Wareneingang bugfix abschliessen, removed edit from minidetail

phpwf/plugins/class.yui.php

@@ -12108,9 +12108,6 @@ url:strUrl, success:function(html){strReturn = html;}, async:false
     </tr>
     </tfoot>
     </table></div>
-    <br>
-    <br>
-    <br>
     ');
     
         if((empty($disableautosavefilter)) && $this->anzusersaves < 2) {

upgrade/data/db_schema.json

@@ -64785,6 +64785,17 @@
                     "Extra": "",
                     "Privileges": "select,insert,update,references",
                     "Comment": ""
+                },
+                {
+                    "Field": "vorlaeufig",
+                    "Type": "int(1)",
+                    "Collation": null,
+                    "Null": "YES",
+                    "Key": "",
+                    "Default": "",
+                    "Extra": "",
+                    "Privileges": "select,insert,update,references",
+                    "Comment": ""
                 }
             ],
             "keys": [

www/lib/class.erpapi.php

@@ -26040,7 +26040,7 @@ function ChargenMHDAuslagern($artikel, $menge, $lagerplatztyp, $lpid,$typ,$wert,
         $this->app->Tpl->Set('DRUCKER', $this->GetSelectDrucker($selected));
       }
       $this->app->Tpl->Set('FAX',$this->GetSelectFax());
-      $this->app->Tpl->Set('EMAILEMPFAENGER',$this->GetSelectEmail());
+      $this->app->Tpl->Set('EMAILEMPFAENGER',$this->GetSelectEmail($this->Firmendaten("email")));
       $projektabkuerzung = $this->app->DB->Select("SELECT abkuerzung FROM projekt WHERE id='$projekt'");
       $this->app->Tpl->Set('PROJEKT',$projektabkuerzung);
       //$this->app->Tpl->Set(PROJEKT,$this->GetProjektSelect($projekt));

www/pages/content/ticket_edit.tpl

@@ -19,7 +19,7 @@
 	        				<fieldset>
                                 <table width="100%" border="0" class="mkTableFormular">
                                     <legend>{|[STATUSICON]<b>Ticket <font color="blue">#[SCHLUESSEL]</font></b>|}</legend>
-                                    <tr><td>{|Betreff|}:</td><td><input type="text" name="betreff" id="betreff" value="[BETREFF]" size="20"></td></tr>
+                                    <tr><td>{|Betreff|}:</td><td><input type="text" name="betreff" id="betreff" value="[BETREFF]" size="100%"></td></tr>
                                     <tr><td>{|Von|}:</td><td>[KUNDE]&nbsp;[MAILADRESSE]</td></tr>
                                     <tr><td>{|Projekt|}:</td><td><input type="text" name="projekt" id="projekt" value="[PROJEKT]" size="20"></td></tr>
                                     <tr><td>{|Adresse|}:</td><td><input type="text" name="adresse" id="adresse" value="[ADRESSE]" size="20"><a href="index.php?module=adresse&action=edit&id=[ADRESSE_ID]"><img src="./themes/new/images/forward.svg" border="0" style="top:6px; position:relative"></a></td></tr>

www/pages/content/wareneingang_minidetail.tpl

@@ -1,7 +1,11 @@
+<!--
 <table id="table[MD5]">
-<tr><td>{|Lieferschein|}:</td><td><input type="checkbox" onchange="lsclick[MD5]();" id="beiback_lieferschein[MD5]" disabled value="1" [BEIPACK_LIEFERSCHEIN] /></td><td><span id="lsnr[MD5]">[LSNR]</span></td><td><input type="button" value="{|Belege &auml;ndern|}" style="cursor:hand;" onclick="editclick[MD5]();" /></td></tr>
+<tr><td>{|Lieferschein|}:</td><td><input type="checkbox" onchange="lsclick[MD5]();" id="beiback_lieferschein[MD5]" disabled value="1" [BEIPACK_LIEFERSCHEIN] /></td><td><span id="lsnr[MD5]">[LSNR]</span></td>
+<td><input type="button" value="{|Belege &auml;ndern|}" style="cursor:hand;" onclick="editclick[MD5]();" /></td>
+</tr>
 <tr><td>{|Rechnung|}:</td><td><input type="checkbox" onchange="reclick[MD5]();" id="beiback_rechnung[MD5]" disabled value="1" [BEIPACK_RECHNUNG] /></td><td><span id="renr[MD5]">[RENR]</span></td><td></td></tr>
 </table>
+-->
 
 <table width="100%">
 <tr><td width="100%">[ARTIKEL]</td></tr>

www/pages/content/wareneingang_paketinhalt.tpl

@@ -11,9 +11,7 @@
   <input type="hidden" id="paketannahme_id" value="[ID]" />
   [BEFORETAB1]
   <div id="tabs-1">
-
     [TAB1START]
-
     [MESSAGE1]
     <form action="" method="post">
       <div class="row">
@@ -26,25 +24,51 @@
                   <tr><td>{|Lieferschein-Nr.|}:</td><td><input type=text size="40" name="lsnr" value=[LSNR]></td></tr>
                   <tr><td>{|Rechnung-Nr.|}:</td><td><input type=text size="40" name="renr" value=[RENR]></td></tr>
                   <tr><td>{|Bemerkung|}:</td><td><textarea rows="5" cols="40" name="bemerkung">[BEMERKUNG]</textarea></td></tr>
-                  <tr><td><input type="submit" name="speichern" class="btnGreenNew" value="Speichern"></td>
+                  [ISLIEFERANTSTART]
+                  <tr><td>{|Ziellager|}:</td><td><input type=text size="40" name="ziellager" id="ziellager" value=[LAGER]></td></tr>
+                  [ISLIEFERANTENDE]                
                 </table>
               </fieldset>
             </div>
           </div>
           <div class="col-xs-12 col-md-2 col-md-height">
             <div class="inside inside-full-height">
-              <fieldset>
+                <fieldset>
-                <legend>{|Aktionen|}</legend>
+                    [BUTTONS]
-                [BUTTONS]
+                    [BEFOREFRM]
-                [BEFOREFRM]
+                    [AFTERFRM]
-                [AFTERFRM]
+                    [DISTRIINHALTBUTTONS]
-                  [DISTRIINHALTBUTTONS]
+                    [BEFOREFRM]
-                  <input type="submit" name="abschliessen" id="btnabschliessen" class="btnGreenNew"  value="Paketinhalt ist erfasst">
+                    [AFTERFRM]         
-                  [BEFOREMANUELLERFASSEN]
+                    <table width="100%" border="0" class="mkTableFormular">
-                  <input type="submit" name="manuellerfassen" class="btnBlueNew" value="Artikel manuell erfassen">
+                        <legend>{|Aktionen|}</legend>                        
-                  [AFTERMANUELLERFASSEN]
+                        [BEFOREMANUELLERFASSEN]            
-                [BEFOREFRM]
+                        <tr><td>               
-                [AFTERFRM]
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="manuellerfassen">{|Artikel manuell erfassen|}</button>
+                        </td></tr>
+                        [AFTERMANUELLERFASSEN]
+                        [ISLIEFERANTSTART]
+<!--
+                        <tr><td>               
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="fuellen">{|Aus Bestellungen f&uuml;llen|}</button>
+                        </td></tr>
+                        <tr><td>               
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="leeren">{|Leeren|}</button>
+                        </td></tr>
+-->
+                        [ISLIEFERANTENDE]                
+                        <tr><td>               
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="speichern">{|Speichern|}</button>
+                        </td></tr>
+                        [ISLIEFERANTSTART]
+                        <tr><td>               
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="buchen">{|Buchen|}</button>
+                        </td></tr>
+                        [ISLIEFERANTENDE]                
+                        <tr><td>               
+                            <button name="submit" class="ui-button-icon" style="width:100%;" value="abschliessen">{|Abschlie&szlig;en|}</button>            
+                        </td></tr>
+                    </table>
               </fieldset>
             </div>
           </div>
@@ -54,7 +78,7 @@
         <div class="row-height">
           <div class="col-xs-12 col-md-10 col-md-height">
             <div class="inside-white inside-full-height">
-              [TAB1]
+                [TAB1]                                 
             </div>
           </div>
         </div>

