Der direkte Zugriff per Webbrowser auf einige Verzeichniss muss verhindert werden.

[mfinanz.git] / SL / IS.pm

diff --git a/SL/IS.pm b/SL/IS.pm
index 24f8f0f17f69c96e8cca5295a38c025f96c0ea82..f546b51078036e56789b0f11d09c5b27debdca39 100644 (file)
--- a/SL/IS.pm
+++ b/SL/IS.pm
@@ -103,7 +103,7 @@ sub invoice_details {
 
     $form->{"qty_$i"} = $form->parse_amount($myconfig, $form->{"qty_$i"});
 
-    if ($form->{"qty_$i"} != 0) {
+    if ($form->{"id_$i"} != 0) {
 
       # add number, description and qty to $form->{number},
       if ($form->{"subtotal_$i"} && !$subtotal_header) {
@@ -357,9 +357,10 @@ sub invoice_details {
     ($form->{taxincluded}) ? $form->{total} : $form->{total} + $tax;
   $form->{total} =
     $form->format_amount($myconfig, $form->{invtotal} - $form->{paid}, 2);
+
   $form->{invtotal} = $form->format_amount($myconfig, $form->{invtotal}, 2);
-  $form->set_payment_options($myconfig, $form->{invdate});
   $form->{paid} = $form->format_amount($myconfig, $form->{paid}, 2);
+  $form->set_payment_options($myconfig, $form->{invdate});
 
   $form->{username} = $myconfig->{name};
 
@@ -391,7 +392,7 @@ sub project_description {
 sub customer_details {
   $main::lxdebug->enter_sub();
 
-  my ($self, $myconfig, $form) = @_;
+  my ($self, $myconfig, $form, @wanted_vars) = @_;
 
   # connect to database
   my $dbh = $form->dbconnect($myconfig);
@@ -416,6 +417,14 @@ sub customer_details {
 
   # remove id and taxincluded before copy back
   delete @$ref{qw(id taxincluded)};
+
+  @wanted_vars = grep({ $_ } @wanted_vars);
+  if (scalar(@wanted_vars) > 0) {
+    my %h_wanted_vars;
+    map({ $h_wanted_vars{$_} = 1; } @wanted_vars);
+    map({ delete($ref->{$_}) unless ($h_wanted_vars{$_}); } keys(%{$ref}));
+  }
+
   map { $form->{$_} = $ref->{$_} } keys %$ref;
   $sth->finish;
 
@@ -543,7 +552,7 @@ sub post_invoice {
       $form->{"qty_$i"} *= -1;
     }
 
-    if ($form->{"qty_$i"} != 0) {
+    if ($form->{"id_$i"}) {
 
       # get item baseunit
       $query = qq|SELECT p.unit