Die hoort weg te zijn

svn path=/Website/branches/v5.4.1/; revision=22097
PNBR#29793 : Nieuw logo op bonnen
2014-07-08 11:20:56 +00:00 · 2014-07-02 11:44:36 +00:00 · 2014-06-18 08:32:12 +00:00 · 2014-06-18 07:22:15 +00:00 · 2014-06-18 07:18:34 +00:00 · 2014-06-18 07:18:16 +00:00
779 changed files with 32075 additions and 19209 deletions
--- a/APPL/ALG/alg_district_list.inc
+++ b/APPL/ALG/alg_district_list.inc
@@ -85,13 +85,22 @@ function district_list(pautfunction, params)
  var reg_key = params.reg_key;
  var dis_key = params.dis_key;

-    function fnrowActionEnabler(oRs)
-    {
-        var eDelete = false;
-        if (alg.canWriteDistrict(oRs("alg_district_key").value, authparams.mALGwritelevel))
-            eDelete = true;
-        return ({eDelete: eDelete})
-    }
+  function fnrowActionEnabler(oRs)
+  {
+      var eDelete = false;
+      if (alg.canWriteDistrict(oRs("alg_district_key").value, authparams.mALGwritelevel))
+          eDelete = true;
+      return ({eDelete: eDelete})
+  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var dis_key = oRs("alg_district_key").Value;
+    var this_alg = alg.func_enabled(dis_key, "D");
+
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
 %>
  <html>
    <head>
@@ -146,6 +155,7 @@ function district_list(pautfunction, params)
                                   rowActionEnabler: fnrowActionEnabler,
                                   flexModule: "ALG",
                                   flexId: "alg_district_key",
+                                   flexParams: fnrowFlexParams,
                                   filterParams: params,
                                   outputmode: outputmode,
                                   buttons: addButton
--- a/APPL/ALG/alg_edit_gebouw_save.asp
+++ b/APPL/ALG/alg_edit_gebouw_save.asp
@@ -38,10 +38,10 @@
                  { dbs: "PRS_KOSTENPLAATS_KEY",      typ: "key",     frm: "prs_kstpl" },
                  { dbs: "MLD_DIENSTNIVEAU_KEY",      typ: "key",     frm: "dienstniveau" },
                  { dbs: "ALG_GEBOUW_ORDERNR",        typ: "varchar", frm: "bld_ordrnr" },
-                  { dbs: "ALG_GEBOUW_DWGX",           typ: "number",  frm: "bld_dwgx" },
-                  { dbs: "ALG_GEBOUW_DWGY",           typ: "number",  frm: "bld_dwgy" },
-                  { dbs: "ALG_GEBOUW_X",              typ: "number",  frm: "bld_x" },
-                  { dbs: "ALG_GEBOUW_Y",              typ: "number",  frm: "bld_y" },
+                  { dbs: "ALG_GEBOUW_DWGX",           typ: "float",   frm: "bld_dwgx" },
+                  { dbs: "ALG_GEBOUW_DWGY",           typ: "float",   frm: "bld_dwgy" },
+                  { dbs: "ALG_GEBOUW_X",              typ: "float",   frm: "bld_x" },
+                  { dbs: "ALG_GEBOUW_Y",              typ: "float",   frm: "bld_y" },
                  { dbs: "ALG_GEBOUW_BEZ",            typ: "check",   frm: "bld_bez" },
                  { dbs: "ALG_GEBOUW_WERKDAGEN",      typ: "check0",  frm: "bld_werkdagen" }];

--- a/APPL/ALG/alg_gebouw_list.inc
+++ b/APPL/ALG/alg_gebouw_list.inc
@@ -90,13 +90,22 @@ function gebouw_list(pautfunction, params)
  var bld_key = params.bld_key;
  var bld_func = params.bld_func;

-    function fnrowActionEnabler(oRs)
-    {
-        var eDelete = false;
-        if (alg.canWriteGebouw(oRs("alg_gebouw_key").value, authparams.mALGwritelevel))
-            eDelete = true;
-        return ({eDelete: eDelete})
-    }
+  function fnrowActionEnabler(oRs)
+  {
+      var eDelete = false;
+      if (alg.canWriteGebouw(oRs("alg_gebouw_key").value, authparams.mALGwritelevel))
+          eDelete = true;
+      return ({eDelete: eDelete})
+  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var bld_key = oRs("alg_gebouw_key").Value;
+    var this_alg = alg.func_enabled(bld_key, "G");
+
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
 %>

  <html>
@@ -181,6 +190,7 @@ function gebouw_list(pautfunction, params)
                                   rowActionEnabler: fnrowActionEnabler,
                                   flexModule: "ALG",
                                   flexId: "alg_gebouw_key",
+                                   flexParams: fnrowFlexParams,
                                   filterParams: params,
                                   outputmode: outputmode,
                                   buttons: addButton
@@ -192,7 +202,6 @@ function gebouw_list(pautfunction, params)
    rst.addColumn(new Column({caption: L("lcl_estate_gebouw_srtgebouw"), content: "alg_srtgebouw_omschrijving"}));
    rst.addColumn(new Column({caption: L("lcl_estate_gebouw_man_bruto_vloeropp"), content: "alg_gebouw_bruto_vloeropp"}));

-
    if (outputmode != 0)
    {
    rst.addColumn(new Column({caption: L("lcl_estate_gebouw_man_opmerk"), content: "alg_gebouw_opmerking"}));
--- a/APPL/ALG/alg_locatie_list.inc
+++ b/APPL/ALG/alg_locatie_list.inc
@@ -101,6 +101,15 @@ function locatie_list(pautfunction, params)
        eDelete = true;
    return ({eDelete: eDelete})
  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var loc_key = oRs("alg_locatie_key").Value;
+    var this_alg = alg.func_enabled(loc_key, "L");
+
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
 %>

 <html>
@@ -173,6 +182,7 @@ function locatie_list(pautfunction, params)
                                   outputmode: outputmode,
                                   flexModule: "ALG",
                                   flexId: "alg_locatie_key",
+                                   flexParams: fnrowFlexParams,
                                   filterParams: params,
                                   buttons: addButton
                                 });
--- a/APPL/ALG/alg_ruimte.asp
+++ b/APPL/ALG/alg_ruimte.asp
@@ -58,7 +58,7 @@ else
    addString = (loc_key > 0? "&loc_key=" + loc_key : "")
              + (geb_key > 0? "&geb_key=" + geb_key : "")
              + (ver_key > 0? "&ver_key=" + ver_key : "")
-              + (cad_ruimte_nr?"&cad_ruimte_nr="+cad_ruimte_nr:"");
+              + (cad_ruimte_nr?"&cad_ruimte_nr="+safe.url(cad_ruimte_nr):"");
  }
 }
 %>
--- a/APPL/ALG/alg_ruimte_list.inc
+++ b/APPL/ALG/alg_ruimte_list.inc
@@ -199,6 +199,15 @@ function ruimte_list(pautfunction, params)
        return (floorCache[oRs("alg_verdieping_key").value]);
      }

+      function fnrowFlexParams(oRs)
+      {
+        var room_key = oRs("alg_ruimte_key").Value;
+        var this_alg = alg.func_enabled(room_key, "R");
+
+        var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+        return flexParams;
+      }
+
      var addurl = "appl/alg/alg_ruimte.asp?a=1";
      addurl += buildTransitParam(["locatiekey", "gebouwkey", "verdiepingkey", "ruimtekey"], params)  // TODO: welke allemaal?

@@ -217,6 +226,7 @@ function ruimte_list(pautfunction, params)
                                     outputmode: outputmode,
                                     flexModule: "ALG",
                                     flexId: "alg_ruimte_key",
+                                     flexParams: fnrowFlexParams,
                                     filterParams: params,
                                     buttons: addButton
                                   });
--- a/APPL/ALG/alg_show_locatie.asp
+++ b/APPL/ALG/alg_show_locatie.asp
@@ -60,7 +60,7 @@ oRs.Close();

      function alg_showphotos()
      {
-        FcltMgr.openDetail("appl/shared/show_foto.asp?urole=bo&root_path=<%=custpath%>/location_images/&loc_key=<%=loc_key%>", "<%=L("lcl_photos")%>");
+        FcltMgr.openDetail("appl/shared/show_foto.asp?urole=bo&loc_key=<%=loc_key%>", "<%=L("lcl_photos")%>");
      }

      function loc_change()
@@ -140,7 +140,7 @@ oRs.Close();
        ROFIELDTR("fld", L("lcl_prs_address_post_land"), pst_land, {suppressEmpty: true});
        ROFIELDTR("fld", L("lcl_estate_locatie_man_verantw"), loc_vw, {suppressEmpty: true});
        ROFIELDTR("fld", L("lcl_estate_locatie_man_verantw_tel"), loc_vwtel, {suppressEmpty: true});
-        ROFIELDTR("fld", L("lcl_noti_email"), loc_mail, {suppressEmpty: true});
+        AFIELDTR('fldmailto details', L("lcl_noti_email"), "mailto:" + loc_mail, loc_mail, { suppressEmpty: true });

        BLOCK_END();

--- a/APPL/ALG/alg_show_terreinsector.asp
+++ b/APPL/ALG/alg_show_terreinsector.asp
@@ -25,7 +25,7 @@ FCLTHeader.Requires({ plugins: ["jQuery"],

 var ter_key  = getQParamInt("ter_key");
 var onrgoedlvl = "T";
-var this_alg = alg.func_enabled(loc_key, onrgoedlvl);
+var this_alg = alg.func_enabled(ter_key, onrgoedlvl);
 user.auth_required_or_abort(this_alg.readman || this_alg.readuse);

 var sql = "SELECT ts.alg_locatie_key"
--- a/APPL/ALG/alg_terreinsector_list.inc
+++ b/APPL/ALG/alg_terreinsector_list.inc
@@ -82,13 +82,22 @@ function terrein_list(pautfunction, params)
  var ter_code = params.ter_code;
  var ter_func = params.ter_func;

-    function fnrowActionEnabler(oRs) // klopt dit voor terreinsector?
-    {
-        var eDelete = false;
-        if (alg.canWriteLocatie(oRs("alg_locatie_key").value, authparams.mALGwritelevel))
-            eDelete = true;
-        return ({eDelete: eDelete})
-    }
+  function fnrowActionEnabler(oRs) // klopt dit voor terreinsector?
+  {
+      var eDelete = false;
+      if (alg.canWriteLocatie(oRs("alg_locatie_key").value, authparams.mALGwritelevel))
+          eDelete = true;
+      return ({eDelete: eDelete})
+  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var ter_key = oRs("alg_terreinsector_key").Value;
+    var this_alg = alg.func_enabled(ter_key, "T");
+
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
 %>

 <html>
@@ -158,6 +167,7 @@ function terrein_list(pautfunction, params)
                                   outputmode: outputmode,
                                   flexModule: "ALG",
                                   flexId: "alg_terreinsector_key",
+                                   flexParams: fnrowFlexParams,
                                   filterParams: params,
                                   buttons: addButton
                                  });
--- a/APPL/ALG/alg_verdieping_list.inc
+++ b/APPL/ALG/alg_verdieping_list.inc
@@ -90,12 +90,21 @@ function verdiepingen_list(pautfunction, params)
  var lvl_key = params.lvl_key;

  function fnrowActionEnabler(oRs)
-    {
-        var eDelete = false;
-        if (alg.canWriteVerdieping(oRs("alg_verdieping_key").value, authparams.mALGwritelevel))
-            eDelete = true;
-        return ({eDelete: eDelete})
-    }
+  {
+    var eDelete = false;
+    if (alg.canWriteVerdieping(oRs("alg_verdieping_key").value, authparams.mALGwritelevel))
+        eDelete = true;
+    return ({eDelete: eDelete})
+  }
+
+  function fnrowFlexParams(oRs)
+  {
+    var ver_key = oRs("alg_verdieping_key").Value;
+    var this_alg = alg.func_enabled(ver_key, "V");
+
+    var flexParams = { readman: this_alg.readman, readuse: this_alg.readuse};
+    return flexParams;
+  }
 %>

  <html>
@@ -164,6 +173,7 @@ function verdiepingen_list(pautfunction, params)
                                   outputmode: outputmode,
                                   flexModule: "ALG",
                                   flexId: "alg_verdieping_key",
+                                   flexParams: fnrowFlexParams,
                                   filterParams: params,
                                   rowData: fnrowData,
                                   rowActionEnabler: fnrowActionEnabler,
--- a/APPL/API/api.asp
+++ b/APPL/API/api.asp
@@ -15,6 +15,7 @@ LCL_Disable = 1;
 ANONYMOUS_Allowed = 1;
 FCLTEXPIRES = 8*60; // geen database interactie tenslotte
 NO_ADDHEADER = 1; // common.inc voert wat globale acties hierdoor niet meer uit
+var EXPIRED_PASSWORD_OK = true; // performance
 %>
 <!-- #include file="../Shared/common.inc"-->
 <!-- #include file="../api/api.inc" -->
@@ -23,6 +24,6 @@ NO_ADDHEADER = 1; // common.inc voert wat globale acties hierdoor niet meer uit
    var APIKEY = getQParam("APIKEY");
    var API = new API_func(APIname, APIKEY); // controleert vanzelf

-    //__DoLog("Transferring to: " + API.apidata.file);
+    __Log("Transferring to: " + API.apidata.file);
    Server.Transfer(API.apidata.file);
 %>
--- a/APPL/API/api.inc
+++ b/APPL/API/api.inc
@@ -57,8 +57,15 @@ function API_func(APIname, APIKEY)

 API_func.prototype.error = function (msg)
 {
-    Response.Status = "500 Internal server error";
-    Response.Write(msg);
+    if (JSON_Result && JSON) // Merk op dat 'invalid APIKEY' al door /default.asp
+    {                        // is onderschept en dus niet hier komt.
+      Response.Write(JSON.stringify({ success: false, message: msg }));
+    }
+    else
+    {
+        Response.Status = "500 Internal server error";
+        Response.Write(safe.html(msg));
+    }
    Response.End;
 }

--- a/APPL/API/api_besordsoap.asp
+++ b/APPL/API/api_besordsoap.asp
@@ -160,7 +160,7 @@
                                        Oracle.Execute(tsql);
                                    }
                                }
-                                else 
+                                else
                                {
                                    resultcode = 5;
                                    resulttekst = "Invalid status change";
@@ -216,7 +216,7 @@
                                    resulttekst = "Invalid status change";
                                }
                            }
-                            else 
+                            else
                            {
                                resultcode = 4;
                                resulttekst = "Remote delivery not enabled";
@@ -282,7 +282,7 @@
                                            + (newbruto ? ", bes_bestelling_item_brutoprijs="+ newbrutoval : "")
                                            + " WHERE bes_bestelling_item_key="+ bi_key;
                                        Oracle.Execute(tsql);
-                                        shared.trackaction("BESUPD", bes_key, L("lcl_bes_is_besupdtrack").format(S("bes_bestelling_prefix") + bes_key));
+                                        shared.trackaction("BESUPD", bes_key, L("lcl_bes_is_besupdtrackprice").format(S("bes_bestelling_prefix") + bes_key, safe.curr(newprijsval)));

