Umformatieren der Abfragen und Vermeidung von SQL injection durch Verwendung von...

[mfinanz.git] / SL / Form.pm

diff --git a/SL/Form.pm b/SL/Form.pm
index 90ac919ef01111f576236de03aac426947bb0cd8..7636b16595b6ed42ca5efb4a4ec3191ec59602a3 100644 (file)
--- a/SL/Form.pm
+++ b/SL/Form.pm
@@ -1092,7 +1092,7 @@ sub get_exchangerate {
 
   unless ($transdate) {
     $main::lxdebug->leave_sub();
 
   unless ($transdate) {
     $main::lxdebug->leave_sub();

-    return "";
+    return 1;

   }
 
   my $query = qq|SELECT e.$fld FROM exchangerate e
   }
 
   my $query = qq|SELECT e.$fld FROM exchangerate e


@@ -1104,7 +1104,7 @@ sub get_exchangerate {
   my ($exchangerate) = $sth->fetchrow_array;
   $sth->finish;
 
   my ($exchangerate) = $sth->fetchrow_array;
   $sth->finish;
 

-  if ($exchangerate == 0) {
+  if (!$exchangerate) {

     $exchangerate = 1;
   }
 
     $exchangerate = 1;
   }
 


@@ -2248,9 +2248,12 @@ sub save_history {
                &get_employee($self, $dbh);
        }
        
                &get_employee($self, $dbh);
        }
        

-       my $query = qq|INSERT INTO status (trans_id, employee_id, addition, what_done) 
-                                  VALUES ($self->{id}, $self->{employee_id}, '$self->{addition}', '$self->{what_done}')|;
-       $dbh->do($query) || $self->dberror($query);
+       my $query =
+    qq|INSERT INTO history_erp (trans_id, employee_id, addition, what_done) | .
+    qq|VALUES (?, ?, ?, ?)|;
+  my @values = (conv_i($self->{id}), conv_i($self->{employee_id}),
+                $self->{addition}, $self->{what_done});
+  do_query($self, $dbh, $query, @values);

        
        $main::lxdebug->leave_sub();
 }
        
        $main::lxdebug->leave_sub();
 }


@@ -2264,27 +2267,29 @@ sub get_history {
        my $restriction = shift();
        my @tempArray;
        my $i = 0;
        my $restriction = shift();
        my @tempArray;
        my $i = 0;

-       if($trans_id ne ""){
-               my $query = qq|SELECT st.employee_id, st.itime, st.addition, st.what_done, emp.name 
-                                  FROM status st 
-                                  LEFT JOIN employee emp 
-                                  ON emp.id = st.employee_id
-                                  WHERE trans_id = $trans_id|
-                                  . $restriction;
+       if ($trans_id ne "") {
+               my $query =
+      qq|SELECT h.employee_id, h.itime::timestamp(0) AS itime, h.addition, h.what_done, emp.name | .
+      qq|FROM history_erp h | .
+      qq|LEFT JOIN employee emp | .
+      qq|ON emp.id = h.employee_id | .
+      qq|WHERE trans_id = ? |
+      . $restriction;

        
                my $sth = $dbh->prepare($query) || $self->dberror($query);
        
        
                my $sth = $dbh->prepare($query) || $self->dberror($query);
        

-               $sth->execute() || $self->dberror($query);
+               $sth->execute($trans_id) || $self->dberror("$query ($trans_id)");

 
                while(my $hash_ref = $sth->fetchrow_hashref()) {
                        $hash_ref->{addition} = $main::locale->text($hash_ref->{addition});
                        $hash_ref->{what_done} = $main::locale->text($hash_ref->{what_done});
                        $tempArray[$i++] = $hash_ref; 
                }
 
                while(my $hash_ref = $sth->fetchrow_hashref()) {
                        $hash_ref->{addition} = $main::locale->text($hash_ref->{addition});
                        $hash_ref->{what_done} = $main::locale->text($hash_ref->{what_done});
                        $tempArray[$i++] = $hash_ref; 
                }

-               return \@tempArray if ($i > 0 && $tempArray[0] ne "");
+    $main::lxdebug->leave_sub() and return \@tempArray
+      if ($i > 0 && $tempArray[0] ne "");

        }
        }

-       return 0;

        $main::lxdebug->leave_sub();
        $main::lxdebug->leave_sub();

+       return 0;

 }
 
 sub save_status {
 }
 
 sub save_status {