Projekt

Allgemein

Profil

« Zurück | Weiter » 

Revision c83c61d2

Von Moritz Bunkus vor etwa 12 Jahren hinzugefügt

  • ID c83c61d255ba54bd5a6c4afa291bc0cfb872297c
  • Vorgänger faa7c313
  • Nachfolger 2fc8536b

Werte für Lieferanten-, Abteilungs-, Währungsauswahl ordentlich escapen

Fixt #1886.

Unterschiede anzeigen:

bin/mozilla/ap.pl
156 156
  # currencies
157 157
  $form->{defaultcurrency} = $form->get_default_currency(\%myconfig);
158 158

  
159
  map { $form->{selectcurrency} .= "<option>$_\n" } $form->get_all_currencies(\%myconfig);
159
  map { my $quoted = H($_); $form->{selectcurrency} .= "<option value=\"${quoted}\">${quoted}\n" } $form->get_all_currencies(\%myconfig);
160 160

  
161 161
  # vendors
162 162
  if (@{ $form->{all_vendor} || [] }) {
163 163
    $form->{vendor} = qq|$form->{vendor}--$form->{vendor_id}|;
164
    map { $form->{selectvendor} .= "<option>$_->{name}--$_->{id}\n" }
164
    map { my $quoted = H($_->{name} . "--" . $_->{id}); $form->{selectvendor} .= "<option value=\"${quoted}\">${quoted}\n" }
165 165
      (@{ $form->{all_vendor} });
166 166
  }
167 167

  
168 168
  # departments
169 169
  if (@{ $form->{all_departments} || [] }) {
170
    $form->{selectdepartment} = "<option>\n";
171 170
    $form->{department}       = "$form->{department}--$form->{department_id}";
172

  
173
    map {
174
      $form->{selectdepartment} .=
175
        "<option>$_->{description}--$_->{id}\n"
176
    } (@{ $form->{all_departments} || [] });
171
    $form->{selectdepartment} = "<option>\n" . join('', map { my $quoted = H("$_->{description}--$_->{id}"); "<option value=\"${quoted}\">${quoted}\n"} @{ $form->{all_departments} || [] });
177 172
  }
178 173

  
179 174
  $form->{employee} = "$form->{employee}--$form->{employee_id}";
......
230 225

  
231 226
  # set option selected
232 227
  foreach my $item (qw(vendor currency department)) {
228
    my $to_replace         =  H($form->{$item});
233 229
    $form->{"select$item"} =~ s/ selected//;
234
    $form->{"select$item"} =~
235
      s/option>\Q$form->{$item}\E/option selected>$form->{$item}/;
230
    $form->{"select$item"} =~ s/>\Q${to_replace}\E/ selected>${to_replace}/;
236 231
  }
237 232
  my $readonly = ($form->{id}) ? "readonly" : "";
238 233

  
......
291 286
              <tr>
292 287
                <th align="right" nowrap>| . $locale->text('Department') . qq|</th>
293 288
                <td colspan=3><select name=department>$form->{selectdepartment}</select>
294
                <input type=hidden name=selectdepartment value="$form->{selectdepartment}">
289
                <input type=hidden name=selectdepartment value="| . H($form->{selectdepartment}) . qq|">
295 290
                </td>
296 291
              </tr>
297 292
| if $form->{selectdepartment};
......
462 457
              <tr>
463 458
                <th align=right nowrap>| . $locale->text('Currency') . qq|</th>
464 459
                <td><select name=currency>$form->{selectcurrency}</select></td>
465
                <input type=hidden name=selectcurrency value="$form->{selectcurrency}">
460
                <input type=hidden name=selectcurrency value="| . H($form->{selectcurrency}) . qq|">
466 461
                <input type=hidden name=defaultcurrency value=$form->{defaultcurrency}>
467 462
                <input type=hidden name=fxgain_accno value=$form->{fxgain_accno}>
468 463
                <input type=hidden name=fxloss_accno value=$form->{fxloss_accno}>

Auch abrufbar als: Unified diff