                                        // En de bestelopdracht!
                                        tsql = "UPDATE bes_bestelopdr_item "
@@ -292,7 +292,7 @@
                                            + (newbruto ? ", bes_bestelopdr_item_brutoprijs="+ newbrutoval : "")
                                            + " WHERE bes_bestelopdr_item_key="+ boi_key;
                                        Oracle.Execute(tsql);
-                                        shared.trackaction("BES2UP", opdr_key, L("lcl_bes_is_bes2uptrack").format(S("bes_bestelopdr_prefix") + opdrid));
+                                        shared.trackaction("BES2UP", opdr_key, L("lcl_bes_is_bes2uptrackprice").format(S("bes_bestelopdr_prefix") + opdrid, safe.curr(newprijsval)));
                                    }

                                    if (newontv && resultcode == -1)
--- a/APPL/API/api_inssoap.asp
+++ b/APPL/API/api_inssoap.asp
@@ -29,6 +29,7 @@
 %>
 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../Shared/xml_converter.inc" -->
+<!-- #include file="../Shared/json2.js" -->
 <!-- #include file="../api/api.inc" -->
 <%
    // We sturen het antwoord in UTF-8.
@@ -38,6 +39,9 @@
    var APIname = getQParam("API");
    var APIKEY = getQParam("APIKEY");
    var API = new API_func(APIname, APIKEY);
+
+    var asJSON = getQParam("json","0")!="0";
+
    var tsql = "-";        // Voor tijdelijke statement(s)
    var sql = "-";         // De uiteindelijke insert/update-sql
    var xmlReq = Server.CreateObject("MSXML2.DOMDocument.4.0");
@@ -172,8 +176,8 @@
                      + "     , ins_deel_statedate=SYSDATE" // TODO: de meegegeven meetdatumtijd nemen
                      + " WHERE ins_deel_key=" + deel_key;
                  Oracle.Execute(sql);
-
-                  shared.trackaction("INSUPD", deel_key, L("lcl_deel_state")+" "+safe.quoted_sql(waarde)); // met indicatie van soap/wijzing oid.
+                  // FSN#28896: state-changes worden automatisch getrackt in ins_deel_state_history; geen updtracking meer
+                  //shared.trackaction("INSUPD", deel_key, L("lcl_deel_state")+" "+safe.quoted_sql(waarde));
                }
              }
              else { // outinn != ''
@@ -258,7 +262,14 @@
    }
    else
    {
-        Response.ContentType = "text/xml";
-        Response.Write(xmlResp.xml)
+        if (asJSON)
+            Response.ContentType = "application/json";
+        else
+            Response.ContentType = "text/xml";
+
+        if (asJSON)
+            var antwoord = JSON.stringify(xmlToJson(xmlResp), null, getQParam("pretty","0")=="1"?2:0);
+        else
+            var antwoord = xmlResp.xml;
    }
 %>
--- a/APPL/API/api_opdrsoap.asp
+++ b/APPL/API/api_opdrsoap.asp
@@ -54,6 +54,18 @@
        }
        var inputXML = Server.CreateObject("MSXML2.DOMDocument.4.0");
        inputXML.load(Request);
+
+        if (inputXML.parseError.errorCode != 0)
+        {
+            __DoLog( "Error loading XML: "
+                         + inputXML.parseError.errorCode
+                         + "\n" + inputXML.parseError.reason
+                         + " regel " + inputXML.parseError.line
+                         + "(" + inputXML.parseError.linepos + ")"
+                     , "#ff0000");
+        }
+        if (API.apidata.loglevel) __Log2File(inputXML.xml, APIname + "_IN");
+
        inputXML.transformNodeToObject(iXsl, xmlReq);
    }
    else
@@ -172,7 +184,7 @@
                            + "  FROM prs_perslidkostenplaats ppk,"
                            + "       prs_kostenplaats pk"
                            + " WHERE pk.prs_kostenplaats_key = ppk.prs_kostenplaats_key"
-                            + "   AND pk.prs_perslid_key = " + voor_key
+                            + "   AND ppk.prs_perslid_key = " + voor_key
                            + "   AND prs_kostenplaats_verwijder IS NULL"
                            + "   AND prs_perslidkostenplaats_boeken = 1";
                        var oRs = Oracle.Execute(sql);
--- a/APPL/API/api_ressoap_info.asp
+++ b/APPL/API/api_ressoap_info.asp
@@ -11,7 +11,7 @@

    Notes:
 */
-    DOCTYPE_Disable = 1;
+    JSON_Result = true;
    LCL_Disable = 1
    THIS_FILE = "appl/api/api_ressoap_info.asp";

@@ -74,6 +74,19 @@ try
    params.anonymous = true; // erg anoniem
    params.get_deepurl = true; // we willen graag een bookmark

+    if (params.prs_externId && !(params.prs_key > 0))
+    {
+        var sql = "SELECT prs_perslid_key"
+                + "  FROM prs_perslid"
+                + " WHERE prs_perslid_oslogin = " + safe.quoted_sql("_" + params.prs_externId);
+        var oRs = Oracle.Execute(sql);
+        if (!oRs.Eof)
+        {
+            params.prs_key = oRs("prs_perslid_key").Value;
+        }
+        oRs.Close()
+    }
+
    switch (params.request)
    {
        case "plan_rooms_info":
@@ -95,7 +108,7 @@ try

            var inc_queries = ["resruimte"];
            var queries = prodsearch_queries(w_discs, filter);
-            var q_items = [];
+            var q_items = { alg_locatie_plaats: params.alg_locatie_plaats };
            var sql = prodsearch_sql(filter, queries, w_discs, q_items, inc_queries);
            var oRs = Oracle.Execute(sql);
            var plan_info = Oracle.rs2hash(oRs);
@@ -103,18 +116,6 @@ try
            set_deep_info(params, plan_info);
            break;
        case "user_lopend_info": // Alle lopende reserveringen van params.prs_externId
-            if (params.prs_externId && !(params.prs_key > 0))
-            {
-                var sql = "SELECT prs_perslid_key"
-                        + "  FROM prs_perslid"
-                        + " WHERE prs_perslid_oslogin = " + safe.quoted_sql("_" + params.prs_externId);
-                var oRs = Oracle.Execute(sql);
-                if (!oRs.Eof)
-                {
-                    params.prs_key = oRs("prs_perslid_key").Value;
-                }
-                oRs.Close()
-            }

