From 4d9e662ba9739c89c15e68662dce8fd55f5c1d5b Mon Sep 17 00:00:00 2001
From: kindlm <kindlm@technikum-wien.at>
Date: Wed, 2 Nov 2016 13:35:45 +0100
Subject: [PATCH 1/3] =?UTF-8?q?SQL-Injection=20L=C3=BCcke=20geschlossen?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 include/organisationseinheit.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/organisationseinheit.class.php b/include/organisationseinheit.class.php
index e6e0c4bd3..43322b1d6 100644
--- a/include/organisationseinheit.class.php
+++ b/include/organisationseinheit.class.php
@@ -572,7 +572,7 @@ class organisationseinheit extends basis_db
 	    		foreach($searchItem as $value)
 				{
 					$qry.=' OR (LOWER(oe_kurzbz)=LOWER('.$this->db_add_param($value).'))
-							OR (LOWER(bezeichnung)=LOWER('.$this->db_add_param($value).'))'; 
+							OR (LOWER(bezeichnung) LIKE LOWER(\'%'.$this->db_escape($value).'%\'))'; 
 				}
 	    $qry.=	' ORDER BY organisationseinheittyp_kurzbz, bezeichnung;';
 	    

From b82d14d4cdc3be8383fd8917f38be022856cdfe4 Mon Sep 17 00:00:00 2001
From: oesi <oesi@technikum-wien.at>
Date: Wed, 2 Nov 2016 15:00:41 +0100
Subject: [PATCH 2/3] Fehler bei Firmensuche im WaWi behoben

---
 include/firma.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/firma.class.php b/include/firma.class.php
index 029e1469a..06b0db7eb 100644
--- a/include/firma.class.php
+++ b/include/firma.class.php
@@ -388,7 +388,7 @@ class firma extends basis_db
 				UNION
 				SELECT
 					firma_id, name, anmerkung, lieferbedingungen, firmentyp_kurzbz, updateamum, updatevon, insertamum, insertvon,
-					ext_id, schule, steuernummer, gesperrt, aktiv, finanzamt, '2' as sort
+					ext_id, schule, steuernummer, gesperrt, aktiv, finanzamt, '2' as sort, partner_code
 				FROM public.tbl_firma
 				WHERE
 				UPPER(trim(public.tbl_firma.name)) like '%".$this->db_escape($matchcode)."%'
@@ -698,7 +698,7 @@ class firma extends basis_db
 
 		if($firmentyp_kurzbz!='')
 			$qry.=" and firmentyp_kurzbz=".$this->db_add_param($firmentyp_kurzbz);
-		
+
 		if($oes!='')
 			$qry.=" and oe_kurzbz IN ('".$oes."') ";
 

From d20ee458805741610c0a74905cd94287830c3b20 Mon Sep 17 00:00:00 2001
From: oesi <oesi@technikum-wien.at>
Date: Wed, 2 Nov 2016 15:27:51 +0100
Subject: [PATCH 3/3] Fehler behoben beim Anlegen von neuen Firmen

---
 include/firma.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/firma.class.php b/include/firma.class.php
index 06b0db7eb..0e98a3738 100644
--- a/include/firma.class.php
+++ b/include/firma.class.php
@@ -177,7 +177,7 @@ class firma extends basis_db
 			//Neuen Datensatz einfuegen
 			$qry='INSERT INTO public.tbl_firma (name,  anmerkung, lieferbedingungen,
 					firmentyp_kurzbz, updateamum, updatevon, insertamum, insertvon, schule,steuernummer,
-					gesperrt,aktiv,finanzamt) VALUES('.
+					gesperrt,aktiv,finanzamt, partner_code) VALUES('.
 				$this->db_add_param($this->name).', '.
 				$this->db_add_param($this->anmerkung).', '.
 				$this->db_add_param($this->lieferbedingungen).', '.