www/pages/managementboard.php

@@ -401,7 +401,8 @@ class Managementboard
     /** @var Rechnungslauf $obj */
     $obj = $this->app->erp->LoadModul('rechnungslauf');
     if($obj){
-      $w[24] = $obj->RechnungslaufRechnungslauf(true);
+      // $w[24] = $obj->RechnungslaufRechnungslauf(true); // This does not exist, presumably old xentral function
+      $w[24] = 0;    
     }
     else {
       $w[24] = 0;

www/pages/ticket.php

@@ -68,7 +68,7 @@ class Ticket {
                 $dropnbox = "'<img src=./themes/new/images/details_open.png class=details>' AS `open`,
                               CONCAT('<input type=\"checkbox\" name=\"auswahl[]\" value=\"',t.id,'\" />') AS `auswahl`";
 
-                $priobetreff = "if(t.prio!=1,t.betreff,CONCAT('<b><font color=red>',t.betreff,'</font></b>'))";
+                $priobetreff = "if(t.prio!=1,REGEXP_REPLACE(t.betreff, '<[^>]*>+', ''),CONCAT('<b><font color=red>',REGEXP_REPLACE(t.betreff, '<[^>]*>+', ''),'</font></b>'))"; //+ #20230916 XSS
 
                 $anzahlnachrichten = "(SELECT COUNT(n.id) FROM ticket_nachricht n WHERE n.ticket = t.schluessel)";
 
@@ -310,6 +310,8 @@ class Ticket {
         // Add Messages now
         foreach ($messages as $message) {
 
+            $message['betreff'] = strip_tags($message['betreff']); //+ #20230916 XSS
+
             // Clear this first
             $this->app->Tpl->Set('NACHRICHT_ANHANG',"");         
 
@@ -622,6 +624,8 @@ class Ticket {
 
         $ticket_from_db = $this->app->DB->SelectArr($sql)[0];
 
+        $ticket_from_db['betreff'] = htmlentities(strip_tags($ticket_from_db['betreff'])); //+ #20230916 XSS
+
         foreach ($ticket_from_db as $key => $value) {
             $this->app->Tpl->Set(strtoupper($key), $value);   
         }
@@ -733,10 +737,10 @@ class Ticket {
                 
                 if (!empty($recv_messages)) {
                     if (!str_starts_with(strtoupper($recv_messages[0]['betreff']),"RE:")) {
-                        $betreff = "RE: ".$recv_messages[0]['betreff'];
+                        $betreff = "RE: ".strip_tags($recv_messages[0]['betreff']); //+ #20230916 XSS
                     }
                     else {
-                        $betreff = $recv_messages[0]['betreff'];
+                        $betreff = strip_tags($recv_messages[0]['betreff']); //+ #20230916 XSS
                     }
 
                     $sql = "SELECT GROUP_CONCAT(DISTINCT `value` ORDER BY `value` SEPARATOR ', ') FROM ticket_header th WHERE th.ticket_nachricht = ".$recv_messages[0]['id']." AND `value` <> '".$senderAddress."' AND type='to'";