            plan_info = [];
            if (params.prs_key > 0)
@@ -175,6 +176,8 @@ function set_deep_info(params, plan_info)
        plan_info[r].deepurl = deepurl;
        if (plan_info[r].image)
            plan_info[r].image_url = HTTP.urlzelfnoroot() + S("res_image_path") + plan_info[r].image;
+        else if (plan_info[r].foto) // prodsearch
+            plan_info[r].image_url = HTTP.urlzelfnoroot() + S("res_image_path") + plan_info[r].foto;
    }
 }
 %>
--- a/APPL/API/phonebook_js.asp
+++ b/APPL/API/phonebook_js.asp
@@ -14,6 +14,7 @@
 DOCTYPE_Disable = 1;
 FCLTEXPIRES = 8*60; // geen database interactie tenslotte
 THIS_FILE = "appl/api/phonebook_js.asp";
+var EXPIRED_PASSWORD_OK = true; // performance
 %>
 <!-- #include file="../Shared/common.inc"-->
 <!-- #include file="../Shared/json2.js" -->
--- a/APPL/API2/api2.inc
+++ b/APPL/API2/api2.inc
@@ -0,0 +1,679 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api.inc
+    Description:    Functies voor API's
+    Notes:
+
+*/
+%>
+<!-- #include file="../Shared/save2db.inc" -->
+<%
+api2 = {
+    authenticate: function _authenticate(model)
+    {
+        var APIKEY;
+        if (S("fac_api_key_in_url"))
+            APIKEY = getQParam("APIKEY", "");
+        if (!APIKEY && Request.ServerVariables("HTTP_X_FACILITOR_API_KEY").Count)
+            APIKEY = String(Request.ServerVariables("HTTP_X_FACILITOR_API_KEY")); // Meegegeven als X-FACILITOR-API-Key
+
+        if (!APIKEY && Session("user_key") > 0)
+        {
+            user_key = Session("user_key"); // Hierdoor is de API intern te gebruiken zonder authenticatie
+        }
+        else
+        {
+            Session.Abandon(); // Altijd, voor de zekerheid
+
+            var sql = "SELECT prs_perslid_key, prs_perslid_naam"
+                    + "  FROM prs_perslid"
+                    + " WHERE prs_perslid_verwijder IS NULL"
+                    + "   AND prs_perslid_apikey = " + safe.quoted_sql(APIKEY);
+            var oRs = Oracle.Execute(sql);
+            if (oRs.Eof || !APIKEY)
+            {
+                Response.Status = "401 Unauthorized";
+                //Response.AddHeader("WWW-Authenticate", "Basic realm=\"FACILITOR API\"");
+                Response.End;
+            };
+            __Log("API2 User is: " + oRs("prs_perslid_naam").Value);
+            /* global */ user_key = oRs("prs_perslid_key").Value;
+            oRs.Close();
+        }
+        /* global */ user = new Perslid(user_key);
+
+        // Impersonate?
+        var IMPERS;
+        if (S("fac_api_key_in_url"))
+            IMPERS = getQParam("SWITCHUSER", "");
+        if (!IMPERS && Request.ServerVariables("HTTP_X_FACILITOR_SWITCH_USER").Count)
+            IMPERS = String(Request.ServerVariables("HTTP_X_FACILITOR_SWITCH_USER")); // Meegegeven als X-FACILITOR-SWITCH-USER
+        if (IMPERS) // && S("fac_api_allow_impersonate")
+        {
+           var sql = "SELECT prs_perslid_key, prs_perslid_naam"
+                   + "  FROM prs_perslid"
+                   + " WHERE prs_perslid_verwijder IS NULL"
+                    + "   AND prs_perslid_oslogin = " + safe.quoted_sql_upper(IMPERS);
+            var oRs = Oracle.Execute(sql);
+            if (oRs.Eof)
+            {
+                Response.Status = "412 Invalid X-Facilitor-Switch-User header";
+                Response.End;
+            };
+            __Log("IMPERS User is: " + oRs("prs_perslid_naam").Value);
+            var other_user_key = oRs("prs_perslid_key").Value;
+            oRs.Close();
+            if (model.impersonate_auth)
+            {
+                var xfunc = user.func_enabled2(model.module, { prs_key: other_user_key, isOptional: true });
+                var can = (xfunc && xfunc.canRead(model.impersonate_auth));
+                if (can)
+                    /* global */ user_key = other_user_key;
+            }
+            if (user_key != other_user_key)
+            {
+                Response.Status = "412 Unauthorized X-Facilitor-Switch-User header";
+                Response.End;
+            }
+        }
+    },
+    process: function _process(model)
+    {
+        CheckForLogging(Request.QueryString("logging"));
+
+        Session.Codepage = 65001; // We doen *uitsluitend* utf-8
+        Response.Charset = 'utf-8';
+
+        api2.authenticate(model);
+
+        var method = String(Request.ServerVariables("REQUEST_METHOD"));
+
+        if (!/GET|PUT|POST|DELETE/.test(method)) // Overigens houdt IIS deze al eerder tegen
+        {
+            Response.Status = "405 Method not allowed";
+            Response.End;
+        }
+        if (!("REST_" + method in model))
+        {
+            Response.Status = "501 Not Implemented";
+            // TODO The response MUST include an Allow header containing a list of valid methods for the requested resource.
+            Response.End;
+        }
+        var jsondata = {};
+        if (/PUT|POST/.test(method))
+        {
+            jsondata = RequestJSON(); // TODO: XML ondersteunen
+            if (!jsondata)
+                api2.error(500, "Error parsing input JSON");
+        }
+        var key = getQParamInt("id", -1); // Voor GET/PUT/DELETE
+
+        var data = model["REST_" + method]( { filter: api2.qs2json(), include: getQParamArray("include",[]) }, jsondata, key );
+        if (method == "DELETE")
+        {
+            Response.Status = "204 No Content";
+            Response.End;
+        }
+
+        api2.deliver(data, getQParamSafe("format", "json"),
+                           model.records_name,
+                           model.record_name,
+                           (method != "GET")||getQParamInt("id","0")>0); // PUT en POST altijd single
+
+    },
+    qs2json: function _qs2json(params)
+    {
+        var filter = {};
+        for (var i = 1; i<= Request.QueryString.Count; i++)
+        {
+            filter[Request.QueryString.key(i)] = String(Request.QueryString(i));
+        }
+        return filter;
+    },
+
+    // Verwerk filtervelden die in de url zijn meegegeven
+    sqlfilter: function _sqlfilter(params, model)
+    {
+        var wheres = [];
+        if (params.filter)
+        {
+            for (var fld in model.fields)
+            {
+                var field = model.fields[fld];
+                var filter = field.filter;
+                if (!filter)
+                    continue;
+
+                if (field.name in params.filter)
+                {
+                    var filterval = params.filter[field.name];
+                    // TODO: operand?
+                    var clause;
+                    switch (field.typ)
+                    {
+                        case "key":
+                            var safe_val = parseInt(filterval, 10);
+                            if (isNaN(safe_val))
+                            {
+                                Response.Status = "404 Not Found";
+                                Response.End;
+                            }
+                            break;
+                        case "number":
+                        case "check":
+                            var safe_val = parseInt(filterval, 10);
+                            if (isNaN(safe_val))
+                            {
+                                Response.Status = "404 Not Found";
+                                Response.End;
+                            }
+                            break;
+                        case "varchar":
+                            var safe_val = safe.quoted_sql(filterval);
+                            break;
+                        default:
+                            UNKNOWN_FILTER_TYPE;
+                    }
+                    var dbs = field.dbs;
+                    if (dbs.indexOf(".") < 0)
+                        dbs = model.table + "." + field.dbs;
+
+                    wheres.push(dbs + " = " + safe_val);
+                }
+            }
+        }
+        return wheres;
+    },
+
+    sqlfields: function _sqlfields(params, model)
+    {
+        var selects = [];
+        var tables = [ model.table ];
+        var wheres = [];
+
+        var name_cnt = 0;
+        for (var fld in model.fields)
+        {
+            var field = model.fields[fld];
+            if (!field.name)
+                continue;
+
+            var dbs = field.dbs;
+            if (field.sql)
+            {
+                selects.push(field.sql + " AS " + field.dbs);
+            }
+            else
+            {
+                if (dbs.indexOf(".") < 0)
+                    dbs = model.table + "." + field.dbs;
+
+                selects.push(dbs);
+            }
+            if (field.foreign && typeof field.foreign == 'string') // de functions komen later
+            {
+                var foreign = foreignKeyTable(field.foreign);
+                if (!foreign)
+                    MISSING_FOREIGN;
+                field.foreignsql = "SELECT " + foreign.desc
+                                 + "  FROM " + foreign.tbl + " " + (foreign.alias||"xx")
+                                 + " WHERE ";
+                if (foreign.where)
+                    field.foreignsql += foreign.where + " AND ";
+                field.foreignsql += (foreign.alias||"xx") + "." + foreign.key + " = " + dbs;
+                if (foreign.desc.match(/\_CODE$/i))
+                    field.foreigniscode = true;
+            }
+            if (field.foreignsql)
+            {
+                name_cnt ++;
+                field._foreignname = "foreign_" + name_cnt; // Genereer een niet al te extreem lange naam
+                selects.push("(" + field.foreignsql + ") " + field._foreignname);
+            }
+        }
+        if (params.include && model.includes)
+        {
+            for (var i in params.include)
+            {
+                if (params.include[i] in model.includes)
+                {
+                    var inc = model.includes[params.include[i]];
+                    if (inc.model)
+                    {
+                        var incquery = api2.sqlfields(params, inc.model);
+
+                        selects = selects.concat (incquery.selects);
+                        tables = tables.concat (incquery.tables);
+                        wheres = wheres.concat (incquery.wheres);
+                        wheres.push ( model.table + "." + model.primary + "=" + inc.model.table + "." + inc.joinfield);
+                    }
+                }
+            }
+        }
+        return { selects: selects, tables: tables, wheres: wheres };
+    },
+
+    // TODO the_key *moet* bestaan. Andere filtervelden negeren we
+    update_fields: function _update_fields(params, model, jsondata)
+    {
+//__DoLogj(jsondata)
+        if (jsondata[model.record_name])
+            jsondata = jsondata[model.record_name]; // dereference
+
+        var fields = [];
+        for (var fld in model.fields)
+        {
+            var field = model.fields[fld];
+            // De key halen we uit de url, die in de JSON negeren we
+            if (field.name == "id")
+                continue;
+            if (field.dbs.indexOf(".") >= 0) // complexe foreign key
+                continue;
+            if (!(field.name in jsondata) && !field.fnval)
+                continue;
+
+            if (field.fnval)
+                var newval = field.fnval(jsondata);
+            else // simpel
+                var newval = jsondata[field.name];
+
+            // De foreign keys action { "id": "5", "name": "afhalen" }
+            if (field.typ == "key" && newval && typeof newval == "object")
+                newval = newval.id;
+
+            var newfield = { dbs: field.dbs,
+                             typ: field.typ,
+                             val: newval
+                           };
+            fields.push(newfield);
+        }
+        return fields;
+
+    },
+    // Verwerk de POST en PUT (== insert en update)
+    process_includes: function(params, model, jsondata, the_key)
+    {
+        if (jsondata[model.record_name])
+            jsondata = jsondata[model.record_name]; // dereference
+
+        if (!model.includes)
+            return [];
+        for (var incname in model.includes)
+        {
+            if (incname in jsondata) // i=="visitors"
+            {
+                var inc = model.includes[incname];
+                if (inc.model) // andere includes zijn nog niet bij te werken
+                {
+                    var incmodel = inc.model;
+
+                    // Vul existing_includes met bestaande records in de database
+                    var sql = "SELECT " + incmodel.primary
+                            + "  FROM " + incmodel.table
+                            + " WHERE " + incmodel.table + "." + inc.joinfield + "=" + the_key;
+                    var existing_includes = {};
+                    var oRs = Oracle.Execute(sql);
+                    while (!oRs.Eof)
+                    {
+                        //__DoLog("Found in DB " + incname + " " + oRs(incmodel.primary).Value);
+                        existing_includes[oRs(incmodel.primary).Value] = { found: false }; // vooralsnog niet in json-data gevonden
+                        oRs.MoveNext();
+                    }
+                    oRs.Close();
+
+                    var incdata = jsondata[incname]; // Array zoals via API aangeleverd
+                    for (var j=0; j<incdata.length; j++)
+                    {
+                        var inckey = incdata[j]["id"]; // Die moet er zijn
+                        if (!inckey || inckey < 0 || params.isNew)
+                        {
+                            //__DoLog("Ik zou moeten inserten");
+                            incmodel.REST_POST(params, incdata[j], the_key);
+                        }
+                        else if (inckey in existing_includes)
+                        {
+                            //__DoLog("Ik zou '{0}' {1} moeten updaten".format(incname, inckey));
+                            incmodel.REST_PUT(params, incdata[j], inckey);
+                            existing_includes[inckey].found = true;
+                        }
+                    }
+                    for (oldi in existing_includes)
+                    {
+                        if (!existing_includes[oldi].found)
+                        {
+                            incmodel.REST_DELETE(params, incdata[j], oldi);
+                        }
+                    }
+                }
+                else
+                {
+                    //if (inc.func)
+                }
+            }
+        }
+    },
+    // Geeft de GET terug
+    sql2jsonval: function(oRs, field)
+    {
+//__DoLog(field.dbs);
+        if (field.dbs.indexOf(".") < 0)
+            var val = oRs(field.dbs).Value;
+        else
+            var val = oRs(field.dbs.split(".")[1]).Value;
+        if (field.typ == "date" && (val != null))
+            val = new Date(val)
+        if (field.typ == "datetime" && (val != null))
+            val = new Date(val)
+        // TODO: Wat te doen met lege waarde
+        // action: null
+        // action: {key: null, name: null}
+        // action: {}
+        // of helemaal weglaten? We hebben nu de 1e optie
+        // En wat bij een leeg (include) array? Dan kun je ook nog occupations:[] krijgen
+        if (val && (field.foreign || field.foreignsql))
+        {
+            if (field.foreignsql)
+            {
+                var name = oRs(field._foreignname).Value;
+                if (name != null && typeof name == "date" )
+                    name = new Date(name);
+            }
+            else
+            {
+                var name = field.foreign(val);
+            }
+            val = { id: val };
+            if (field.foreigniscode)
+                val.code = name;
+            else
+                val.name = name;
+        }
+        return val;
+    },
+    sql2jsonfields: function (oRs, model)
+    {
+        var record = {};
+        for (var fld in model.fields)
+        {
+            var field = model.fields[fld];
+            if (!field.name)
+                continue;
+
+            record[field.name] = api2.sql2jsonval(oRs, field);
+        }
+        return record;
+    },
+    sql2json: function _sql2json(params, sql, model)
+    {
+        var prefuncdata;
+        var prefuncdatainitialized = false;
+        var prefilterfuncdata;
+        if (model.filter && model.filter.prefunc)
+            prefilterfuncdata = model.filter.prefunc(params);
+
+        var data = [];
+        var oRs = Oracle.Execute(sql);
+        var lastkey = -1;
+        while (!oRs.Eof)
+        {
+            var key = oRs(model.primary).Value;
+            if (key != lastkey)
+            {
+                if (lastkey > 0)
+                    data.push(record);
+                var record = {};
+            }
+
+            if (model.filter && model.filter.func)
+            {
+                if (!model.filter.func(oRs, params, prefilterfuncdata))
+                {
+                    oRs.MoveNext();
+                    continue;
+                }
+            }
+
+            var fld;
+            for (fld in model.fields)
+            {
+                var field = model.fields[fld];
+                if (!field.name)
+                    continue;
+                record[field.name] = api2.sql2jsonval(oRs, field);
+            }
+
+            if (params.include && model.includes)
+            {
+                for (var i in params.include)
+                {
+                    var incname = params.include[i];
+                    if (incname in model.includes)
+                    {
+                        var incmodel = model.includes[incname].model;
+                        if (!(incname in record))
+                            record[incname] = [];
+                        if (incmodel)
+                        {
+                            record[incname].push(api2.sql2jsonfields(oRs, incmodel));
+                        }
+                        else if (model.includes[incname].func)
+                        {
+                            if (model.includes[incname].prefunc && !prefuncdatainitialized)
+                            {
+                                prefuncdata = model.includes[incname].prefunc(params);
+                                prefuncdatainitialized = true;
+                            }
+                            var incdata = model.includes[incname].func(key, params, prefuncdata);
+                            if (incdata !== null)
+                                record[incname].push(incdata);
+                        }
+                    }
+                }
+            }
+
+            lastkey = key;
+            oRs.MoveNext();
+        }
+        if (lastkey > 0)
+            data.push(record);
+        return data;
+    },
+    // Data is een array met 'records'
+    deliver: function _deliver(data, format, records_name, record_name, single )
+    {
+        if (single && !data.length)
+        {
+            Response.Status = "404 Not Found";
+            Response.End;
+        }
+
+        switch (format)
+        {
+            case "json":
+                var result = { };
+                if (single)
+                    result[record_name] = data[0];
+                else
+                    result[records_name] = data;
+
+                var str_antwoord = JSON.stringify(result, null, getQParam("pretty","0")=="1"?2:0);
+
+                var jsonp = getQParam("jsonp", getQParam("callback",""));
+                if (jsonp)
+                {
+                    str_antwoord = jsonp + "(" + str_antwoord + ")";
+                    Response.ContentType = "application/javascript";
+                }
+                else
+                    Response.ContentType = "application/json";
+                break;
+            case "html":
+                Response.ContentType = "text/html";
+                var result = { };
+                if (single)
+                    result[record_name] = data[0];
+                else
+                    result[records_name] = data;
+                var antwoord = JSON.stringify(result, null, 2);
+                var str_antwoord = "<!DOCTYPE html><html><head></head><body><pre>"
+                                 +      Server.HTMLEncode(antwoord)
+                                 + "</pre></body></html>";
+                break;
+            case "xml":
+                Response.ContentType = "text/xml";
+                var xml_antwoord = api2.json2xml(data, records_name, record_name, single);
+                // TODO: Output XSL transform ondersteunen?
+                var str_antwoord = xml_antwoord.xml;
+                break;
+            default:
+                WRONG_FORMAT;
+        }
+
+        // str_antwoord heeft nu het te versturen antwoord
+        // Bepaal eTag
+        var oCrypto = new ActiveXObject("SLNKDWF.Crypto");
+        var eTag = '"' + oCrypto.hex_sha1(String(S("cache_changecounter")) + "_" + str_antwoord).toLowerCase() + '"';
+        Response.AddHeader("ETag", eTag);
+        if (Request.ServerVariables("HTTP_IF_NONE_MATCH") == eTag)
+        {   // We hebben een match! Effectief besparen wel alleen op dataverkeer, de queries zijn al geweest
+            Response.Clear();
+            Response.Status = "304 Not modified";
+            Response.End;
+        }
+
+        // if (API.apidata.loglevel) __Log2File(str_antwoord, APIname + "_OUT");
+        Response.write(str_antwoord);
+    },
+
+    // TODO: Wanneer attributes gebruiken en wanneer (sub)-elements?
+    json2xml: function _json2xml(data, rootname, record_name, single)
+    {
+        var xmlDoc = new ActiveXObject("MSXML2.DOMDocument.4.0");
+        xmlDoc.appendChild(xmlDoc.createProcessingInstruction("xml", "version=\"1.0\" encoding=\"utf-8\""));
+
+        var record2json = function(record, record_name)
+        {
+            var elementRecord = xmlDoc.createElement(record_name);
+            for (var fld in record)
+            {
+                var elementField = xmlDoc.createElement(fld);
+                if (record[fld] instanceof Date)
+                {
+                    var elementFieldText = xmlDoc.createTextNode(String(record[fld].toJSON()));
+                    elementField.appendChild(elementFieldText);
+                }
+                else if (record[fld] instanceof Array)
+                {
+                    for (var i = 0; i < record[fld].length; i++)
+                        elementField.appendChild(record2json(record[fld][i], "visitor")); // TODO Hardcoded
+                }
+                else if (record[fld] && typeof record[fld] == "object") // TODO: veronderstelt nog hardcoded dat dit foreign met name/key is
+                {
+                    if ("name" in record[fld] && "id" in record[fld])
+                    {
+                        elementField.setAttribute("name", record[fld].name);
+                        elementField.setAttribute("id", record[fld].id);
+                    }
+                    else
+                        elementField = record2json(record[fld], fld);
+                }
+                else
+                {
+                    var elementFieldText = xmlDoc.createTextNode(record[fld]||"");
+                    elementField.appendChild(elementFieldText);
+                }
+                elementRecord.appendChild(elementField);
+            }
+            return elementRecord;
+        };
+
+        if (single)
+        {
+            xmlDoc.appendChild(record2json(data[0], record_name));
+        }
+        else
+        {
+            var arrayElement = xmlDoc.createElement(rootname);
+            for (var i = 0; i < data.length; i++)
+                arrayElement.appendChild(record2json(data[i], record_name));
+            xmlDoc.appendChild(arrayElement);
+        }
+        return xmlDoc;
+    },
+    error: function (code, msg)
+    {
+        abort_with_warning(msg, code)
+    }
+}
+
+
+// LET OP: Verwacht wordt dat de JSON-code in de body utf-8 encoded is, niet windows-1252!
+// (in de praktijk moet je *moeite* doen om windows-1252 te krijgen dus dit is handiger)
+function RequestJSON()
+{
+    var jvraag;
+    if(Request.TotalBytes > 0)
+    {
+        var lngBytesCount = Request.TotalBytes;
+        jvraag = BytesToStr(Request.BinaryRead(lngBytesCount));
+    }
+    __Log("Vraag: " + jvraag);
+    try
+    {
+        var vraag = myJSON.parse(jvraag);
+    }
+    catch (e)
+    {
+        __DoLog("eval faalt met: {0}<br>{1}".format(e.description, jvraag), "ffff00");
+        return null;
+    }
+    return vraag;
+}
+
+function BytesToStr(bytes)
+{
+    var stream = Server.CreateObject("ADODB.Stream");
+    stream.type = 1;
+    stream.open;
+    stream.write(bytes);
+    stream.position = 0;
+    stream.type = 2; // Text
+    stream.charset = "utf-8";
+
+    var sOut = stream.readtext();
+    stream.close;
+    return sOut;
+}
+
+function getQParamISODate(pName, defVal)
+{
+    return _get_ParamISODate(Request.Querystring, pName, defVal)
+}
+function getFParamISODate(pName, defVal)
+{
+    return _get_ParamISODate(Request.Form, pName, defVal)
+}
+function _get_ParamISODate(pColl, pName, defVal)
+{
+    var strval = _get_Param(pColl, pName, defVal, true); // force: een lege waarde wordt als afwezig beschouwd
+    if (strval)
+    {
+        var dt = myJSON.internal_parsedate(null, strval);
+        if (dt && dt instanceof Date)
+            return dt;
+    }
+
+    if (defVal instanceof Date)
+    {
+        return defVal;
+    }
+    if (defVal === null) // bewust triple===
+    {
+        return null;
+    }
+    // Error message will get to client and/or IIS logfiles
+    eval("INTERNAL_ERROR_PARAMETER_" + pName + "_IS_NOT_ISODATE");
+}
+%>
--- a/APPL/API2/api_appointments.asp
+++ b/APPL/API2/api_appointments.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_appointments.asp
+
+    Description:    BEZ_AFSPRAAK API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_appointments.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_appointments.inc" -->
+<%
+    api2.process(model_appointments);
+%>
--- a/APPL/API2/api_buildings.asp
+++ b/APPL/API2/api_buildings.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_buildings.asp
+
+    Description:    ALG_GEBOUW API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_buildings.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_buildings.inc" -->
+<%
+    api2.process(model_buildings);
+%>
--- a/APPL/API2/api_districts.asp
+++ b/APPL/API2/api_districts.asp
@@ -0,0 +1,25 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_districts.asp
+
+    Description:    ALG_LOCATIE API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_districts.asp";
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_districts.inc" -->
+<%
+    api2.process(model_districts);
+%>
--- a/APPL/API2/api_locations.asp
+++ b/APPL/API2/api_locations.asp
@@ -0,0 +1,25 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_locations.asp
+
+    Description:    ALG_LOCATIE API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_locations.asp";
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_locations.inc" -->
+<%
+    api2.process(model_locations);
+%>
--- a/APPL/API2/api_persons.asp
+++ b/APPL/API2/api_persons.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_persons.asp
+
+    Description:    PRS_PERSLID API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_persons.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_persons.inc" -->
+<%
+    api2.process(model_persons);
+%>
--- a/APPL/API2/api_regions.asp
+++ b/APPL/API2/api_regions.asp
@@ -0,0 +1,25 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_regions.asp
+
+    Description:    ALG_REGIO API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_regions.asp";
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_regions.inc" -->
+<%
+    api2.process(model_regions);
+%>
--- a/APPL/API2/api_reservablerooms.asp
+++ b/APPL/API2/api_reservablerooms.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_reservablerooms.asp
+
+    Description:    RES_RUIMTE API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_reservablerooms.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_reservablerooms.inc" -->
+<%
+    api2.process(model_reservablerooms);
+%>
--- a/APPL/API2/api_reservations.asp
+++ b/APPL/API2/api_reservations.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_reservations.asp
+
+    Description:    PRS_PERSLID API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_reservations.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_reservations.inc" -->
+<%
+    api2.process(model_reservations);
+%>
--- a/APPL/API2/api_visitors.asp
+++ b/APPL/API2/api_visitors.asp
@@ -0,0 +1,27 @@
+<%@ language = "JavaScript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           api_visitors.asp
+
+    Description:    BEZ_AFSPRAAK API
+    Parameters:
+    Context:        Door een remote systeem (geen persoon) om info uit FACILITOR te halen aan te roepen
+
+    Notes:
+*/
+    DOCTYPE_Disable = true;
+    ANONYMOUS_Allowed = 1; // Eigenlijk niet waar. We regelen echter alles zelf
+    THIS_FILE = "appl/api/api_visitors.asp";
+
+//    Session("logging")=1;
+
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="./api2.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./model_visitors.inc" -->
+<%
+    api2.process(model_visitors);
+%>
--- a/APPL/API2/model_appointments.inc
+++ b/APPL/API2/model_appointments.inc
@@ -0,0 +1,134 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_appointments.inc
+
+    Description:    Afspraken model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<!-- #include file="./model_visitors.inc" -->
+<%
+function afs_alg_onrgoed_keys(jsondata)
+{
+    // TODO: key-check, auth check
