diff --git a/APPL/FAC/fac_edit_reportcolumn.asp b/APPL/FAC/fac_edit_reportcolumn.asp index 0daec5a9a2..9e9c01d994 100644 --- a/APPL/FAC/fac_edit_reportcolumn.asp +++ b/APPL/FAC/fac_edit_reportcolumn.asp @@ -28,7 +28,7 @@ var rap_id = getQParamInt("rap_id"); var col_id = getQParamInt("col_id"); var autostart = getQParamInt("autostart",-1); -user.auth_required_or_abort(user.has("WEB_UDRMAN")); +user.checkAutorisation("WEB_UDRMAN"); function BREAK() { diff --git a/APPL/FAC/get_kenmerk_info_ajax.asp b/APPL/FAC/get_kenmerk_info_ajax.asp index e55c5a5161..a4d6879cbe 100644 --- a/APPL/FAC/get_kenmerk_info_ajax.asp +++ b/APPL/FAC/get_kenmerk_info_ajax.asp @@ -20,7 +20,7 @@ var JSON_Result = true; <% -user.auth_required_or_abort(user.has("WEB_UDRMAN")); +user.checkAutorisation("WEB_UDRMAN"); var module = getQParam("module", ""); var req_info = getQParam("req_info"); @@ -169,10 +169,7 @@ switch (req_info) + " FROM fac_usrrap_cols" + " WHERE fac_usrrap_cols_key = " + cols_key; var oRs = Oracle.Execute(sql); - if (!oRs.eof) - { - var col_name = oRs("fac_usrrap_cols_column_name").Value; - } + var safe_key_col_name = oRs("fac_usrrap_cols_column_name").Value; oRs.Close(); // Aan de hand van de module de te gebruiken tabellen bepalen. @@ -222,10 +219,11 @@ switch (req_info) scr = "SELECT rt." + ref_txt + " FROM mld_kenmerkmelding kenm" + " , " + ref_tab + " rt" - + " WHERE rt." + ref_col + " = kenm.mld_kenmerkmelding_waarde" + + " WHERE kenm.mld_kenmerkmelding_verwijder IS NULL" + + " AND rt." + ref_col + " = kenm.mld_kenmerkmelding_waarde" + (ref_key ? " AND rt.fac_usrtab_key = " + ref_key : "") + " AND kenm.mld_kenmerk_key = " + kenm_key - + " AND kenm.mld_melding_key = " + safe.quoted_sql(col_name); + + " AND kenm.mld_melding_key = " + safe_key_col_name; } else if (data_type == "M" || data_type == "F" || data_type == "X" || data_type == "E") { // kenmerkwaarde verwijst naar een bestand @@ -235,8 +233,9 @@ switch (req_info) { // De overige kenmerkwaarden staan direct in de tabel. src = "SELECT kenm.mld_kenmerkmelding_waarde" + " FROM mld_kenmerkmelding kenm" - + " WHERE kenm.mld_kenmerk_key = " + kenm_key - + " AND kenm.mld_melding_key = " + col_name; + + " WHERE kenm.mld_kenmerkmelding_verwijder IS NULL" + + " AND kenm.mld_kenmerk_key = " + kenm_key + + " AND kenm.mld_melding_key = " + safe_key_col_name; } // Conversie datatype kenmerk naar datatype rapport: