adminandClaude Opus 5
3dfbf1c9c7
incs/saveNchange.php neu geschrieben: Adressen, Telefonnummern, Kontakte, Notizen und Konten laufen ueber db_abfrage() mit Platzhaltern, mehrschrittiges Speichern in einer Transaktion. Weil sich die Speicherfunktionen gegenseitig aufrufen, klammern beginneSpeichern()/beendeSpeichern() die Verschachtelung; incs/rechnung.php nutzt sie ebenfalls. Kunden- und Lieferantenseiten waren zwei fast gleiche Kopien und teilen sich jetzt partnerAddSeite(), partnerChangeSeite() und partnerShowDaten(). Dabei behoben: - SQL-Injektion ueber die Suchbegriffe der Kunden-, Lieferanten-, Adress-, Kommissions- und Projektsuche sowie ueber die Artikel-Autovervollstaendigung - gespeichertes XSS: Notizen (nl2br escapt nicht), Bankname, Dokumenttyp, Namen und Adressen in allen Trefferlisten - sites/liefershow.php war unter PHP 8 ein Fatal ($kdnres.id) - "Telefonnummer loeschen" im Kundenbereich lief in einen Fatal, die Nummern einer geloeschten Adresse blieben stehen (Spalte hiess adress_id statt adresse_id, mysql_fetch_assoc gibt es nicht mehr) - Geburtstag ohne Jahr wurde im Formular verschluckt, die IBAN kam beim Bearbeiten aus $_GET statt aus dem Konto - die Versionskette eines Kunden brach nach einem Schritt ab - Kommissionsadressen speicherten die Ortsangabe der Adresse statt der des Telefonformulars und einen Adresstyp als Telefontyp - Blaettern in den Trefferlisten: ohne ORDER BY konnte dieselbe Zeile zweimal oder gar nicht erscheinen; ajax_searchadress() bekam die Seite nicht - Hauptadresse laesst sich nicht mehr loeschen, Kundendaten nicht mehr ueber die Lieferantenseite (und umgekehrt) - ajax/auto/* baute JSON von Hand zusammen, ein Anfuehrungszeichen im Ort machte die Liste unbrauchbar Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
296 lines
9.6 KiB
JavaScript
296 lines
9.6 KiB
JavaScript
var search_in_progress = 0
|
|
|
|
function ajax_searchkunden(page)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("kdnsrc_list").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
field = encodeURIComponent(document.getElementById("kdnsrc_field").value);
|
|
search = encodeURIComponent(document.getElementById("kdnsrc_src").value);
|
|
|
|
var url = "ajax/searchkunden.php?field=" + field + "&page=" + page + "&search=" + search;
|
|
reqkdnsrc = new XMLHttpRequest();
|
|
reqkdnsrc.open("GET", url, true);
|
|
reqkdnsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkdnsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("kdnsrc_list").innerHTML = reqkdnsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkdnsrc.send();
|
|
}
|
|
}
|
|
|
|
function ajax_searchzeit(page,user)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("termcontainer-"+user).innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
search = encodeURIComponent(document.getElementById("zeit_src-"+user).value);
|
|
|
|
var url = "ajax/searchzeit.php?page=" + page + "&user=" + user + "&search=" + search;
|
|
reqkdnsrc = new XMLHttpRequest();
|
|
reqkdnsrc.open("GET", url, true);
|
|
reqkdnsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkdnsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("termcontainer-"+user).innerHTML = reqkdnsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkdnsrc.send();
|
|
}
|
|
}
|
|
|
|
// page zuerst, damit die Seitenschaltung (displayPages) die Nummer
|
|
// als erstes Argument uebergeben kann - wie bei den anderen Suchen
|
|
function ajax_searchadress(page,rechid,subact)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("adrsrc_list").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
field = encodeURIComponent(document.getElementById("adrsrc_field").value);
|
|
search = encodeURIComponent(document.getElementById("adrsrc_src").value);
|
|
|
|
var url = "ajax/searchadress.php?field=" + field + "&page=" + page + "&search=" + search + "&rechid=" + rechid + "&subact=" + subact;
|
|
reqadrsrc = new XMLHttpRequest();
|
|
reqadrsrc.open("GET", url, true);
|
|
reqadrsrc.onreadystatechange = function()
|
|
{
|
|
if(reqadrsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("adrsrc_list").innerHTML = reqadrsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqadrsrc.send();
|
|
}
|
|
}
|
|
|
|
function ajax_searchliefer(page)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("kdnsrc_list").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
field = encodeURIComponent(document.getElementById("kdnsrc_field").value);
|
|
search = encodeURIComponent(document.getElementById("kdnsrc_src").value);
|
|
|
|
var url = "ajax/searchliefer.php?field=" + field + "&page=" + page + "&search=" + search;
|
|
reqkdnsrc = new XMLHttpRequest();
|
|
reqkdnsrc.open("GET", url, true);
|
|
reqkdnsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkdnsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("kdnsrc_list").innerHTML = reqkdnsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkdnsrc.send();
|
|
}
|
|
}
|
|
|
|
function ajax_searchkdnprojects(page,kdnid)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("projectlist").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
search = encodeURIComponent(document.getElementById("src_project").value);
|
|
|
|
var url = "ajax/searchkdnprojects.php?page=" + page + "&search=" + search+"&kdnid=" + kdnid;
|
|
|
|
reqkdnsrc = new XMLHttpRequest();
|
|
reqkdnsrc.open("GET", url, true);
|
|
reqkdnsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkdnsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("projectlist").innerHTML = reqkdnsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkdnsrc.send();
|
|
}
|
|
}
|
|
|
|
function ajax_searchkdnrech(page,skspage,typ,kdnid)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("rechlist-"+typ).innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
search = encodeURIComponent(document.getElementById("src_rech-"+typ).value);
|
|
|
|
var url = "ajax/searchkdnrech.php?page=" + page + "&skspage=" + skspage + "&search=" + search+"&typ=" + typ + "&kdnid=" + kdnid;
|
|
|
|
reqkdnsrc = new XMLHttpRequest();
|
|
reqkdnsrc.open("GET", url, true);
|
|
reqkdnsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkdnsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("rechlist-"+typ).innerHTML = reqkdnsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkdnsrc.send();
|
|
}
|
|
}
|
|
function ajax_searchkomm(page,kdnid)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("kommsrc_list").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
search = encodeURIComponent(document.getElementById("kommsrc_src").value);
|
|
|
|
var url = "ajax/searchkomm.php?page=" + page + "&search=" + search+"&kdnid=" + kdnid;
|
|
|
|
reqkommsrc = new XMLHttpRequest();
|
|
reqkommsrc.open("GET", url, true);
|
|
reqkommsrc.onreadystatechange = function()
|
|
{
|
|
if(reqkommsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("kommsrc_list").innerHTML = reqkommsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqkommsrc.send();
|
|
}
|
|
}
|
|
function ajax_searchrech(page,skspage)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("rechlist").innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
search = encodeURIComponent(document.getElementById("src_rech").value);
|
|
|
|
var url = "ajax/searchrech.php?page=" + page + "&skspage=" + skspage + "&search=" + search;
|
|
|
|
reqrechsrc = new XMLHttpRequest();
|
|
reqrechsrc.open("GET", url, true);
|
|
reqrechsrc.onreadystatechange = function()
|
|
{
|
|
if(reqrechsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("rechlist").innerHTML = reqrechsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqrechsrc.send();
|
|
}
|
|
}
|
|
function ajax_searchterm(page, termtyp)
|
|
{
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
document.getElementById("termcontainer-"+termtyp).innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
search = encodeURIComponent(document.getElementById("term_src-"+termtyp).value);
|
|
|
|
var url = "ajax/searchterm.php?page=" + page + "&search=" + search + "&termtyp=" + termtyp;
|
|
|
|
reqtermsrc = new XMLHttpRequest();
|
|
reqtermsrc.open("GET", url, true);
|
|
reqtermsrc.onreadystatechange = function()
|
|
{
|
|
if(reqtermsrc.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("termcontainer-"+termtyp).innerHTML = reqtermsrc.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqtermsrc.send();
|
|
}
|
|
}
|
|
|
|
function ajax_displaymsgs(page,user)
|
|
{
|
|
messagepage = page;
|
|
messages = user;
|
|
if(!search_in_progress)
|
|
{
|
|
search_in_progress = 1;
|
|
//document.getElementById("msgdiv-"+user).innerHTML = "<p><img src='pics/progress_white.gif' /></p>";
|
|
//document.getElementById("kdnsrc_src").disabled = true;
|
|
|
|
var url = "ajax/displaymsgs.php?fromuser="+user+"&page="+page;
|
|
reqmsgs = new XMLHttpRequest();
|
|
reqmsgs.open("GET", url, true);
|
|
reqmsgs.onreadystatechange = function()
|
|
{
|
|
if(reqmsgs.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("msgdiv-"+user).innerHTML = reqmsgs.responseText;
|
|
search_in_progress = 0;
|
|
$("[title]").trigger("redotooltips");
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqmsgs.send();
|
|
}
|
|
}
|
|
function sendmsg(touser)
|
|
{
|
|
msg = encodeURIComponent(document.getElementById("message-"+touser).value);
|
|
var url = "ajax/sendmsg.php?touser="+touser+"&msg="+msg;
|
|
reqsndmsgs = new XMLHttpRequest();
|
|
reqsndmsgs.open("GET", url, true);
|
|
reqsndmsgs.onreadystatechange = function()
|
|
{
|
|
if(reqsndmsgs.readyState == 4)
|
|
{
|
|
// Get the data from the server's response
|
|
document.getElementById("message-"+touser).value = "";
|
|
ajax_displaymsgs(0,touser);
|
|
//document.getElementById("kdnsrc_src").disabled = false;
|
|
}
|
|
}
|
|
reqsndmsgs.send();
|
|
} |