+    if (jsondata.room && jsondata.room.id > 0)
+        return jsondata.room.id;
+    if (jsondata.floor && jsondata.floor.id > 0)
+        return jsondata.floor.id;
+    if (jsondata.building && jsondata.building.id > 0)
+        return jsondata.building.id;
+    return null;
+};
+
+model_appointments =
+{
+    module: "BEZ",
+    table: "bez_afspraak",
+    primary: "bez_afspraak_key",
+    records_name: "appointments",
+    record_name: "appointment",
+    fields: [{ name: "id",          dbs: "bez_afspraak_key",                          typ: "key",     filter: "exact" },
+             { name: "from",        dbs: "bez_afspraak_datum",                        typ: "datetime"},
+             { name: "to",          dbs: "bez_afspraak_eind",                         typ: "datetime"},
+             { name: "description", dbs: "bez_afspraak_opmerking",                    typ: "varchar"},
+             { name: "action",      dbs: "bez_actie_key",                             typ: "key",     foreign: "bez_actie"},
+             { name: "location",    dbs: "alg_locatie_key",                           typ: "key",     foreign: "alg_locatie"},
+             { name: "building",    dbs: "alg_v_allonroerendgoed.alg_gebouw_key",     typ: "key",     foreign: "alg_gebouw" },
+             { name: "floor",       dbs: "alg_v_allonroerendgoed.alg_verdieping_key", typ: "key",     foreign: "alg_verdieping" },
+             { name: "room",        dbs: "alg_v_allonroerendgoed.alg_ruimte_key",     typ: "key",     foreign: "alg_ruimte" },
+             {                      dbs: "alg_onrgoed_keys",                          typ: "key",     fnval: afs_alg_onrgoed_keys }
+            ],
+    includes: {"visitors": { model: model_visitors,
+                             joinfield: "bez_afspraak_key"
+                           }
+              },
+    impersonate_auth: "WEB_BEZFOF",
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization hoewel je eigen afspraken zien natuurlijk niet echt spannend is
+            var query = api2.sqlfields(params, model_appointments );
+            query.wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+                               + "     OR bez_afspraak_host_key = " + user_key + ")");
+            query.wheres.push("bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez"));
+
+            query.tables.push("alg_v_allonroerendgoed");
+            query.wheres.push("alg_v_allonroerendgoed.alg_onroerendgoed_keys(+) = bez_afspraak.alg_onrgoed_keys");
+
+            var wheres = api2.sqlfilter(params, model_appointments);
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY bez_afspraak_datum, bez_afspraak.bez_afspraak_key";
+__DoLog(sql);
+            var json = api2.sql2json (params, sql, model_appointments );
+
+            return json;
+        },
+
+    REST_PUT: function (params, jsondata, the_key) /* update appointment */
+        {
+            var fields = api2.update_fields(params, model_appointments, jsondata); // Build updater
+
+            // bezUpd heeft na afloop eventueel oldjsvals
+            var wheres = [" bez_afspraak_key = " + the_key];
+            wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+                               + "     OR bez_afspraak_host_key = " + user_key + ")");
+            var bezUpd = buildTrackingUpdate("bez_afspraak", wheres.join(" AND " ), fields, { noValidateToken: true });
+            __DoLog(bezUpd.sql);
+            Oracle.Execute(bezUpd.sql);
+
+            var beztrack = api2.process_includes(params, model_appointments, jsondata, the_key);
+
+            // TODO: Tracking
+            //var result = saveBezoekers(afspr_key, -1, { urole: urole, loctimechanged: changed });
+            //if (result.beztrack && result.beztrack.length > 0)
+            //bezUpd.trackarray.push(result.beztrack.join("\n"));
+
+            return model_appointments.REST_GET(params); // resulterende data weer terug
+        },
+    REST_POST: function (params, jsondata) /* new appointment */
+        {
+            var fields = api2.update_fields(params, model_appointments, jsondata); // Build updater
+            fields.push({ dbs: "bez_afspraak_key",      typ: "key",     seq: "bez_s_bez_afspraak_key" });
+            fields.push({ dbs: "bez_afspraak_host_key",    typ: "key",  val: user_key });
+            fields.push({ dbs: "bez_afspraak_contact_key", typ: "key",  val: user_key });
+
+            var bezIns = buildInsert("bez_afspraak", fields, { noValidateToken: true });
+            var afs_key = bezIns.sequences["bez_afspraak_key"];
+            __DoLog(bezIns.sql);
+            Oracle.Execute(bezIns.sql);
+
+            // TODO: Tracking
+            params.isNew = true; // negeer eventuele bestaande keys
+            var beztrack = api2.process_includes(params, model_appointments, jsondata, afs_key);
+            //var bezUpd = {trackarray: [L("lcl_bez_is_bezadd") + ": " + beznaam + "/" + bed]};
+            params.filter.id = afs_key;
+            return model_appointments.REST_GET(params); // resulterende data weer terug
+        },
+    REST_DELETE: function (params, jsondata, the_key) /* delete appointment */
+    {
+            var wheres = [" bez_afspraak_key = " + the_key];
+            wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+                               + "     OR bez_afspraak_host_key = " + user_key + ")");
+            var sql = "DELETE FROM bez_afspraak"
+                    + " WHERE " + wheres.join(" AND " );
+
+            __DoLog(sql);
+            Oracle.Execute(sql);
+    }
+}
+%>
--- a/APPL/API2/model_buildings.inc
+++ b/APPL/API2/model_buildings.inc
@@ -0,0 +1,65 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_buildings.inc
+
+    Description:    Gebouwen model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_buildings =
+{
+    table: "alg_gebouw",
+    primary: "alg_gebouw_key",
+    records_name: "buildings",
+    record_name: "building",
+    fields: [{ name: "id",           dbs: "alg_gebouw_key",          typ: "key",     filter: "exact" },
+             { name: "code",         dbs: "alg_gebouw_code",         typ: "varchar", filter: "like" },
+             { name: "name",         dbs: "alg_gebouw_naam",         typ: "varchar", filter: "like" },
+             // is afgeleid gegeven { name: "description",  dbs: "alg_gebouw_omschrijving", typ: "varchar"},
+             { name: "visitable"  ,  dbs: "alg_gebouw_bez",          typ: "check",   filter: "exact"},
+             { name: "location",     dbs: "alg_locatie_key",         typ: "key",     foreign: "alg_locatie"},
+             { name: "coordinate_x", dbs: "alg_gebouw_x",            typ: "number"},
+             { name: "coordinate_y", dbs: "alg_gebouw_y",            typ: "number"},
+            ],
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_buildings);
+            query.wheres.push("alg_gebouw_verwijder IS NULL");
+
+            var wheres = api2.sqlfilter(params, model_buildings)
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY alg_gebouw_code";
+
+            var json = api2.sql2json (params, sql, model_buildings);
+
+            return json;
+        },
+    PUT: function (params) /* update building */
+    {
+    },
+    POST: function (params) /* new building */
+    {
+    },
+    DELETE: function (params) /* delete building */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_districts.inc
+++ b/APPL/API2/model_districts.inc
@@ -0,0 +1,61 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_districts.inc
+
+    Description:    District model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_districts =
+{
+    table: "alg_district",
+    primary: "alg_district_key",
+    records_name: "districts",
+    record_name: "district",
+    fields: [{ name: "id",           dbs: "alg_district_key",          typ: "key",     filter: "exact" },
+             //{ name: "name",         dbs: "alg_district_naam",         typ: "varchar", filter: "like" },
+             { name: "name",         dbs: "alg_district_omschrijving", typ: "varchar"},
+             { name: "region",       dbs: "alg_regio_key",             typ: "key",     foreign: "alg_regio"}
+            ],
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_districts);
+            query.wheres.push("alg_district_verwijder IS NULL");
+
+            var wheres = api2.sqlfilter(params, model_districts)
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY alg_district_omschrijving";
+
+            var json = api2.sql2json (params, sql, model_districts);
+
+            return json;
+        },
+    PUT: function (params) /* update district */
+    {
+    },
+    POST: function (params) /* new district */
+    {
+    },
+    DELETE: function (params) /* delete district */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_locations.inc
+++ b/APPL/API2/model_locations.inc
@@ -0,0 +1,64 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_locations.inc
+
+    Description:    Locatie model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_locations =
+{
+    table: "alg_locatie",
+    primary: "alg_locatie_key",
+    records_name: "locations",
+    record_name: "location",
+    fields: [{ name: "id",           dbs: "alg_locatie_key",          typ: "key",     filter: "exact" },
+             { name: "code",         dbs: "alg_locatie_code",         typ: "varchar", filter: "like" },
+             //{ name: "name",         dbs: "alg_locatie_naam",         typ: "varchar", filter: "like" },
+             { name: "description",  dbs: "alg_locatie_omschrijving", typ: "varchar"},
+             { name: "district",     dbs: "alg_district_key",         typ: "key",     foreign: "alg_district"},
+             { name: "coordinate_x", dbs: "alg_locatie_x",            typ: "number"},
+             { name: "coordinate_y", dbs: "alg_locatie_y",            typ: "number"},
+            ],
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_locations);
+            query.wheres.push("alg_locatie_verwijder IS NULL");
+
+            var wheres = api2.sqlfilter(params, model_locations)
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY alg_locatie_code";
+
+            var json = api2.sql2json (params, sql, model_locations);
+
+            return json;
+        },
+    PUT: function (params) /* update location */
+    {
+    },
+    POST: function (params) /* new location */
+    {
+    },
+    DELETE: function (params) /* delete location */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_persons.inc
+++ b/APPL/API2/model_persons.inc
@@ -0,0 +1,67 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_persons.inc
+
+    Description:    Perslid model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_persons =
+{
+    table: "prs_perslid",
+    primary: "prs_perslid_key",
+    records_name: "persons",
+    record_name: "person",
+    fields: [{ name: "id",          dbs: "prs_perslid_key",       typ: "key",       filter: "exact" },
+             { name: "lastname",    dbs: "prs_perslid_naam",      typ: "varchar"},
+             { name: "firstname",   dbs: "prs_perslid_voornaam",  typ: "varchar"},
+             { name: "mail",        dbs: "prs_perslid_email",     typ: "varchar"},
+             { name: "login",       dbs: "prs_perslid_oslogin",   typ: "varchar"},
+             { name: "department",  dbs: "prs_afdeling_key",      typ: "key",       foreign: "prs_afdeling"}
+            ],
+
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_persons );
+
+            query.wheres.push("prs_perslid_key = " + user_key); // Altijd fe vooralnog
+
+            var wheres = api2.sqlfilter(params, model_persons);
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY prs_perslid_naam, prs_perslid.prs_perslid_key";
+
+__DoLog(sql);
+
+            var json = api2.sql2json (params, sql, model_persons );
+
+            return json;
+        },
+    PUT: function (params) /* update building */
+    {
+    },
+    POST: function (params) /* new building */
+    {
+    },
+    DELETE: function (params) /* delete building */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_regions.inc
+++ b/APPL/API2/model_regions.inc
@@ -0,0 +1,60 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_regions.inc
+
+    Description:    Regio model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_regions =
+{
+    table: "alg_regio",
+    primary: "alg_regio_key",
+    records_name: "regions",
+    record_name: "region",
+    fields: [{ name: "id",           dbs: "alg_regio_key",          typ: "key",     filter: "exact" },
+             //{ name: "name",         dbs: "alg_region_naam",         typ: "varchar", filter: "like" },
+             { name: "name",  dbs: "alg_regio_omschrijving", typ: "varchar"}
+            ],
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_regions);
+            query.wheres.push("alg_regio_verwijder IS NULL");
+
+            var wheres = api2.sqlfilter(params, model_regions)
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY alg_regio_omschrijving";
+
+            var json = api2.sql2json (params, sql, model_regions);
+
+            return json;
+        },
+    PUT: function (params) /* update region */
+    {
+    },
+    POST: function (params) /* new region */
+    {
+    },
+    DELETE: function (params) /* delete region */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_reservablerooms.inc
+++ b/APPL/API2/model_reservablerooms.inc
@@ -0,0 +1,170 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_reservablerooms.inc
+
+    Description:    Bezoekers model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:          // TODO: Koppelzalen?
+
+    http://uwva.5iwork/Branch541/api2/reservablerooms.json?apikey=APIPFO&pretty=1&location=71&include=occupations&logging=0&freefrom=2014-05-06T11:00:00Z&freeto=2014-05-06T13:00:00Z
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<!-- #include file="../res/res.inc"-->
+<%
+model_reservablerooms =
+{
+    table: "res_ruimte",
+    primary: "res_ruimte_key",
+    records_name: "reservablerooms",
+    record_name: "reservableroom",
+    fields: [{ name: "id",           dbs: "res_ruimte_key",          typ: "key",     filter: "exact" },
+             { name: "name",         dbs: "res_ruimte_nr",           typ: "varchar"},
+             { name: "description",  dbs: "res_ruimte_omschrijving", typ: "varchar"},
+             // { name: "open",         dbs: "res_ruimte_begintijd",    typ: "time"}, is geen echte 'time'
+             { name: "location",     dbs: "alg_v_allonroerendgoed.alg_locatie_key",  typ: "key", foreign: "alg_locatie", filter: "exact"},
+             { name: "room",         dbs: "res_alg_ruimte.res_alg_ruimte_key",      typ: "key",     foreign: "alg_ruimte"},
+             { name: "image",        dbs: "res_ruimte_image",        typ: "varchar" }
+            ],
+    filter: { prefunc: function _prefilterfunc(params)
+                {
+                    //__DoLog("getQParamISODate: " + getQParamISODate("res_van"));
+                    var res_van = getQParamISODate("freefrom", null);
+                    var res_tot = getQParamISODate("freeto", null);
+                    if (res_van && res_tot)
+                    {
+                        var params = {res_van: res_van, // TODO: Welke dag?
+                                      res_tot: res_tot,
+                                      loc_key: 71, // alkw
+                                      //res_ruimte_key: 8065, // even hard
+                                      authparams : user.checkAutorisation("WEB_RESUSE", null, null, true),
+                                      forSelectRoom: true
+                                    }
+                        return res.plan_bezet_info(params); // wordt meegeven aan de volgende func
+                    }
+                    else
+                        return null;
+                },
+             func: function _filterfunc(oRs, params, prefuncdata)
+                {
+                    if (!prefuncdata)
+                        return true;
+                    var res_van = getQParamISODate("freefrom", null);
+                    var res_tot = getQParamISODate("freeto", null); // TODO: Voorkomen dat het een andere dag is
+                    var key = oRs("res_ruimte_key").Value;
+                    var occupations = prefuncdata[key]
+                    prev_end = res_van.setFloatHours(S("res_t1")); // TODO: per ruimte?
+                    for (var i in occupations)
+                    {
+                        var occu = occupations[i];
+                        if (res_van < occu.res_tot && res_tot > occu.res_van)
+                        {
+                            return false; // Overlap
+                        }
+                        prev_end = occu.res_tot;
+                    }
+                    return true;
+                }
+            },
+    includes: {"availability": { //xmodel: model_visitors,
+                                xjoinfield: "bez_afspraak_key"
+                              },
+               "occupations": { // prefunc om alles tegelijk op te halen
+                                prefunc: function _occupations(params)
+                                    {
+                                        var params = {res_van: new Date(), // TODO: Welke dag?
+                                                       res_tot: new Date(),
+                                                       loc_key: 71, // alkw
+                                                       //res_ruimte_key: 8065, // even hard
+                                                       authparams : user.checkAutorisation("WEB_RESUSE", null, null, true),
+                                                       forSelectRoom: true
+                                                     }
+                                        return res.plan_bezet_info(params); // wordt meegeven aan de volgende func
+                                    },
+                                func: function _occupations(key, params, prefuncdata)
+                                    {
+                                        var occupied = prefuncdata[key] ;
+                                        return occupied?occupied[0]:null;
+                                    },
+                                xjoinfield: "bez_afspraak_key"
+                              }
+              },
+
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_reservablerooms );
+
+            query.tables.push("res_alg_ruimte");
+
+            query.wheres.push("res_ruimte_verwijder IS NULL");
+            query.wheres.push("res_alg_ruimte_verwijder IS NULL");
+
+            //query.wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+            //                   + "     OR bez_afspraak_host_key = " + user_key + ")");
+            query.wheres.push("res_alg_ruimte.res_ruimte_key = res_ruimte.res_ruimte_key");
+            //query.wheres.push("bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez"));
+
+            query.tables.push("alg_v_allonroerendgoed");
+            query.wheres.push("alg_v_allonroerendgoed.alg_onroerendgoed_keys = res_alg_ruimte.alg_ruimte_key");
+            query.wheres.push("alg_v_allonroerendgoed.alg_type = 'R'");
+
+            var wheres = api2.sqlfilter(params, model_reservablerooms);
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY res_ruimte_nr";
+
+__DoLog(sql);
+
+            var json = api2.sql2json (params, sql, model_reservablerooms );
+
+            return json;
+        },
+    xxxREST_PUT: function (params, jsondata, the_key) /* update reservablerooms */
+        {
+            var fields = api2.update_fields(params, model_reservablerooms, jsondata); // Build updater
+
+            // bezUpd heeft na afloop eventueel oldjsvals
+            var bezUpd = buildTrackingUpdate("bez_bezoekers", " bez_bezoekers_key = " + the_key, fields, { noValidateToken: true });
+            __DoLog(bezUpd.sql);
+            Oracle.Execute(bezUpd.sql);
+
+            var beztrack = api2.process_includes(params, model_reservablerooms, the_key, jsondata);
+
+            //var result = saveBezoekers(afspr_key, -1, { urole: urole, loctimechanged: changed });
+            //if (result.beztrack && result.beztrack.length > 0)
+            //bezUpd.trackarray.push(result.beztrack.join("\n"));
+
+            return model_reservablerooms.REST_GET(params); // resulterende data weer terug
+        },
+    xxxREST_POST: function (params, jsondata, parent_key) /* new reservablerooms */
+        {
+            var fields = api2.update_fields(params, model_reservablerooms, jsondata); // Build updater
+            fields.push({ dbs: "bez_bezoekers_key",        typ: "key",     seq: "bez_s_bez_bezoekers_key" });
+            fields.push({ dbs: "bez_afspraak_key",         typ: "key",     val: parent_key });
+
+            var bezIns = buildInsert("bez_bezoekers", fields, { noValidateToken: true });
+            var bez_key = bezIns.sequences["bez_bezoekers_key"];
+            __DoLog(bezIns.sql);
+            Oracle.Execute(bezIns.sql);
+            //var bezUpd = {trackarray: [L("lcl_bez_is_bezadd") + ": " + beznaam + "/" + bed]};
+            // TODO: Wat teruggeven?
+        },
+    DELETE: function (params) /* delete reservablerooms */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_reservations.inc
+++ b/APPL/API2/model_reservations.inc
@@ -0,0 +1,92 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_reservations.inc
+
+    Description:    Reservering model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:          In het technisch datamodel heeft een reservering een koppeling naar een
+                    res_ruimte_opstel record (een geldige ruimte<->opstelling combinatie)
+                    In de API splitsen we dat in de meer natuurlijk aanvoelende res_ruimte_key
+                    en res_ruimte_opstel_key
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<!-- #include file="../res/res.inc"-->
+<%
+var sqlro = "SELECT rg.res_ruimte_nr || CASE WHEN res_ruimte_opstel_default = 1 THEN '' ELSE ' (' || ro.res_opstelling_omschrijving || ')' END CASE"
+            + "  FROM res_ruimte_opstelling rro"
+            + "     , res_opstelling ro"
+            + "     , res_v_alg_ruimte_gegevens rg"
+            + " WHERE rro.res_opstelling_key = ro.res_opstelling_key"
+            + "   AND rro.res_ruimte_key = rg.res_ruimte_key"
+            + "   AND rro.res_ruimte_opstel_key = res_rsv_ruimte.res_ruimte_opstel_key";
+
+model_reservations =
+{
+    module: "RES",
+    table: "res_rsv_ruimte",
+    primary: "res_rsv_ruimte_key",
+    records_name: "reservations",
+    record_name: "reservation",
+
+    fields: [{ name: "id",            dbs: "res_rsv_ruimte_key",         typ: "key",       filter: "exact" },
+             { name: "code",          dbs: "res_reservering_id",         sql: "res_reservering_key||'/'||res_rsv_ruimte_volgnr",        typ: "varchar"},
+             { name: "from",          dbs: "res_rsv_ruimte_van",         typ: "datetime"},
+             { name: "to",            dbs: "res_rsv_ruimte_tot",         typ: "datetime"},
+             { name: "description",   dbs: "res_rsv_ruimte_omschrijving", typ: "varchar"},
+             { name: "remark",        dbs: "res_rsv_ruimte_opmerking",   typ: "varchar"},
+             { name: "host",          dbs: "res_rsv_ruimte_host_key",    typ: "key",       foreign: "prs_perslid"},
+             { name: "contact",       dbs: "res_rsv_ruimte_contact_key", typ: "key",       foreign: "prs_perslid"},
+             { name: "visitorscount", dbs: "res_rsv_ruimte_bezoekers",   typ: "number" },
+             { name: "status",        dbs: "res_status_fo_key",          typ: "key",       foreign: res.getfostatustext },
+             { name: "room",          dbs: "res_ruimte_opstelling.res_ruimte_key", typ: "key",      foreign: "res_ruimte" },
+             { name: "configuration", dbs: "res_ruimte_opstelling.res_opstelling_key",  typ: "key", foreign: "res_opstelling" },
+            ],
+
+    impersonate_auth: "WEB_RESFOF",
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_reservations );
+
+            query.wheres.push(user_key + " IN (res_rsv_ruimte_host_key, res_rsv_ruimte_contact_key)"); // Altijd fe vooralnog
+            query.wheres.push("res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res"));
+
+            query.tables.push("res_ruimte_opstelling");
+            query.wheres.push("res_rsv_ruimte.res_ruimte_opstel_key = res_ruimte_opstelling.res_ruimte_opstel_key");
+
+            var wheres = api2.sqlfilter(params, model_reservations);
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY res_rsv_ruimte_van, res_rsv_ruimte.res_rsv_ruimte_key";
+
+__DoLog(sql);
+
+            var json = api2.sql2json (params, sql, model_reservations );
+
+            return json;
+        },
+    PUT: function (params) /* update reservation */
+    {
+    },
+    POST: function (params) /* new reservation */
+    {
+    },
+    DELETE: function (params) /* delete reservation */
+    {
+    }
+}
+%>
--- a/APPL/API2/model_visitors.inc
+++ b/APPL/API2/model_visitors.inc
@@ -0,0 +1,105 @@
+<% /*
+    $Revision$
+    $Id$
+
+    File:           model_visitors.inc
+
+    Description:    Bezoekers model. Dit bestand heeft niets met interfacing te maken
+                    maar werkt uitsluitend op JSON-data
+    Parameters:
+    Context:
+
+    Notes:
+*/
+
+%>
+<!-- #include file="../Shared/discxalg3d.inc"-->
+<%
+model_visitors =
+{
+    table: "bez_bezoekers",
+    primary: "bez_bezoekers_key",
+    records_name: "visitors",
+    record_name: "visitor",
+    fields: [{ name: "id",          dbs: "bez_bezoekers_key",    typ: "key",     filter: "exact" },
+             { name: "name",        dbs: "bez_afspraak_naam",    typ: "varchar"},
+             { name: "company",     dbs: "bez_afspraak_bedrijf", typ: "varchar"},
+             { name: "badge",       dbs: "bez_bezoekers_pasnr",  typ: "varchar"},
+             { name: "in",          dbs: "bez_bezoekers_done",   typ: "datetime"},
+             { name: "out",         dbs: "bez_bezoekers_out",    typ: "datetime"}
+             // niet teruglinken, { name: "appointment", dbs: "bez_afspraak_key",     typ: "key",     foreign: "bez_afspraak"}
+            ],
+
+    REST_GET: function _GET(params)
+        {
+            var urole = "fe"; // TODO: Moet echt niet ter zake doen
+            var autfunction = urole == "fe"? "WEB_ALGUSE" : "WEB_ALGMAN";
+            params.authparams = user.checkAutorisation(autfunction, null, null, true); // pessimistisch
+
+            // TODO: Add authorization
+            var query = api2.sqlfields(params, model_visitors );
+
+            query.tables.push("bez_afspraak");
+            query.wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+                               + "     OR bez_afspraak_host_key = " + user_key + ")");
+            query.wheres.push("bez_afspraak.bez_afspraak_key = bez_bezoekers.bez_afspraak_key");
+            query.wheres.push("bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez"));
+
+            var wheres = api2.sqlfilter(params, model_visitors);
+            query.wheres = query.wheres.concat(wheres);
+
+            var sql = "SELECT " + query.selects.join(", ")
+                    + "  FROM " + query.tables.join(", ")
+                    + " WHERE " + query.wheres.join(" AND " )
+                    + " ORDER BY bez_afspraak_datum, bez_afspraak.bez_afspraak_key";
+
+__DoLog(sql);
+
+            var json = api2.sql2json (params, sql, model_visitors );
+
+            return json;
+        },
+    REST_PUT: function (params, jsondata, the_key) /* update visitors */
+        {
+            var fields = api2.update_fields(params, model_visitors, jsondata); // Build updater
+
+            // bezUpd heeft na afloop eventueel oldjsvals
+            var bezUpd = buildTrackingUpdate("bez_bezoekers", " bez_bezoekers_key = " + the_key, fields, { noValidateToken: true });
+            __DoLog(bezUpd.sql);
+            Oracle.Execute(bezUpd.sql);
+
+            var beztrack = api2.process_includes(params, model_visitors, the_key, jsondata);
+
+            //var result = saveBezoekers(afspr_key, -1, { urole: urole, loctimechanged: changed });
+            //if (result.beztrack && result.beztrack.length > 0)
+            //bezUpd.trackarray.push(result.beztrack.join("\n"));
+
+            return model_visitors.REST_GET(params); // resulterende data weer terug
+        },
+    REST_POST: function (params, jsondata, parent_key) /* new visitors */
+        {
+            var fields = api2.update_fields(params, model_visitors, jsondata); // Build updater
+            fields.push({ dbs: "bez_bezoekers_key",        typ: "key",     seq: "bez_s_bez_bezoekers_key" });
+            fields.push({ dbs: "bez_afspraak_key",         typ: "key",     val: parent_key });
+
+            var bezIns = buildInsert("bez_bezoekers", fields, { noValidateToken: true });
+            var bez_key = bezIns.sequences["bez_bezoekers_key"];
+            __DoLog(bezIns.sql);
+            Oracle.Execute(bezIns.sql);
+            //var bezUpd = {trackarray: [L("lcl_bez_is_bezadd") + ": " + beznaam + "/" + bed]};
+            // TODO: Wat teruggeven?
+        },
+    REST_DELETE: function (params, jsondata, the_key) /* delete visitors */
+    {
+        var wheres = [" bez_bezoekers_key = " + the_key];
+        // TODO: Autorisatie
+        //wheres.push("(bez_afspraak_contact_key = " + user_key // Altijd fe vooralnog
+        //                   + "     OR bez_afspraak_host_key = " + user_key + ")");
+        var sql = "DELETE FROM bez_bezoekers"
+                + " WHERE " + wheres.join(" AND " );
+
+        __DoLog(sql);
+        Oracle.Execute(sql);
+    }
+}
+%>
--- a/APPL/BES/ModalForm.asp
+++ b/APPL/BES/ModalForm.asp
@@ -8,7 +8,7 @@

 <html>
  <head>
-    <title><%=titleString%></title>
+    <title><%=safe.html(titleString)%></title>
    <script>
        function closeModal(retval)
        {
--- a/APPL/BES/addFavourites.asp
+++ b/APPL/BES/addFavourites.asp
@@ -102,7 +102,7 @@ function doSubmit()
        <td class='label'><label for="fav"><%=L("lcl_bes_favour_list")%>:</label></td>
        <td><select name="fav" id="fav"><%
          // eigen favorieten lijsten van een bepaalde categorie
-          sql = " SELECT '" + L("lcl_bes_select_fav_list") + "', 'A' FROM DUAL"
+          sql = " SELECT " + safe.quoted_sql(L("lcl_bes_select_fav_list")) + ", 'A' FROM DUAL"
              + " UNION"
              + " SELECT bf.bes_favoriet_naam"
              + ", 'B'"
--- a/APPL/BES/bes.inc
+++ b/APPL/BES/bes.inc
@@ -74,6 +74,15 @@
              return statustekst;
           },

+        trackbestellingaccepteren:
+           function (opdr_key, ptxt)
+           { // noot: shared.trackaction (fac.trackaction) genereert ook eventuele notificaties.
+             if (ptxt)
+               shared.trackaction('BESACP', opdr_key, ptxt);
+             else
+               shared.trackaction('BESACP', opdr_key);
+           },
+
        // Alle (BES) informatie van een disciplnie
        disc_info: function _disc_info(disc_key, autfunction)
        {
@@ -89,6 +98,10 @@
                    + "     , bes_disc_params_auto_order"
                    + "     , bes_disc_params_min_bedrag"
                    + "     , bes_disc_params_bestellimiet"
+                    + "     , bes_disc_params_bestellimiet2"
+                    + "     , bes_disc_params_bestellimiet3"
+                    + "     , bes_disc_params_bestellimiet4"
+                    + "     , bes_disc_params_bestellimiet5"
                    + "     , ins_discipline_kpnverplicht"
                    + "     , bes_disc_params_pgb"
                    + "     , bes_disc_params_herfiat"
@@ -109,28 +122,32 @@