www/setup/setup.css

@@ -1,37 +1,3 @@
-@font-face {
-	font-family: 'Inter';
-	font-style: normal;
-	font-weight: 400;
-	font-display: swap;
-	src: url('../themes/new/fonts/Inter-Regular.woff2?v=3.13') format("woff2"),
-	url('../themes/new/fonts/Inter-Regular.woff?v=3.13') format("woff");
-}
-@font-face {
-	font-family: 'Inter';
-	font-style: italic;
-	font-weight: 400;
-	font-display: swap;
-	src: url('../themes/new/fonts/Inter-Italic.woff2?v=3.13') format("woff2"),
-	url('../themes/new/fonts/Inter-Italic.woff?v=3.13') format("woff");
-}
-
-@font-face {
-	font-family: 'Inter';
-	font-style: normal;
-	font-weight: 700;
-	font-display: swap;
-	src: url('../themes/new/fonts/Inter-Bold.woff2?v=3.13') format("woff2"),
-	url('../themes/new/fonts/Inter-Bold.woff?v=3.13') format("woff");
-}
-@font-face {
-	font-family: 'Inter';
-	font-style: italic;
-	font-weight: 700;
-	font-display: swap;
-	src: url('../themes/new/fonts/Inter-BoldItalic.woff2?v=3.13') format("woff2"),
-	url('../themes/new/fonts/Inter-BoldItalic.woff?v=3.13') format("woff");
-}
-
 body {
 	font-size: 16px;
 	font-family: 'Inter', Arial, Helvetica, sans-serif;

www/themes/new/css/login.css

@@ -1,38 +1,3 @@
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../themes/new/fonts/Inter-Regular.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Regular.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../themes/new/fonts/Inter-Italic.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Italic.woff?v=3.13') format("woff");
-}
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../fonts/Inter-Bold.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Bold.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../fonts/Inter-BoldItalic.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-BoldItalic.woff?v=3.13') format("woff");
-}
-
-
 html {
     box-sizing: border-box;
 }

www/themes/new/css/login_styles.css

@@ -1,39 +1,3 @@
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../fonts/Inter-Regular.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Regular.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../fonts/Inter-Italic.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Italic.woff?v=3.13') format("woff");
-}
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../fonts/Inter-Bold.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Bold.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../themes/new/fonts/Inter-BoldItalic.woff2?v=3.13') format("woff2"),
-    url('../themes/new/fonts/Inter-BoldItalic.woff?v=3.13') format("woff");
-}
-
-
 html {
     box-sizing: border-box;
 }

www/themes/new/css/styles.css

@@ -1,71 +1,3 @@
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../fonts/Inter-Regular.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Regular.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 400;
-    font-display: swap;
-    src: url('../fonts/Inter-Italic.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Italic.woff?v=3.13') format("woff");
-}
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 500;
-    font-display: swap;
-    src: url("../fonts/Inter-Medium.woff2?v=3.13") format("woff2"),
-    url("../fonts/Inter-Medium.woff?v=3.13") format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 500;
-    font-display: swap;
-    src: url("../fonts/Inter-MediumItalic.woff2?v=3.13") format("woff2"),
-    url("../fonts/Inter-MediumItalic.woff?v=3.13") format("woff");
-}
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 600;
-    font-display: swap;
-    src: url("../fonts/Inter-SemiBold.woff2?v=3.13") format("woff2"),
-    url("../fonts/Inter-SemiBold.woff?v=3.13") format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 600;
-    font-display: swap;
-    src: url("../fonts/Inter-SemiBoldItalic.woff2?v=3.13") format("woff2"),
-    url("../fonts/Inter-SemiBoldItalic.woff?v=3.13") format("woff");
-}
-
-@font-face {
-    font-family: 'Inter';
-    font-style:  normal;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../fonts/Inter-Bold.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-Bold.woff?v=3.13') format("woff");
-}
-@font-face {
-    font-family: 'Inter';
-    font-style:  italic;
-    font-weight: 700;
-    font-display: swap;
-    src: url('../fonts/Inter-BoldItalic.woff2?v=3.13') format("woff2"),
-    url('../fonts/Inter-BoldItalic.woff?v=3.13') format("woff");
-}
-
 body {
     font-size: 12px;
 	font-family: 'Inter', Arial, Helvetica, sans-serif;