if $ENV{QUERY_STRING};
   $self->_input_to_hash($ARGV[0])           if @ARGV && $ARGV[0];
 


@@ -268,6 +278,12 @@ sub new {
     $uploads = $self->_request_to_hash($content);
   }
 
     $uploads = $self->_request_to_hash($content);
   }
 

+  if ($self->{RESTORE_FORM_FROM_SESSION_ID}) {
+    my %temp_form;
+    $::auth->restore_form_from_session(delete $self->{RESTORE_FORM_FROM_SESSION_ID}, form => \%temp_form);
+    $self->_input_to_hash(join '&', map { $self->escape($_) . '=' . $self->escape($temp_form{$_}) } keys %temp_form);
+  }
+

   my $db_charset   = $::lx_office_conf{system}->{dbcharset};
   $db_charset    ||= Common::DEFAULT_CHARSET;
 
   my $db_charset   = $::lx_office_conf{system}->{dbcharset};
   $db_charset    ||= Common::DEFAULT_CHARSET;
 


@@ -640,6 +656,18 @@ sub create_http_response {
   return $output;
 }
 
   return $output;
 }
 

+sub use_stylesheet {
+  my $self = shift;
+
+  $self->{stylesheet} = [ $self->{stylesheet} ] unless ref $self->{stylesheet} eq 'ARRAY';
+  $self->{stylesheet} = [ grep { -f                       }
+                          map  { m:^css/: ? $_ : "css/$_" }
+                          grep { $_                       }
+                               (@{ $self->{stylesheet} }, @_)
+                        ];
+
+  return @{ $self->{stylesheet} };
+}

 
 sub header {
   $::lxdebug->enter_sub;
 
 sub header {
   $::lxdebug->enter_sub;


@@ -662,8 +690,7 @@ sub header {
     push @header, "<meta http-equiv='refresh' content='$refresh_time;$refresh_url'>";
   }
 
     push @header, "<meta http-equiv='refresh' content='$refresh_time;$refresh_url'>";
   }
 

-  push @header, "<link rel='stylesheet' href='css/$_' type='text/css' title='Lx-Office stylesheet'>"
-    for grep { -f "css/$_" } apply { s|.*/|| } $self->{stylesheet}, $self->{stylesheets};
+  push @header, map { qq|<link rel="stylesheet" href="$_" type="text/css" title="Lx-Office stylesheet">| } $self->use_stylesheet;

 
   push @header, "<style type='text/css'>\@page { size:landscape; }</style>" if $self->{landscape};
   push @header, "<link rel='shortcut icon' href='$self->{favicon}' type='image/x-icon'>" if -f $self->{favicon};
 
   push @header, "<style type='text/css'>\@page { size:landscape; }</style>" if $self->{landscape};
   push @header, "<link rel='shortcut icon' href='$self->{favicon}' type='image/x-icon'>" if -f $self->{favicon};


@@ -808,7 +835,6 @@ sub _prepare_html_template {
 
   $additional_params->{"conf_dbcharset"}              = $::lx_office_conf{system}->{dbcharset};
   $additional_params->{"conf_webdav"}                 = $::lx_office_conf{features}->{webdav};
 
   $additional_params->{"conf_dbcharset"}              = $::lx_office_conf{system}->{dbcharset};
   $additional_params->{"conf_webdav"}                 = $::lx_office_conf{features}->{webdav};

-  $additional_params->{"conf_lizenzen"}               = $::lx_office_conf{features}->{lizenzen};

   $additional_params->{"conf_latex_templates"}        = $::lx_office_conf{print_templates}->{latex};
   $additional_params->{"conf_opendocument_templates"} = $::lx_office_conf{print_templates}->{opendocument};
   $additional_params->{"conf_vertreter"}              = $::lx_office_conf{features}->{vertreter};
   $additional_params->{"conf_latex_templates"}        = $::lx_office_conf{print_templates}->{latex};
   $additional_params->{"conf_opendocument_templates"} = $::lx_office_conf{print_templates}->{opendocument};
   $additional_params->{"conf_vertreter"}              = $::lx_office_conf{features}->{vertreter};


@@ -984,6 +1010,16 @@ sub write_trigger {
   return $jsscript;
 }    #end sub write_trigger
 
   return $jsscript;
 }    #end sub write_trigger
 

+sub _store_redirect_info_in_session {
+  my ($self) = @_;
+
+  return unless $self->{callback} =~ m:^ ( [^\?/]+ \.pl ) \? (.+) :x;
+
+  my ($controller, $params) = ($1, $2);
+  my $form                  = { map { map { $self->unescape($_) } split /=/, $_, 2 } split m/\&/, $params };
+  $self->{callback}         = "${controller}?RESTORE_FORM_FROM_SESSION_ID=" . $::auth->save_form_in_session(form => $form);
+}
+

 sub redirect {
   $main::lxdebug->enter_sub();
 
 sub redirect {
   $main::lxdebug->enter_sub();
 


@@ -993,6 +1029,7 @@ sub redirect {
     $self->info($msg);
 
   } else {
     $self->info($msg);
 
   } else {

+    $self->_store_redirect_info_in_session;

     print $::form->redirect_header($self->{callback});
   }
 
     print $::form->redirect_header($self->{callback});
   }
 


@@ -1153,7 +1190,7 @@ sub parse_amount {
   if (   ($myconfig->{numberformat} eq '1.000,00')
       || ($myconfig->{numberformat} eq '1000,00')) {
     $amount =~ s/\.//g;
   if (   ($myconfig->{numberformat} eq '1.000,00')
       || ($myconfig->{numberformat} eq '1000,00')) {
     $amount =~ s/\.//g;

-    $amount =~ s/,/\./;
+    $amount =~ s/,/\./g;

   }
 
   if ($myconfig->{numberformat} eq "1'000.00") {
   }
 
   if ($myconfig->{numberformat} eq "1'000.00") {


@@ -1164,7 +1201,9 @@ sub parse_amount {
 
   $main::lxdebug->leave_sub(2);
 
 
   $main::lxdebug->leave_sub(2);
 

-  return ($amount * 1);
+  # Make sure no code wich is not a math expression ends up in eval().
+  return 0 unless $amount =~ /^ [\s \d \( \) \- \+ \* \/ \. ]* $/x;
+  return scalar(eval($amount)) * 1 ;

 }
 
 sub round_amount {
 }
 
 sub round_amount {


@@ -1638,7 +1677,7 @@ sub date_closed {
   #   Leere Datumseingabe i.O.
   #     SELECT 1 FROM defaults WHERE '' < closedto
   #   normale Zahlungsbuchung über Rechnungsmaske i.O.
   #   Leere Datumseingabe i.O.
   #     SELECT 1 FROM defaults WHERE '' < closedto
   #   normale Zahlungsbuchung über Rechnungsmaske i.O.

-  #     SELECT 1 FROM defaults WHERE '10.05.2011' < closedto 
+  #     SELECT 1 FROM defaults WHERE '10.05.2011' < closedto

   # Testfälle mit definiertem closedto (30.04.2011):
   #  Leere Datumseingabe i.O.
   #   SELECT 1 FROM defaults WHERE '' < closedto
   # Testfälle mit definiertem closedto (30.04.2011):
   #  Leere Datumseingabe i.O.
   #   SELECT 1 FROM defaults WHERE '' < closedto


@@ -1862,12 +1901,12 @@ sub set_payment_options {
   my $dbh = $self->get_standard_dbh($myconfig);
 
   my $query =
   my $dbh = $self->get_standard_dbh($myconfig);
 
   my $query =

-    qq|SELECT p.terms_netto, p.terms_skonto, p.percent_skonto, p.description_long | .
+    qq|SELECT p.terms_netto, p.terms_skonto, p.percent_skonto, p.description_long , p.description | .

     qq|FROM payment_terms p | .
     qq|WHERE p.id = ?|;
 
   ($self->{terms_netto}, $self->{terms_skonto}, $self->{percent_skonto},
     qq|FROM payment_terms p | .
     qq|WHERE p.id = ?|;
 
   ($self->{terms_netto}, $self->{terms_skonto}, $self->{percent_skonto},

-   $self->{payment_terms}) =
+   $self->{payment_terms}, $self->{payment_description}) =

      selectrow_query($self, $dbh, $query, $self->{payment_id});
 
   if ($transdate eq "") {
      selectrow_query($self, $dbh, $query, $self->{payment_id});
 
   if ($transdate eq "") {


@@ -3812,7 +3851,7 @@ Examples:
 =head2 C<header>
 
 Generates a general purpose http/html header and includes most of the scripts
 =head2 C<header>
 
 Generates a general purpose http/html header and includes most of the scripts

-ans stylesheets needed.
+and stylesheets needed. Stylesheets can be added with L<use_stylesheet>.

 
 Only one header will be generated. If the method was already called in this
 request it will not output anything and return undef. Also if no
 
 Only one header will be generated. If the method was already called in this
 request it will not output anything and return undef. Also if no


@@ -3832,9 +3871,8 @@ default to 3 seconds and the refering url.
 
 =item stylesheet
 
 
 =item stylesheet
 

-=item stylesheets
-
-If these are arrayrefs the contents will be inlined into the header.
+Either a scalar or an array ref. Will be inlined into the header. Add
+stylesheets with the L<use_stylesheet> function.

 
 =item landscape
 
 
 =item landscape