            var oRs = Oracle.Execute(sql);
            var result = { disc_key                       : disc_key,
-                           discipline_omschrijving        : oRs("ins_discipline_omschrijving").value,
-                           discipline_kpnverplicht        : oRs("ins_discipline_kpnverplicht").value == '1',
-                           disc_params_retour             : oRs("bes_disc_params_retour").value == '1',
-                           disc_params_retour_url         : oRs("bes_disc_params_retour_url").value,
-                           disc_params_levopm_url         : oRs("bes_disc_params_levopm_url").value,
-                           disc_params_leverdagen         : oRs("bes_disc_params_leverdagen").value || 0,
-                           disc_params_punchouturl        : oRs("bes_disc_params_punchouturl").value,
-                           disc_params_punch_bedr_key     : oRs("bes_disc_params_punch_bedr_key").value,
-                           disc_params_logo_url           : oRs("bes_disc_params_logo_url").value,
-                           disc_params_autoacceptrfo      : oRs("bes_disc_params_autoacceptrfo").value,
-                           disc_params_auto_order         : oRs("bes_disc_params_auto_order").value,
-                           disc_params_min_bedrag         : oRs("bes_disc_params_min_bedrag").value,
-                           disc_params_bestellimiet       : oRs("bes_disc_params_bestellimiet").value,
-                           disc_params_pgb                : oRs("bes_disc_params_pgb").value,
-                           disc_params_herfiat            : oRs("bes_disc_params_herfiat").value || 0,
-                           disc_params_herfiatpct         : oRs("bes_disc_params_herfiatpct").value,
-                           disc_params_herfiatmarge       : oRs("bes_disc_params_herfiatmarge").value,
-                           staffelgroepitems              : oRs("staffelgroepitems").value,
-                           maxartikel                     : oRs("bes_disc_params_maxartikel").value? oRs("bes_disc_params_maxartikel").value : -1,
-                           kpautorisatie                  : oRs("bes_disc_params_kpautorisatie").value == 1,
-                           disc_params_for_others         : oRs("bes_disc_params_for_others").value == 1,
-                           can_concept                    : oRs("bes_disc_params_herfiat").value > 0 // 5.1.2 functionaliteit
+                           discipline_omschrijving        : oRs("ins_discipline_omschrijving").Value,
+                           discipline_kpnverplicht        : oRs("ins_discipline_kpnverplicht").Value == '1',
+                           disc_params_retour             : oRs("bes_disc_params_retour").Value == '1',
+                           disc_params_retour_url         : oRs("bes_disc_params_retour_url").Value,
+                           disc_params_levopm_url         : oRs("bes_disc_params_levopm_url").Value,
+                           disc_params_leverdagen         : oRs("bes_disc_params_leverdagen").Value || 0,
+                           disc_params_punchouturl        : oRs("bes_disc_params_punchouturl").Value,
+                           disc_params_punch_bedr_key     : oRs("bes_disc_params_punch_bedr_key").Value,
+                           disc_params_logo_url           : oRs("bes_disc_params_logo_url").Value,
+                           disc_params_autoacceptrfo      : oRs("bes_disc_params_autoacceptrfo").Value,
+                           disc_params_auto_order         : oRs("bes_disc_params_auto_order").Value,
+                           disc_params_min_bedrag         : oRs("bes_disc_params_min_bedrag").Value,
+                           disc_params_bestellimiet       : oRs("bes_disc_params_bestellimiet").Value,
+                           disc_params_bestellimiet2      : oRs("bes_disc_params_bestellimiet2").Value,
+                           disc_params_bestellimiet3      : oRs("bes_disc_params_bestellimiet3").Value,
+                           disc_params_bestellimiet4      : oRs("bes_disc_params_bestellimiet4").Value,
+                           disc_params_bestellimiet5      : oRs("bes_disc_params_bestellimiet5").Value,
+                           disc_params_pgb                : oRs("bes_disc_params_pgb").Value,
+                           disc_params_herfiat            : oRs("bes_disc_params_herfiat").Value || 0,
+                           disc_params_herfiatpct         : oRs("bes_disc_params_herfiatpct").Value,
+                           disc_params_herfiatmarge       : oRs("bes_disc_params_herfiatmarge").Value,
+                           staffelgroepitems              : oRs("staffelgroepitems").Value,
+                           maxartikel                     : oRs("bes_disc_params_maxartikel").Value? oRs("bes_disc_params_maxartikel").Value : -1,
+                           kpautorisatie                  : oRs("bes_disc_params_kpautorisatie").Value == 1,
+                           disc_params_for_others         : oRs("bes_disc_params_for_others").Value == 1,
+                           can_concept                    : oRs("bes_disc_params_herfiat").Value > 0 // 5.1.2 functionaliteit
                         }
            oRs.Close();
            if (autfunction)
@@ -143,7 +160,7 @@
            BLOCK_START("besInfo" , L("lcl_bes_key") + "&nbsp;" + S("bes_bestelling_prefix") + bes_bestelling.bes_key + (bes_bestelling.parent_key? "*" : ""));
              if (bes_bestelling.satisfaction && shared.satisfactionsymbol(bes_bestelling.satisfaction))
              {
-                %><img id="satisfaction" src="<%=shared.satisfactionsymbol(bes_bestelling.satisfaction)%>"><%
+                %><img id="satisfaction" src="<%=shared.satisfactionsymbol(bes_bestelling.satisfaction)%>" title="<%=safe.htmlattr(bes_bestelling.satisfaction_op)%>"><%
              }

              ROFIELDTR("fld", L("lcl_bes_discipline"), bes_disc_info.discipline_omschrijving);
@@ -208,13 +225,13 @@
                  oRs = Oracle.Execute(sql);
              while(!oRs.eof)
              {
-                var txt = S("bes_bestelopdr_prefix") + oRs("bes_bestelopdr_id").value;
-                if (oRs("bes_bestelopdr_status").value == 1) // afgewezen
-                    txt += " (" + bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").value) + ")";
+                var txt = S("bes_bestelopdr_prefix") + oRs("bes_bestelopdr_id").Value;
+                if (oRs("bes_bestelopdr_status").Value == 1) // afgewezen
+                    txt += " (" + bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").Value) + ")";
                if (bes_bestelling.parent_key)
                    txt += "*"; // wij zijn een change dus de opdracht ook
                l_orders.push(txt);
-                l_orders_key.push(oRs("bes_bestelopdr_key").value);
+                l_orders_key.push(oRs("bes_bestelopdr_key").Value);
                oRs.MoveNext();
              }
              oRs.Close();
@@ -266,8 +283,8 @@
                  + " ORDER BY bes_bestelling_key";
              oRs = Oracle.Execute(sql);
              while(!oRs.eof) {
-                l_retours.push(S("bes_bestelling_prefix") + oRs("bes_bestelling_key").value);
-                l_retourk.push(oRs("bes_bestelling_key").value);
+                l_retours.push(S("bes_bestelling_prefix") + oRs("bes_bestelling_key").Value);
+                l_retourk.push(oRs("bes_bestelling_key").Value);
                oRs.MoveNext();
              }
              oRs.Close();
@@ -302,7 +319,7 @@
                  oRs = Oracle.Execute(sql);
                  if (!oRs.eof)
                  {
-                    var params = { infoPointer: { Url: "appl/cnt/cnt_contract.asp?urole=" + urole + "&cnt_key=" + oRs("cnt_contract_key").value,
+                    var params = { infoPointer: { Url: "appl/cnt/cnt_contract.asp?urole=" + urole + "&cnt_key=" + oRs("cnt_contract_key").Value,
                                   Title: L("lcl_contract") + " " + S("bes_bestelling_prefix") + bes_bestelling.bes_key,
                                   suppressEmpty: true }}
                    ROFIELDTR ("fld", L("lcl_contract"), S("bes_bestelling_prefix") + bes_bestelling.bes_key,  params);
@@ -326,8 +343,8 @@

            while(!oRs.eof)
            {
-              srtdeel_arr.push(oRs("bes_srtdeel_key").value);
-              amount_arr.push(oRs("bes_bestelling_item_aantal").value);
+              srtdeel_arr.push(oRs("bes_srtdeel_key").Value);
+              amount_arr.push(oRs("bes_bestelling_item_aantal").Value);
              oRs.MoveNext();
            }
            oRs.Close();
@@ -342,39 +359,41 @@

            // Get info of existing BES_BESTELLING
            var sql = "SELECT b.bes_bestelling_status"
-                  + ",        b.bes_bestelling_datum"
-                  + ",        b.prs_perslid_key"
-                  + ",        b.prs_perslid_key_voor"
-                  + ",        p.prs_afdeling_key"
-                  + ",        b.prs_kostenplaats_key"
-                  + ",        (SELECT " + S("prs_kpn_string")
-                  + "            FROM prs_kostenplaats k"
-                  + "           WHERE k.prs_kostenplaats_key = b.prs_kostenplaats_key) prs_kostenplaats_omschr"
-                  + ",        b.bes_bestelling_plaats"
-                  + ",       b.bes_bestelling_status"
-                  + ",       b.bes_bestelling_ordernr"
-                  + ",       m.mld_adres_naam"
-                  + ",       m.mld_adres_key"
-                  + ",       b.bes_bestelling_leverdatum"
-                  + ",       b.bes_bestelling_retourvan_key"
-                  + ",       prs.getkpverantwoordelijke (b.prs_kostenplaats_key, " + S("prs_approvemethod") + ", " + exclude_fiatter + ") fiatteur_key"
-                  + ",       b.bes_bestelling_fiat_user"
-                  + ",       b.bes_bestelling_korting"
-                  + ",       b.bes_bestelling_levkosten"
-                  + ",       b.mld_melding_key"
-                  + ",       bes_bestelling_opmerking"
-                  + ",       b.fac_activiteit_key"
-                  + ",       b.bes_bestelling_parentkey"
-                  + ",       b.bes_bestelling_satisfaction"
-                  + ",       (SELECT b1.bes_bestelling_key"
-                  + "           FROM bes_bestelling b1"
-                  + "          WHERE b1.bes_bestelling_parentkey = b.bes_bestelling_key) change_key"
-                  + "   FROM bes_bestelling b"
-                  + ",       prs_perslid p"
-                  + ",       mld_adres m"
-                  + "  WHERE b.bes_bestelling_key = " + bes_key
-                  + "    AND p.prs_perslid_key = b.prs_perslid_key"
-                  + "    AND m.mld_adres_key(+) = b.mld_adres_key_lev";
+                    + "     , b.bes_bestelling_datum"
+                    + "     , b.prs_perslid_key"
+                    + "     , b.prs_perslid_key_voor"
+                    + "     , p.prs_afdeling_key"
+                    + "     , b.prs_kostenplaats_key"
+                    + "     , (SELECT " + S("prs_kpn_string")
+                    + "          FROM prs_kostenplaats k"
+                    + "         WHERE k.prs_kostenplaats_key = b.prs_kostenplaats_key) prs_kostenplaats_omschr"
+                    + "     , b.bes_bestelling_plaats"
+                    + "     , b.bes_bestelling_status"
+                    + "     , b.bes_bestelling_ordernr"
+                    + "     , m.mld_adres_naam"
+                    + "     , m.mld_adres_key"
+                    + "     , b.bes_bestelling_leverdatum"
+                    + "     , b.bes_bestelling_retourvan_key"
+                    + "     , prs.getkpverantwoordelijke (b.prs_kostenplaats_key, " + S("prs_approvemethod") + ", " + exclude_fiatter + ") fiatteur_key"
+                    + "     , b.bes_bestelling_fiat_user"
+                    + "     , b.bes_bestelling_korting"
+                    + "     , b.bes_bestelling_levkosten"
+                    + "     , b.mld_melding_key"
+                    + "     , bes_bestelling_opmerking"
+                    + "     , b.fac_activiteit_key"
+                    + "     , b.bes_bestelling_parentkey"
+                    + "     , b.bes_bestelling_satisfaction"
+                    + "     , b.bes_bestelling_satisfaction_op"
+                    + "     , (SELECT b1.bes_bestelling_key"
+                    + "          FROM bes_bestelling b1"
+                    + "         WHERE b1.bes_bestelling_parentkey = b.bes_bestelling_key) change_key"
+                    + "     , b.bes_bestelling_approved"
+                    + "  FROM bes_bestelling b"
+                    + "     , prs_perslid p"
+                    + "     , mld_adres m"
+                    + " WHERE b.bes_bestelling_key = " + bes_key
+                    + "   AND p.prs_perslid_key = b.prs_perslid_key"
+                    + "   AND m.mld_adres_key(+) = b.mld_adres_key_lev";

