Projekt

Allgemein

Profil

« Zurück | Weiter » 

Revision 5cf977e5

Von Moritz Bunkus vor etwa 17 Jahren hinzugefügt

  • ID 5cf977e52788c523150fa19225b90914e6ddc909
  • Vorgänger ee3ab257
  • Nachfolger d7def35a

Quoten von allen in regulären Ausdrücken verwendeten Variablen, die direkt oder indirekt von Benutzereingaben stammen können. Fix für Bug 302.

Unterschiede anzeigen:

SL/Form.pm
2231 2231
    while ($ref = $sth->fetchrow_hashref(NAME_lc)) {
2232 2232

  
2233 2233
      foreach my $key (split(/:/, $ref->{link})) {
2234
        if ($key =~ /$module/) {
2234
        if ($key =~ /\Q$module\E/) {
2235 2235

  
2236 2236
          # cross reference for keys
2237 2237
          $xkeyref{ $ref->{accno} } = $key;
......
2300 2300
    while ($ref = $sth->fetchrow_hashref(NAME_lc)) {
2301 2301

  
2302 2302
      foreach my $key (split(/:/, $ref->{link})) {
2303
        if ($key =~ /$module/) {
2303
        if ($key =~ /\Q$module\E/) {
2304 2304

  
2305 2305
          # cross reference for keys
2306 2306
          $xkeyref{ $ref->{accno} } = $key;
......
2532 2532
  }
2533 2533
  $sth->finish();
2534 2534

  
2535
  my $printed = ($self->{printed} =~ /$self->{formname}/) ? "1" : "0";
2536
  my $emailed = ($self->{emailed} =~ /$self->{formname}/) ? "1" : "0";
2535
  my $printed = ($self->{printed} =~ /\Q$self->{formname}\E/) ? "1" : "0";
2536
  my $emailed = ($self->{emailed} =~ /\Q$self->{formname}\E/) ? "1" : "0";
2537 2537

  
2538 2538
  my %queued = split / /, $self->{queued};
2539 2539
  my @values;
......
2588 2588
    my %queued = split / /, $self->{queued};
2589 2589

  
2590 2590
    foreach my $formname (keys %queued) {
2591
      $printed = ($self->{printed} =~ /$self->{formname}/) ? "1" : "0";
2592
      $emailed = ($self->{emailed} =~ /$self->{formname}/) ? "1" : "0";
2591
      $printed = ($self->{printed} =~ /\Q$self->{formname}\E/) ? "1" : "0";
2592
      $emailed = ($self->{emailed} =~ /\Q$self->{formname}\E/) ? "1" : "0";
2593 2593

  
2594 2594
      $query = qq|INSERT INTO status (trans_id, printed, emailed, spoolfile, formname)
2595 2595
                  VALUES (?, ?, ?, ?, ?)|;
2596 2596
      do_query($self, $dbh, $query, $self->{id}, $printed, $emailed, $queued{$formname}, $formname);
2597 2597

  
2598
      $formnames  =~ s/$self->{formname}//;
2599
      $emailforms =~ s/$self->{formname}//;
2598
      $formnames  =~ s/\Q$self->{formname}\E//;
2599
      $emailforms =~ s/\Q$self->{formname}\E//;
2600 2600

  
2601 2601
    }
2602 2602
  }
......
2610 2610
  map { $status{$_}{emailed} = 1 } split / +/, $emailforms;
2611 2611

  
2612 2612
  foreach my $formname (keys %status) {
2613
    $printed = ($formnames  =~ /$self->{formname}/) ? "1" : "0";
2614
    $emailed = ($emailforms =~ /$self->{formname}/) ? "1" : "0";
2613
    $printed = ($formnames  =~ /\Q$self->{formname}\E/) ? "1" : "0";
2614
    $emailed = ($emailforms =~ /\Q$self->{formname}\E/) ? "1" : "0";
2615 2615

