svn commit: r768286 - /ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl

[mor]

Author: mor
Date: Fri Apr 24 12:47:07 2009
New Revision: 768286

URL: http://svn.apache.org/viewvc?rev=768286&view=rev
Log:
Securing URLs in FTL. Patch from Arun Patidar, part of OFBIZ-2352 
(https://issues.apache.org/jira/browse/OFBIZ-2352)

Modified:
    ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl

Modified: 
ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl?rev=768286&r1=768285&r2=768286&view=diff
==============================================================================
--- 
ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl 
(original)
+++ 
ofbiz/trunk/applications/product/webapp/facility/facility/PicklistManage.ftl 
Fri Apr 24 12:47:07 2009
@@ -92,6 +92,7 @@
                 <#-- PicklistBin -->
                 <#list picklistInfo.picklistBinInfoList?if_exists as 
picklistBinInfo>
                     <#assign isBinComplete = 
Static["org.ofbiz.shipment.picklist.PickListServices"].isBinComplete(delegator, 
picklistBinInfo.picklistBin.picklistBinId)/>
+                    <#assign count = 0>
                     <#if (!isBinComplete)>
                         <div style="margin-left: 15px;">
                             <span 
class="label">${uiLabelMap.ProductBinNum}</span> 
${picklistBinInfo.picklistBin.binLocationNumber}&nbsp;(${picklistBinInfo.picklistBin.picklistBinId})
@@ -142,7 +143,18 @@
                                         
<td>${inventoryItemAndLocation.areaId?if_exists}-${inventoryItemAndLocation.aisleId?if_exists}-${inventoryItemAndLocation.sectionId?if_exists}-${inventoryItemAndLocation.levelId?if_exists}-${inventoryItemAndLocation.positionId?if_exists}</td>
                                         <td>${picklistItem.quantity}</td>
                                         <#if 
!picklistItemInfo.itemIssuanceList?has_content>
-                                            <td><a 
href="<@ofbizUrl>deletePicklistItem?picklistBinId=${picklistItemInfo.picklistItem.picklistBinId}&amp;orderId=${picklistItemInfo.picklistItem.orderId}&amp;orderItemSeqId=${picklistItemInfo.picklistItem.orderItemSeqId}&amp;shipGroupSeqId=${picklistItemInfo.picklistItem.shipGroupSeqId}&amp;inventoryItemId=${picklistItemInfo.picklistItem.inventoryItemId}&amp;facilityId=${facilityId?if_exists}</@ofbizUrl>"
 class="buttontext">${uiLabelMap.CommonDelete}</a></td>
+                                            <td>
+                                                <#assign count = count+1>
+                                                <form 
name="deletePicklistItem_${picklist.picklistId}_${picklistItem.orderId}_${count}"
 method="post" action="<@ofbizUrl>deletePicklistItem</@ofbizUrl>">
+                                                    <input type="hidden" 
name="picklistBinId" value="${picklistItemInfo.picklistItem.picklistBinId}"/>
+                                                    <input type="hidden" 
name="orderId" value= "${picklistItemInfo.picklistItem.orderId}"/>
+                                                    <input type="hidden" 
name="orderItemSeqId" value="${picklistItemInfo.picklistItem.orderItemSeqId}"/>
+                                                    <input type="hidden" 
name="shipGroupSeqId" value="${picklistItemInfo.picklistItem.shipGroupSeqId}"/>
+                                                    <input type="hidden" 
name="inventoryItemId" 
value="${picklistItemInfo.picklistItem.inventoryItemId}"/>
+                                                    <input type="hidden" 
name="facilityId" value="${facilityId?if_exists}"/>
+                                                    <a 
href='javascript:document.deletePicklistItem_${picklist.picklistId}_${picklistItem.orderId}_${count}.submit()'
 class='buttontext'>&nbsp;${uiLabelMap.CommonDelete}&nbsp;</a>
+                                                </form>
+                                            </td>
                                         </#if>
                                         <td>
                                             <#-- 
picklistItem.orderItemShipGrpInvRes (do we want to display any of this info?) 
-->