            var oRs = Oracle.Execute(sql);
            if (oRs.Eof)
@@ -383,33 +402,35 @@
            var bes_bestelling =
            {
                bes_key             : bes_key,
-                //rfoStatusText       : oRs("status").value,
-                rfoStatusText       : ((oRs("bes_bestelling_status").value == 6 && (oRs("bes_bestelling_retourvan_key").value && oRs("bes_bestelling_retourvan_key").value > 0))
+                //rfoStatusText       : oRs("status").Value,
+                rfoStatusText       : ((oRs("bes_bestelling_status").Value == 6 && (oRs("bes_bestelling_retourvan_key").Value && oRs("bes_bestelling_retourvan_key").Value > 0))
                                      ? L("lcl_bes_collected")
-                                      : bes.getbesbestellingstatustext(oRs("bes_bestelling_status").value)),
-                rfoDate             : new Date(oRs("bes_bestelling_datum").value),
-                kostenplaats_key    : oRs("prs_kostenplaats_key").value||-1,
-                kostenplaats_omschr : oRs("prs_kostenplaats_omschr").value||"",
-                perslid_key         : oRs("prs_perslid_key").value, // Persoon die de bestelling aanmaakt
-                afdeling_key        : oRs("prs_afdeling_key").value, // Afdeling van de persoon die de bestelling aanmaakt
-                perslid_key_voor    : oRs("prs_perslid_key_voor").value, // Aanvrager/invoerder/contactpersoon
-                rfoStatus           : oRs("bes_bestelling_status").value,
-                orderNr             : oRs("bes_bestelling_ordernr").value,
-                afleverruimte       : oRs("bes_bestelling_plaats").value,
-                rfoDeliverydate     : new Date(oRs("bes_bestelling_leverdatum").value),
-                rfoRetourVan        : oRs("bes_bestelling_retourvan_key").value,
-                fiatteur_key        : oRs("fiatteur_key").value, // degene die het moet doen
-                bes_bestelling_fiat_user : oRs("bes_bestelling_fiat_user").value, // degene die al geweest is
-                rfoBesKosten        : oRs("bes_bestelling_korting").value,
-                rfoLevKosten        : oRs("bes_bestelling_levkosten").value,
-                rfoOpmerking        : oRs("bes_bestelling_opmerking").value,
-                mld_adres_naam      : oRs("mld_adres_naam").value,
-                mld_adres_key       : oRs("mld_adres_key").value,
-                fac_activiteit_key  : oRs("fac_activiteit_key").value? oRs("fac_activiteit_key").value : -1,
-                mld_key             : oRs("mld_melding_key").value,
-                parent_key          : oRs("bes_bestelling_parentkey").value,
-                satisfaction        : oRs("bes_bestelling_satisfaction").value,
-                change_key          : oRs("change_key").value
+                                      : bes.getbesbestellingstatustext(oRs("bes_bestelling_status").Value)),
+                rfoDate             : new Date(oRs("bes_bestelling_datum").Value),
+                kostenplaats_key    : oRs("prs_kostenplaats_key").Value||-1,
+                kostenplaats_omschr : oRs("prs_kostenplaats_omschr").Value||"",
+                perslid_key         : oRs("prs_perslid_key").Value, // Persoon die de bestelling aanmaakt
+                afdeling_key        : oRs("prs_afdeling_key").Value, // Afdeling van de persoon die de bestelling aanmaakt
+                perslid_key_voor    : oRs("prs_perslid_key_voor").Value, // Aanvrager/invoerder/contactpersoon
+                rfoStatus           : oRs("bes_bestelling_status").Value,
+                orderNr             : oRs("bes_bestelling_ordernr").Value,
+                afleverruimte       : oRs("bes_bestelling_plaats").Value,
+                rfoDeliverydate     : new Date(oRs("bes_bestelling_leverdatum").Value),
+                rfoRetourVan        : oRs("bes_bestelling_retourvan_key").Value,
+                fiatteur_key        : oRs("fiatteur_key").Value, // degene die het moet doen
+                bes_bestelling_fiat_user : oRs("bes_bestelling_fiat_user").Value, // degene die al geweest is
+                rfoBesKosten        : oRs("bes_bestelling_korting").Value,
+                rfoLevKosten        : oRs("bes_bestelling_levkosten").Value,
+                rfoOpmerking        : oRs("bes_bestelling_opmerking").Value,
+                mld_adres_naam      : oRs("mld_adres_naam").Value,
+                mld_adres_key       : oRs("mld_adres_key").Value,
+                fac_activiteit_key  : oRs("fac_activiteit_key").Value? oRs("fac_activiteit_key").Value : -1,
+                mld_key             : oRs("mld_melding_key").Value,
+                parent_key          : oRs("bes_bestelling_parentkey").Value,
+                satisfaction        : oRs("bes_bestelling_satisfaction").Value,
+                satisfaction_op     : oRs("bes_bestelling_satisfaction_op").Value,
+                change_key          : oRs("change_key").Value,
+                approved            : oRs("bes_bestelling_approved").Value? oRs("bes_bestelling_approved").Value : -1
            }
            oRs.close();

@@ -439,28 +460,28 @@
                    + "   AND bes_bestelling_key = " + bes_bestelling.bes_key;
            oRs = Oracle.Execute(sql);

-            if (oRs("ins_discipline_key").value == null)
+            if (oRs("ins_discipline_key").Value == null)
                shared.internal_error("BES: no item lines.");

-            bes_bestelling.dis_key      = oRs("ins_discipline_key").value,
-            bes_bestelling.srtgroep     = oRs("bes_srtgroep_key").value,
-            bes_bestelling.singlegroep  = oRs("singlegroep").value == 1,
-            bes_bestelling.inclBTW      = oRs("inclBTW").value || 0,
-            bes_bestelling.totaal       = oRs("totaal").value || 0;
-            bes_bestelling.aantalontv   = oRs("aantalontv").value || 0;
-            bes_bestelling.isAbonnement = oRs("bes_disc_params_contract").value == 1; // Bij abonnement bestellingen mag er maar 1 bestelregel zijn en is er dus 1 srtgroep.
+            bes_bestelling.dis_key      = oRs("ins_discipline_key").Value,
+            bes_bestelling.srtgroep     = oRs("bes_srtgroep_key").Value,
+            bes_bestelling.singlegroep  = oRs("singlegroep").Value == 1,
+            bes_bestelling.inclBTW      = oRs("inclBTW").Value || 0,
+            bes_bestelling.totaal       = oRs("totaal").Value || 0;
+            bes_bestelling.aantalontv   = oRs("aantalontv").Value || 0;
+            bes_bestelling.isAbonnement = oRs("bes_disc_params_contract").Value == 1; // Bij abonnement bestellingen mag er maar 1 bestelregel zijn en is er dus 1 srtgroep.
            // Let op: Als bes_srtdeel_wijzigdagen niet gezet dan wordt bes_bestelling.wijzig_tot
            // ook niet gezet en hebben we oude <5.1.1 gedrag (meestal niet te wijzigen)
-            if (oRs("bes_srtdeel_wijzigdagen").value != 9999)
+            if (oRs("bes_srtdeel_wijzigdagen").Value != 9999)
            {
                bes_bestelling.wijzig_tot = new Date(bes_bestelling.rfoDeliverydate);
-                bes_bestelling.wijzig_tot.setDate(bes_bestelling.wijzig_tot.getDate() - oRs("bes_srtdeel_wijzigdagen").value);
+                bes_bestelling.wijzig_tot.setDate(bes_bestelling.wijzig_tot.getDate() - oRs("bes_srtdeel_wijzigdagen").Value);
                __Log("Wijzigen tot " + bes_bestelling.wijzig_tot);
            }
-            if (oRs("bes_srtdeel_annuleerdagen").value != 9999)
+            if (oRs("bes_srtdeel_annuleerdagen").Value != 9999)
            {
                bes_bestelling.annuleer_tot = new Date(bes_bestelling.rfoDeliverydate);
-                bes_bestelling.annuleer_tot.setDate(bes_bestelling.annuleer_tot.getDate() - oRs("bes_srtdeel_annuleerdagen").value);
+                bes_bestelling.annuleer_tot.setDate(bes_bestelling.annuleer_tot.getDate() - oRs("bes_srtdeel_annuleerdagen").Value);
                __Log("Annuleren tot " + bes_bestelling.annuleer_tot);
            }
            oRs.close();
@@ -475,8 +496,8 @@
                    + "       AND boi.bes_bestelopdr_item_key = bi.bes_bestelopdr_item_key"
                    + "       AND bi.bes_bestelling_key = " + bes_bestelling.bes_key;
            oRs = Oracle.Execute(sql);
-            bes_bestelling.rfoBestelOpdrStatus = oRs("bes_bestelopdr_status").value||0,
-            bes_bestelling.isordered = oRs("isordered").value||0,
+            bes_bestelling.rfoBestelOpdrStatus = oRs("bes_bestelopdr_status").Value||0,
+            bes_bestelling.isordered = oRs("isordered").Value||0,
            oRs.close();

            if (bes_bestelling.mld_key)
@@ -491,7 +512,7 @@
                    + "   AND sm.mld_stdmelding_key = m.mld_stdmelding_key"
                    + "   AND m.mld_melding_key = " + bes_bestelling.mld_key;
                  oRs = Oracle.Execute(sql);
-                  bes_bestelling.mld_prefix = oRs("mld_prefix").value||"";
+                  bes_bestelling.mld_prefix = oRs("mld_prefix").Value||"";
                  oRs.close()
            }

@@ -510,7 +531,7 @@
          oRs = Oracle.Execute(sql);
          while (!oRs.eof)
          {
-            bes_key_str.push(oRs("bes_bestelling_key").value);
+            bes_key_str.push(oRs("bes_bestelling_key").Value);
            oRs.MoveNext();
          }
          oRs.Close();
@@ -576,37 +597,37 @@
            opdr_key              : opdr_key,
            bestelopdr_id         : oRs("bes_bestelopdr_id").Value,
            bes_key_str           : bes_key_str,
-            prs_bedrijf_naam      : oRs("prs_bedrijf_naam").value,
-            mld_adres_key_lev     : oRs("mld_adres_key_lev").value,
-            mld_adres_key_fac     : oRs("mld_adres_key_fac").value,
-            opmerking             : oRs("bes_bestelopdr_opmerking").value,
-            delivery_opmerk       : oRs("bes_bestelopdr_delivery_opmerk").value,
-            inclBTW               : oRs("prs_kostensoort_btw").value,
-            status                : oRs("bes_bestelopdr_status").value,
-            statustxt             : bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").value),
-            prs_perslid_naam      : oRs("naam").value, // Aangemaakt door
-            perslid_key           : oRs("prs_perslid_key").value,
-            dis_key               : oRs("ins_discipline_key").value,
-            korting               : parseFloat((oRs("bes_bestelopdr_korting").value? oRs("bes_bestelopdr_korting").value : 0).toFixed(2)),
-            levkosten             : parseFloat((oRs("bes_bestelopdr_levkosten").value? oRs("bes_bestelopdr_levkosten").value : 0).toFixed(2))
+            prs_bedrijf_naam      : oRs("prs_bedrijf_naam").Value,
+            mld_adres_key_lev     : oRs("mld_adres_key_lev").Value,
+            mld_adres_key_fac     : oRs("mld_adres_key_fac").Value,
+            opmerking             : oRs("bes_bestelopdr_opmerking").Value,
+            delivery_opmerk       : oRs("bes_bestelopdr_delivery_opmerk").Value,
+            inclBTW               : oRs("prs_kostensoort_btw").Value,
+            status                : oRs("bes_bestelopdr_status").Value,
+            statustxt             : bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").Value),
+            prs_perslid_naam      : oRs("naam").Value, // Aangemaakt door
+            perslid_key           : oRs("prs_perslid_key").Value,
+            dis_key               : oRs("ins_discipline_key").Value,
+            korting               : parseFloat((oRs("bes_bestelopdr_korting").Value? oRs("bes_bestelopdr_korting").Value : 0).toFixed(2)),
+            levkosten             : parseFloat((oRs("bes_bestelopdr_levkosten").Value? oRs("bes_bestelopdr_levkosten").Value : 0).toFixed(2))
          }
-          if(oRs("bes_bestelopdr_status").value == 6 && oRs("bes_bestelling_retourvan_key").Value > 0)
+          if(oRs("bes_bestelopdr_status").Value == 6 && oRs("bes_bestelling_retourvan_key").Value > 0)
              bes_bestelopdr.statustxt = L("lcl_bes_collected");

          var totaal = 0;
          bes_bestelopdr.artikel_arr = new Array();
          while (!oRs.eof)
          { // Nu de artikelregels
-            var catalogus_omschr = oRs("ins_discipline_omschrijving").value;
-            var omschr = oRs("bes_srtdeel_omschrijving").value
-                       + " (" + S("currency_pref") + safe.curr(oRs("item_prijs").value)
-                       + S("currency_suff") + "/" + (oRs("bes_srtdeel_eenheid").value || "") + ")"
-            var aantal = oRs("bes_bestelopdr_item_aantal").value;
-            var aantalontv = oRs("bes_bestelopdr_item_aantalontv").value || 0;
-            var prijs = parseFloat((oRs("prijs").value? oRs("prijs").value : 0).toFixed(2));
-            var item_key = oRs("bes_bestelopdr_item_key").value;
-            var item_prijs = parseFloat((oRs("item_prijs").value? oRs("item_prijs").value : 0).toFixed(2));
-            var artikelnr = oRs("bes_srtdeel_nr").value;
+            var catalogus_omschr = oRs("ins_discipline_omschrijving").Value;
+            var omschr = oRs("bes_srtdeel_omschrijving").Value
+                       + " (" + S("currency_pref") + safe.curr(oRs("item_prijs").Value)
+                       + S("currency_suff") + "/" + (oRs("bes_srtdeel_eenheid").Value || "") + ")"
+            var aantal = oRs("bes_bestelopdr_item_aantal").Value;
+            var aantalontv = oRs("bes_bestelopdr_item_aantalontv").Value || 0;
+            var prijs = parseFloat((oRs("prijs").Value? oRs("prijs").Value : 0).toFixed(2));
+            var item_key = oRs("bes_bestelopdr_item_key").Value;
+            var item_prijs = parseFloat((oRs("item_prijs").Value? oRs("item_prijs").Value : 0).toFixed(2));
+            var artikelnr = oRs("bes_srtdeel_nr").Value;
            bes_bestelopdr.artikel_arr.push({ catalogus_omschr: catalogus_omschr,
                                              omschr:           omschr,
                                              aantal:           aantal,
@@ -626,17 +647,21 @@
        },

        func_enabled_bestelling: // Wat mag ik zoal op deze specifieke bestelling?
-            function _func_enabled_bestelling(bes_bestelling) // bes_bestelling is een bestelling_info hash
+            function _func_enabled_bestelling(bes_bestelling, params) // bes_bestelling is een bestelling_info hash
            {
+              params = params || {};
              var isVerantwoordelijke = (bes_bestelling.fiatteur_key == user_key || user.isCollega(bes_bestelling.fiatteur_key));
              isVerantwoordelijke |= (bes_bestelling.bes_bestelling_fiat_user == user_key || user.isCollega(bes_bestelling.bes_bestelling_fiat_user));