  
2616 2616
    $query = qq|INSERT INTO status (trans_id, printed, emailed, formname)
2617 2617
                VALUES (?, ?, ?, ?)|;
SL/IC.pm
577 577
  $form->{taxaccount} = "";
578 578
  while ($ptr = $stw->fetchrow_hashref(NAME_lc)) {
579 579
    $form->{taxaccount} .= "$ptr->{accno} ";
580
    if (!($form->{taxaccount2} =~ /$ptr->{accno}/)) {
580
    if (!($form->{taxaccount2} =~ /\Q$ptr->{accno}\E/)) {
581 581
      $form->{"$ptr->{accno}_rate"}        = $ptr->{rate};
582 582
      $form->{"$ptr->{accno}_description"} = $ptr->{description};
583 583
      $form->{"$ptr->{accno}_taxnumber"}   = $ptr->{taxnumber};
......
1562 1562
  my $sth = prepare_execute_query($form, $dbh, $query, @values);
1563 1563
  while (my $ref = $sth->fetchrow_hashref(NAME_lc)) {
1564 1564
    foreach my $key (split(/:/, $ref->{link})) {
1565
      if ($key =~ /$module/) {
1565
      if ($key =~ /\Q$module\E/) {
1566 1566
        if (   ($ref->{id} eq $ref->{inventory_accno_id})
1567 1567
            || ($ref->{id} eq $ref->{income_accno_id})
1568 1568
            || ($ref->{id} eq $ref->{expense_accno_id})) {
SL/IR.pm
532 532

  
533 533
  # add shipto
534 534
  $form->{name} = $form->{vendor};
535
  $form->{name} =~ s/--$form->{vendor_id}//;
535
  $form->{name} =~ s/--\Q$form->{vendor_id}\E//;
536 536
  $form->add_shipto($dbh, $form->{id}, "AP");
537 537

  
538 538
  # delete zero entries
......
786 786

  
787 787
      $ref->{taxaccounts} .= "$ptr->{accno} ";
788 788

  
789
      if (!($form->{taxaccounts} =~ /$ptr->{accno}/)) {
789
      if (!($form->{taxaccounts} =~ /\Q$ptr->{accno}\E/)) {
790 790
        $form->{"$ptr->{accno}_rate"}         = $ptr->{rate};
791 791
        $form->{"$ptr->{accno}_description"}  = $ptr->{taxdescription};
792 792
        $form->{"$ptr->{accno}_taxnumber"}    = $ptr->{taxnumber};
......
1033 1033

  
1034 1034
      $ref->{taxaccounts} .= "$ptr->{accno} ";
1035 1035

  
1036
      if (!($form->{taxaccounts} =~ /$ptr->{accno}/)) {
1036
      if (!($form->{taxaccounts} =~ /\Q$ptr->{accno}\E/)) {
1037 1037
        $form->{"$ptr->{accno}_rate"}         = $ptr->{rate};
1038 1038
        $form->{"$ptr->{accno}_description"}  = $ptr->{taxdescription};
1039 1039
        $form->{"$ptr->{accno}_taxnumber"}    = $ptr->{taxnumber};
SL/IS.pm
780 780

  
781 781
  foreach my $trans_id (keys %{ $form->{amount} }) {
782 782
    foreach my $accno (keys %{ $form->{amount}{$trans_id} }) {
783
      next unless ($form->{expense_inventory} =~ /$accno/);
783
      next unless ($form->{expense_inventory} =~ /\Q$accno\E/);
784 784

  
785 785
      $form->{amount}{$trans_id}{$accno} = $form->round_amount($form->{amount}{$trans_id}{$accno}, 2);
786 786

  
......
979 979

  
980 980
  # add shipto
981 981
  $form->{name} = $form->{customer};
982
  $form->{name} =~ s/--$form->{customer_id}//;
982
  $form->{name} =~ s/--\Q$form->{customer_id}\E//;
983 983

  
984 984
  if (!$form->{shipto_id}) {
985 985
    $form->add_shipto($dbh, $form->{id}, "AR");
......
1458 1458
        }
1459 1459
        $ref->{taxaccounts} .= "$ptr->{accno} ";
1460 1460

  
1461
        if (!($form->{taxaccounts} =~ /$ptr->{accno}/)) {
1461
        if (!($form->{taxaccounts} =~ /\Q$ptr->{accno}\E/)) {
1462 1462
          $form->{"$ptr->{accno}_rate"}        = $ptr->{rate};
1463 1463
          $form->{"$ptr->{accno}_description"} = $ptr->{taxdescription};
1464 1464
          $form->{"$ptr->{accno}_taxnumber"}   = $ptr->{taxnumber};
......
1801 1801
      }
1802 1802
      $ref->{taxaccounts} .= "$ptr->{accno} ";
1803 1803

  
1804
      if (!($form->{taxaccounts} =~ /$ptr->{accno}/)) {
1804
      if (!($form->{taxaccounts} =~ /\Q$ptr->{accno}\E/)) {
1805 1805
        $form->{"$ptr->{accno}_rate"}        = $ptr->{rate};
1806 1806
        $form->{"$ptr->{accno}_description"} = $ptr->{taxdescription};
1807 1807
        $form->{"$ptr->{accno}_taxnumber"}   = $ptr->{taxnumber};
SL/Mailer.pm
152 152
      } else {
153 153
        $filename = $attachment;
154 154
        # strip path
155
        $filename =~ s/(.*\/|$self->{fileid})//g;
155
        $filename =~ s/(.*\/|\Q$self->{fileid}\E)//g;
156 156
      }
157 157

  
158 158
      my $application =
SL/OE.pm
444 444

  
445 445
  # add shipto
446 446
  $form->{name} = $form->{ $form->{vc} };
447
  $form->{name} =~ s/--$form->{"$form->{vc}_id"}//;
447
  $form->{name} =~ s/--\Q$form->{"$form->{vc}_id"}\E//;
448 448

  
449 449
  if (!$form->{shipto_id}) {
450 450
    $form->add_shipto($dbh, $form->{id}, "OE");
......
824 824
          $ptr->{accno} = $i;
825 825
        }
826 826
        $ref->{taxaccounts} .= "$ptr->{accno} ";
827
        if (!($form->{taxaccounts} =~ /$ptr->{accno}/)) {
827
        if (!($form->{taxaccounts} =~ /\Q$ptr->{accno}\E/)) {
828 828
          $form->{"$ptr->{accno}_rate"}        = $ptr->{rate};
829 829
          $form->{"$ptr->{accno}_description"} = $ptr->{taxdescription};
830 830
          $form->{"$ptr->{accno}_taxnumber"}   = $ptr->{taxnumber};
SL/ReportGenerator.pm
231 231
  my $self   = shift;
232 232
  my $format = shift;
233 233

  
234
  return grep { my $c = $self->{columns}->{$_}; $c && $c->{visible} && (($c->{visible} == 1) || ($c->{visible} =~ /${format}/i)) } @{ $self->{column_order} };
234
  return grep { my $c = $self->{columns}->{$_}; $c && $c->{visible} && (($c->{visible} == 1) || ($c->{visible} =~ /\Q${format}\E/i)) } @{ $self->{column_order} };
235 235
}
236 236

  
237 237
sub html_format {
SL/Template.pm
503 503
    return 0;
504 504
  }
505 505

  
506
  $form->{tmpfile} =~ s/$userspath\///g;
506
  $form->{tmpfile} =~ s/\Q$userspath\E\///g;
507 507

  
508 508
  for (my $run = 1; $run <= 2; $run++) {
509 509
    system("latex --interaction=nonstopmode $form->{tmpfile} " .
......
542 542
    return 0;
543 543
  }
544 544

  
545
  $form->{tmpfile} =~ s/$userspath\///g;
545
  $form->{tmpfile} =~ s/\Q$userspath\E\///g;
546 546

  
547 547
  for (my $run = 1; $run <= 2; $run++) {
548 548
    system("pdflatex --interaction=nonstopmode $form->{tmpfile} " .
......
650 650
    return 0;
651 651
  }
652 652

  
653
  $form->{"tmpfile"} =~ s/$userspath\///g;
653
  $form->{"tmpfile"} =~ s/\Q$userspath\E\///g;
654 654
  my $psfile = $form->{"tmpfile"};
655 655
  $psfile =~ s/.html/.ps/;
656 656
  if ($psfile eq $form->{"tmpfile"}) {
......
683 683
    return 0;
684 684
  }
685 685

  
686
  $form->{"tmpfile"} =~ s/$userspath\///g;
686
  $form->{"tmpfile"} =~ s/\Q$userspath\E\///g;
687 687
  my $pdffile = $form->{"tmpfile"};
688 688
  $pdffile =~ s/.html/.pdf/;
689 689
  if ($pdffile eq $form->{"tmpfile"}) {
SL/User.pm
830 830

  
831 831
    foreach my $upgradescript (@upgradescripts) {
832 832
      my $a = $upgradescript;
833
      $a =~ s/^$form->{dbdriver}-upgrade-|\.(sql|pl)$//g;
833
      $a =~ s/^\Q$form->{dbdriver}\E-upgrade-|\.(sql|pl)$//g;
834 834
      my $file_type = $1;
835 835

  
836 836
      my ($mindb, $maxdb) = split /-/, $a;
......
1036 1036
  truncate(CONF, 0);
1037 1037

  
1038 1038
  while ($line = shift @config) {
1039
    if ($line =~ /^\[$self->{login}\]/) {
1039
    if ($line =~ /^\[\Q$self->{login}\E\]/) {
1040 1040
      $newmember = 0;
1041 1041
      last;
1042 1042
    }
bin/mozilla/admin.pl
438 438
        open(TEMP, "$templates/$file")
439 439
          or $form->error("$templates/$file : $ERRNO");
440 440

  
441
        $file =~ s/$form->{mastertemplates}-//;
441
        $file =~ s/\Q$form->{mastertemplates}\E-//;
442 442
        open(NEW, ">$form->{templates}/$file")
443 443
          or $form->error("$form->{templates}/$file : $ERRNO");
444 444

  
bin/mozilla/am.pl
1688 1688

  
1689 1689
  if ($form->{id}) {
1690 1690
    $form->{selectIC} =~ s/selected//g;
1691
    $form->{selectIC} =~ s/ value=$form->{inventory_accno_id}/  value=$form->{inventory_accno_id} selected/;
1691
    $form->{selectIC} =~ s/ value=\Q$form->{inventory_accno_id}\E/  value=$form->{inventory_accno_id} selected/;
1692 1692
    $form->{selectIC_income} =~ s/selected//g;
1693
    $form->{selectIC_income} =~ s/ value=$form->{income_accno_id_0}/  value=$form->{income_accno_id_0} selected/;
1693
    $form->{selectIC_income} =~ s/ value=\Q$form->{income_accno_id_0}\E/  value=$form->{income_accno_id_0} selected/;
1694 1694
    $form->{selectIC_expense} =~ s/selected//g;
1695
    $form->{selectIC_expense} =~ s/ value=$form->{expense_accno_id_0}/  value=$form->{expense_accno_id_0} selected/;
1695
    $form->{selectIC_expense} =~ s/ value=\Q$form->{expense_accno_id_0}\E/  value=$form->{expense_accno_id_0} selected/;
1696 1696
  }
1697 1697

  
1698 1698
  if (!$eur) {
......
1719 1719
	      </tr>|;
1720 1720
  if ($form->{id}) {
1721 1721
    $form->{selectIC_income} =~ s/selected//g;
1722
    $form->{selectIC_income} =~ s/ value=$form->{income_accno_id_1}/  value=$form->{income_accno_id_1} selected/;
1722
    $form->{selectIC_income} =~ s/ value=\Q$form->{income_accno_id_1}\E/  value=$form->{income_accno_id_1} selected/;
1723 1723
    $form->{selectIC_expense} =~ s/selected//g;
1724
    $form->{selectIC_expense} =~ s/ value=$form->{expense_accno_id_1}/  value=$form->{expense_accno_id_1} selected/;
1724
    $form->{selectIC_expense} =~ s/ value=\Q$form->{expense_accno_id_1}\E/  value=$form->{expense_accno_id_1} selected/;
1725 1725
  }
1726 1726
  $linkaccounts .= qq|	      <tr>
1727 1727
		<th align=right>| . $locale->text('Revenues EU with UStId') . qq|</th>
......
1734 1734

  
1735 1735
  if ($form->{id}) {
1736 1736
    $form->{selectIC_income} =~ s/selected//g;
1737
    $form->{selectIC_income} =~ s/ value=$form->{income_accno_id_2}/  value=$form->{income_accno_id_2} selected/;
1737
    $form->{selectIC_income} =~ s/ value=\Q$form->{income_accno_id_2}\E/  value=$form->{income_accno_id_2} selected/;
1738 1738
    $form->{selectIC_expense} =~ s/selected//g;
1739
    $form->{selectIC_expense} =~ s/ value=$form->{expense_accno_id_2}/  value=$form->{expense_accno_id_2} selected/;
1739
    $form->{selectIC_expense} =~ s/ value=\Q$form->{expense_accno_id_2}\E/  value=$form->{expense_accno_id_2} selected/;
1740 1740
  }
1741 1741

  
1742 1742
  $linkaccounts .= qq|	      <tr>
......
1750 1750

  
1751 1751
  if ($form->{id}) {
1752 1752
    $form->{selectIC_income} =~ s/selected//g;
1753
    $form->{selectIC_income} =~ s/ value=$form->{income_accno_id_3}/  value=$form->{income_accno_id_3} selected/;
1753
    $form->{selectIC_income} =~ s/ value=\Q$form->{income_accno_id_3}\E/  value=$form->{income_accno_id_3} selected/;
1754 1754
    $form->{selectIC_expense} =~ s/selected//g;
1755
    $form->{selectIC_expense} =~ s/ value=$form->{expense_accno_id_3}/  value=$form->{expense_accno_id_3} selected/;
1755
    $form->{selectIC_expense} =~ s/ value=\Q$form->{expense_accno_id_3}\E/  value=$form->{expense_accno_id_3} selected/;
1756 1756
  }
1757 1757

  
1758 1758
  $linkaccounts .= qq|	      <tr>
bin/mozilla/common.pl
578 578
    $form->redirect($locale->text("Marked as paid"));
579 579
}
580 580
  else {
581
    my $referer = $ENV{HTTP_REFERER};
582
    $referer =~ s/^(.*)action\=.*\&(.*)$/$1action\=mark_as_paid\&mark_as_paid\=1\&login\=$form->{login}\&password\=$form->{password}\&id\=$form->{id}\&$2/;
581
    my $referer  =  $ENV{HTTP_REFERER};
582
    my $login    =  $form->escape($form->{login});
583
    my $password =  $form->escape($form->{password});
584
    my $id       =  $form->escape($form->{id});
585
    $referer     =~ s/^(.*)action\=.*\&(.*)$/$1action\=mark_as_paid\&mark_as_paid\=1\&login\=$login\&password\=$password\&id\=$id\&$2/;
583 586
    $form->header();
584 587
    print qq|<body>|;
585 588
    print qq|<p><b>|.$locale->text('Mark as paid?').qq|</b></p>|;
bin/mozilla/ic.pl
1910 1910

  
1911 1911
      # if this is a tax field
1912 1912
      if ($key =~ /IC_tax/) {
1913
        if ($key =~ /$item/) {
1913
        if ($key =~ /\Q$item\E/) {
1914 1914
          $form->{taxaccounts} .= "$ref->{accno} ";
1915 1915
          $form->{"IC_tax_$ref->{accno}_description"} =
1916 1916
            "$ref->{accno}--$ref->{description}";
bin/mozilla/io.pl
1869 1869
    %queued = map { s|.*/|| } split / /, $form->{queued};
1870 1870

  
1871 1871
    if ($filename = $queued{ $form->{formname} }) {
1872
      $form->{queued} =~ s/$form->{formname} $filename//;
1872
      $form->{queued} =~ s/\Q$form->{formname} $filename\E//;
1873 1873
      unlink "$spool/$filename";
1874 1874
      $filename =~ s/\..*$//g;
1875 1875
    } else {
bin/mozilla/menu.pl
70 70
sub acc_menu {
71 71
  $lxdebug->enter_sub();
72 72
  $mainlevel = $form->{level};
73
  $mainlevel =~ s/$mainlevel--//g;
73
  $mainlevel =~ s/\Q$mainlevel\E--//g;
74 74
  my $menu = new Menu "$menufile";
75 75

  
76 76
  $form->{title} = $locale->text('Accounting Menu');
......
106 106
    $item  = shift @menuorder;
107 107
    $label = $item;
108 108
    $ml    = $item;
109
    $label =~ s/$level--//g;
109
    $label =~ s/\Q$level\E--//g;
110 110
    $ml    =~ s/--.*//;
111 111
    if ($ml eq $mainlevel) { $zeige = 1; }
112 112
    else { $zeige = 0; }
......
138 138

  
139 139
    if ($menu->{$item}{submenu}) {
140 140
      $menu->{$item}{$item} = !$form->{$item};
141
      if ($form->{level} && $item =~ /^$form->{level}/) {
141
      if ($form->{level} && $item =~ /^\Q$form->{level}\E/) {
142 142

  
143 143
        # expand menu
144 144
        if ($zeige) {
bin/mozilla/menunew.pl
124 124

  
125 125
sub acc_menu {
126 126
  $mainlevel = $form->{level};
127
  $mainlevel =~ s/$mainlevel--//g;
127
  $mainlevel =~ s/\Q$mainlevel\E--//g;
128 128
  my $menu = new Menu "$menufile";
129 129

  
130 130
  $| = 1;
......
370 370
    $item  = shift @menuorder;
371 371
    $label = $item;
372 372
    $ml    = $item;
373
    $label =~ s/$level--//g;
373
    $label =~ s/\Q$level\E--//g;
374 374
    $ml    =~ s/--.*//;
375 375
    $label = $locale->text($label);
376 376
    $label =~ s/ /&nbsp;/g;
bin/mozilla/menuv3.pl
75 75
  $locale = Locale->new($language, "menu");
76 76

  
77 77
  $mainlevel = $form->{level};
78
  $mainlevel =~ s/$mainlevel--//g;
78
  $mainlevel =~ s/\Q$mainlevel\E--//g;
79 79
  my $menu = new Menu "$menufile";
80 80

  
81 81
  $| = 1;

Auch abrufbar als: Unified diff