-              var bresult = user.func_enabled("BES",
-                                              bes_bestelling.dis_key,
-                                              null,
-                                              bes_bestelling.perslid_key,
-                                              false, // pessimist
-                                              isVerantwoordelijke); // isVerantwoordelijke dan optional
+              var bresult = user.func_enabled2("BES",
+                                               { ins_discipline_key: bes_bestelling.dis_key,
+                                                 alg_key: null,
+                                                 prs_key: bes_bestelling.perslid_key,
+                                                 checkOptimistic: false, // pessimist
+                                                 isOptional: isVerantwoordelijke,  // isVerantwoordelijke dan optional
+                                                 knownread: params.knownread
+                                               }
+                                              );
              bresult.isVerantwoordelijke = isVerantwoordelijke;

              bresult.canReadAny = bresult.canRead("WEB_BESBOF") ||
@@ -701,65 +726,91 @@
                switch (bes_bestelling.rfoStatus) // (*aanvraag* status)
                {
                    case 1: // Afgewezen/verworpen. Je kunt hem effectie wijzigen en weer opnieuw aanbieden
-                            bresult.canDelete     =    bresult.canWrite("WEB_BESFOF")
-                                                    || bresult.canWrite("WEB_BESBOF");
+                            bresult.canDelete     = bresult.canWrite("WEB_BESFOF") ||
+                                                    bresult.canWrite("WEB_BESBOF");
                            bresult.canMainChange = eigenBestelling || bresult.canWrite("WEB_BESFOF") || bresult.canWrite("WEB_BESBOF");
                            bresult.canItemsChange = bresult.canMainChange && !isPunchout;
                            break;
                    case 2: // Nieuw, ter fiattering
                            bresult.canApprove     = (bes_bestelling.bes_bestelling_fiat_user != user_key) && isVerantwoordelijke;
-                            bresult.canDelete      =     bresult.canWrite("WEB_BESBOF")
-                                                     || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot)
-                                                     || (eigenBestelling && voor_annuleer);
-                            bresult.canMainChange  = (bresult.canApprove //  fiatteur mag ook aanpassen
-                                                      || bresult.canWrite("WEB_BESBOF")
-                                                      || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot)
-                                                      || (eigenBestelling && voor_wijzig)
-                                                     );
+                            bresult.canDelete      = bresult.canWrite("WEB_BESBOF") ||
+                                                     (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot) ||
+                                                     (eigenBestelling && voor_annuleer);
+                            bresult.canMainChange  = bresult.canApprove  || //  fiatteur mag ook aanpassen
+                                                     bresult.canWrite("WEB_BESBOF") ||
+                                                     (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot) ||
+                                                     (eigenBestelling && voor_wijzig);
                            bresult.canItemsChange = bresult.canMainChange && !isPunchout;
                            break;
                    case 3: // Gefiatteerd
-                            bresult.canAccept      = bresult.canWrite("WEB_BESBOF");
+                            var t_cost = bes_bestelling.totaal - bes_bestelling.rfoBesKosten + bes_bestelling.rfoLevKosten;
+                            var bes_approved = bes_bestelling.approved;
+                            var bestellimiet = bes_disc_info.disc_params_bestellimiet;
+                            var bestellimiet2 = bes_disc_info.disc_params_bestellimiet2;
+                            var bestellimiet3 = bes_disc_info.disc_params_bestellimiet3;
+                            var bestellimiet4 = bes_disc_info.disc_params_bestellimiet4;
+                            var bestellimiet5 = bes_disc_info.disc_params_bestellimiet5;
+                            bresult.canAccept      = bresult.canWrite("WEB_BESBOF") &&                                  // Heb ik de rechten om goed te keuren op dit niveau 1?
+                                                     ((S("bes_approval_all") == 0 && t_cost >= bestellimiet) ||         // Zijn de kosten hoger als de limiet
+                                                      (S("bes_approval_all") == 1 && t_cost <= bestellimiet2)) &&       // Zijn de kosten onder mijn limiet om volledig goed te keuren
+                                                     bes_approved <= bestellimiet;                                      // Welke goedkeur? 1, 2, 3, 4 of 5?
+                            bresult.canAccept2     = bresult.canWrite("WEB_BESGO2") &&
+                                                     // Setting mld_opdr_approval_all is
+                                                     // 0: Het approved bedrag is eigen bestellimiet of vorige goedkeur niveau rechten heb ik al (dan direct niveau hoger)
+                                                     // 1: Het approved bedrag is kleiner of gelijk aan eigen bestellimiet
+                                                     ((S("bes_approval_all") == 0 && t_cost >= bestellimiet2 && (bes_approved == bestellimiet2 || bresult.canAccept)) ||
+                                                      (S("bes_approval_all") == 1 && t_cost <= bestellimiet3 && bes_approved <= bestellimiet2));
+                            bresult.canAccept3     = bresult.canWrite("WEB_BESGO3") &&
+                                                     ((S("bes_approval_all") == 0 && t_cost >= bestellimiet3 && (bes_approved == bestellimiet3 || bresult.canAccept2)) ||
+                                                      (S("bes_approval_all") == 1 && t_cost <= bestellimiet4 && bes_approved <= bestellimiet3));
+                            bresult.canAccept4     = bresult.canWrite("WEB_BESGO4") &&
+                                                     ((S("bes_approval_all") == 0 && t_cost >= bestellimiet4 && (bes_approved == bestellimiet4 || bresult.canAccept3)) ||
+                                                      (S("bes_approval_all") == 1 && t_cost <= bestellimiet5 && bes_approved <= bestellimiet4));
+                            bresult.canAccept5     = bresult.canWrite("WEB_BESGO5") &&
+                                                     ((S("bes_approval_all") == 0 && t_cost >= bestellimiet5 && (bes_approved >= bestellimiet5 || bresult.canAccept4)) ||
+                                                      (S("bes_approval_all") == 1 && t_cost > bestellimiet5 && bes_approved <= bestellimiet5)) &&
+                                                     t_cost > bes_approved;
                            bresult.canDelete      =     bresult.canWrite("WEB_BESBOF")
                                                     || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot)
                                                     || (eigenBestelling && voor_annuleer);
-                            bresult.canReject      = bresult.canWrite("WEB_BESBOF");
-                            bresult.canMainChange  = (   bresult.canWrite("WEB_BESBOF")
-                                                      || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot)
-                                                      || (eigenBestelling && voor_wijzig)
-                                                     )
+                            bresult.canReject      = bresult.canAccept ||
+                                                     bresult.canAccept2 ||
+                                                     bresult.canAccept3 ||
+                                                     bresult.canAccept4 ||
+                                                     bresult.canAccept5;
+                            bresult.canMainChange  = (bresult.canWrite("WEB_BESBOF") ||
+                                                      (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot) ||
+                                                      (eigenBestelling && voor_wijzig))
                                                     && !bresult.isChange; // Change bestelaanvraag kan alleen gewijzigd worden als status = 2
                            bresult.canItemsChange = bresult.canMainChange && !isPunchout;
                            break;
                    case 4: // Geaccepteerd door BO
-                            bresult.canDelete      = bresult.canWrite("WEB_BESBOF")
-                                                     || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot)
-                                                     || (eigenBestelling && voor_annuleer);
+                            bresult.canDelete      = bresult.canWrite("WEB_BESBOF") ||
+                                                     (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot) ||
+                                                     (eigenBestelling && voor_annuleer);
                            bresult.canSubmit      = bresult.canWrite("WEB_BESBOF") && !bes_bestelling.isordered;
                            bresult.canRetourURL   = _canRetour && (bes_disc_info.disc_params_retour_url != null);
-                            bresult.canMainChange  = (    bresult.canWrite("WEB_BESBOF")
-                                                      || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot)
-                                                      || (eigenBestelling && voor_wijzig)
-                                                     )
-                                                     && !bresult.isChange; // Change bestelaanvraag kan alleen gewijzigd worden als status = 2
+                            bresult.canMainChange  = (bresult.canWrite("WEB_BESBOF") ||
+                                                      (bresult.canWrite("WEB_BESFOF") && bes_bestelling.wijzig_tot) ||
+                                                      (eigenBestelling && voor_wijzig)) &&
+                                                     !bresult.isChange; // Change bestelaanvraag kan alleen gewijzigd worden als status = 2
                            bresult.canItemsChange = bresult.canMainChange && !isPunchout;
                            break;
                    case 5: // Besteld (lees: opdracht is aangemaakt/ligt bij leverancier)
                            if (bes_bestelling.aantalontv == 0)// Als er artikelen ontvangen zijn houdt het op
                            {
-                                bresult.canDelete      =     bresult.canWrite("WEB_BESBOF")
-                                                         || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot)
-                                                         || (eigenBestelling && voor_annuleer);
+                                bresult.canDelete      = bresult.canWrite("WEB_BESBOF") ||
+                                                         (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot) ||
+                                                         (eigenBestelling && voor_annuleer);
                                bresult.canDelete &= bes_disc_info.can_concept;
                            }
                            bresult.canRetourURL   = _canRetour && (bes_disc_info.disc_params_retour_url != null);
                            // Als iemand wijzigt zal het een change-opdracht worden!
-                            bresult.canMainChange  = (    bresult.canWrite("WEB_BESBOF")
-                                                      || (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot)
-                                                      || (eigenBestelling && voor_wijzig)
-                                                     )
-                                                      && !bresult.isChange // Change bestelaanvraag kan niet meer gewijzigd worden
-                                                      && bes_disc_info.can_concept;
+                            bresult.canMainChange  = (bresult.canWrite("WEB_BESBOF") ||
+                                                      (bresult.canWrite("WEB_BESFOF") && bes_bestelling.annuleer_tot) ||
+                                                      (eigenBestelling && voor_wijzig)) &&
+                                                     !bresult.isChange && // Change bestelaanvraag kan niet meer gewijzigd worden
+                                                     bes_disc_info.can_concept;

                            bresult.canItemsChange = bresult.canMainChange && !isPunchout;
                            break;
@@ -796,9 +847,9 @@
                      + "   AND s.bes_srtgroep_key = g.bes_srtgroep_key"
                      + "   AND bo.bes_bestelopdr_key = " + opdr_key;
              var oRs = Oracle.Execute(sql);
-              var perslid_key = oRs("prs_perslid_key").value;
-              var dis_key = oRs("ins_discipline_key").value;
-              var bestelopdr_status = oRs("bes_bestelopdr_status").value;
+              var perslid_key = oRs("prs_perslid_key").Value;
+              var dis_key = oRs("ins_discipline_key").Value;
+              var bestelopdr_status = oRs("bes_bestelopdr_status").Value;
              oRs.Close();

              var bresult = user.func_enabled("BES",
@@ -899,31 +950,31 @@
              if (!oRs.eof)
              {
                // Oplaan bedrijf waar alle artikelen worden besteld. Moet voor elke artikel hetzelfde zijn.
-                prs_bedrijf_key = oRs("prs_bedrijf_key").value;
+                prs_bedrijf_key = oRs("prs_bedrijf_key").Value;
                // Opslaan van staffelgroep van een item
                ItemArray.push({ item_key    : srtdeel_keys[i],
                                 aantal      : itemaantal_arr[i],
-                                 prijs       : oRs("prijs").value,
-                                 eenheid     : oRs("eenheid").value,
-                                 staffelgroep: oRs("staffelgroep").value
+                                 prijs       : oRs("prijs").Value,
+                                 eenheid     : oRs("eenheid").Value,
+                                 staffelgroep: oRs("staffelgroep").Value
                                });
                // Opslaan van totaalaantallen van een staffelgroep
-                if (oRs("staffelgroep").value)
+                if (oRs("staffelgroep").Value)
                {
-                  if (staffelGroepArray[oRs("staffelgroep").value])
+                  if (staffelGroepArray[oRs("staffelgroep").Value])
                  {
-                    staffelGroepArray[oRs("staffelgroep").value].aantal += itemaantal_arr[i];
-                    staffelGroepArray[oRs("staffelgroep").value].bestelbedrag += (oRs("prijs").value *  itemaantal_arr[i]);
+                    staffelGroepArray[oRs("staffelgroep").Value].aantal += itemaantal_arr[i];
+                    staffelGroepArray[oRs("staffelgroep").Value].bestelbedrag += (oRs("prijs").Value *  itemaantal_arr[i]);
                  }
                  else
                  {
-                    staffelGroepArray[oRs("staffelgroep").value] =
-                            new StaffelGroep(oRs("staffelgroepnaam").value,
+                    staffelGroepArray[oRs("staffelgroep").Value] =
+                            new StaffelGroep(oRs("staffelgroepnaam").Value,
                                              itemaantal_arr[i],
-                                              oRs("eenheid").value,
+                                              oRs("eenheid").Value,
                                              0,
-                                              oRs("groep").value,
-                                              (oRs("prijs").value *  itemaantal_arr[i], 10))
+                                              oRs("groep").Value,
+                                              (oRs("prijs").Value *  itemaantal_arr[i], 10))
                  }
                }
              }
@@ -941,8 +992,8 @@

                if (!oRs.eof)
                {
-                  staffelGroepArray[ItemArray[j].staffelgroep].korting += ItemArray[j].aantal * (ItemArray[j].prijs - parseFloat(oRs("kortingsprijs").value, 10));
-                  litemprijsstring.push(oRs("kortingsprijs").value);
+                  staffelGroepArray[ItemArray[j].staffelgroep].korting += ItemArray[j].aantal * (ItemArray[j].prijs - parseFloat(oRs("kortingsprijs").Value, 10));
+                  litemprijsstring.push(oRs("kortingsprijs").Value);
                  first = false;
                }
              }
@@ -987,7 +1038,7 @@
            var oRs = Oracle.Execute(sql);
            if (!oRs.eof)
            {
-              opdrachtkortingbedrag = oRs("opdrachtkortingbedrag").value;
+              opdrachtkortingbedrag = oRs("opdrachtkortingbedrag").Value;
            }

            sql = "SELECT BES.calcopdrachtkorting(" + prs_bedrijf_key + ", " + subtotaal + ") opdrachtkorting FROM DUAL";
@@ -995,7 +1046,7 @@
            if (!oRs.eof)
            {
              // Korting tot grenswaarde
-              opdrachtkorting = oRs("opdrachtkorting").value;
+              opdrachtkorting = oRs("opdrachtkorting").Value;
            }

            // Nieuw subtotaal: Bestelbedrag - alle kortingen
@@ -1009,7 +1060,7 @@
            if (!oRs.eof)
            {
              // Korting tot grenswaarde
-              grenswaardetot = oRs("grenswaarde").value;
+              grenswaardetot = oRs("grenswaarde").Value;
            }

            // Nu grenswaarde bepalen vanaf
@@ -1023,7 +1074,7 @@
            if (!oRs.eof)
            {
              // Korting vanaf grenswaarde
-              grenswaardevanaf = oRs("grenswaarde").value;
+              grenswaardevanaf = oRs("grenswaarde").Value;
            }

            // Extra (transport) kosten en onderlimiet bepalen
@@ -1039,8 +1090,8 @@
            if (!oRs.eof)
            {
              // Extra (transport) kosten
-              bes_kosten = oRs("bes_kosten").value;
-              bes_limiet = oRs("bes_limiet").value;
+              bes_kosten = oRs("bes_kosten").Value;
+              bes_limiet = oRs("bes_limiet").Value;
            }

            // Totaalbedrag
@@ -1094,9 +1145,9 @@
                + ", bes_bestelling b"
                + " WHERE b.bes_bestelling_key = tot.bes_bestelling_key"
            oRs = Oracle.Execute(sql);
-            prstotaalbesteld = oRs("totaalbedrag").value || 0;
-            korting = oRs("korting").value || 0;
-            levkosten = oRs("levkosten").value || 0;
+            prstotaalbesteld = oRs("totaalbedrag").Value || 0;
+            korting = oRs("korting").Value || 0;
+            levkosten = oRs("levkosten").Value || 0;
            budgetbesteld = prstotaalbesteld - korting + levkosten;
          }
          return budgetbesteld;
@@ -1110,7 +1161,7 @@
          { // Totaalbedrag van eerder bestellingen afgelopen periode van de besteller i.v.m. Afdelings Gebonden Budget (AGB)
            var sql = "SELECT prs.getkostenplaats(" + prs_key + ", " + S("prs_approvemethod") + ", -1) kostenplaats FROM DUAL";
            var oRs = Oracle.Execute(sql);
-            var kp_key = oRs("kostenplaats").value;
+            var kp_key = oRs("kostenplaats").Value;

             // Limietperiode kostenplaats (prs_kostenplaats_limietperiode): 0(of NULL)=geen(oneindig) (default), 1=maand, 2=jaar
            if (kp_key > 0)
@@ -1119,7 +1170,7 @@
                      + "  FROM prs_kostenplaats k"
                      + " WHERE k.prs_kostenplaats_key = " + kp_key;
              var oRs = Oracle.Execute(sql);
-              var kp_limietperiode = oRs("prs_kostenplaats_limietperiode").value;
+              var kp_limietperiode = oRs("prs_kostenplaats_limietperiode").Value;
              var periode;
              if (kp_limietperiode == 1)
                periode = "MM"; // Maandelijks budget
@@ -1139,15 +1190,15 @@
                    ? " AND b.bes_bestelling_key <> " + bes_key
                    : "")
                  + (kp_limietperiode && kp_limietperiode > 0
-                    ? " AND b.bes_bestelling_datum >= TRUNC (SYSDATE, '" + periode + "')" // De eerste van de deze maand of 1 januari dit jaar
+                    ? " AND b.bes_bestelling_datum >= TRUNC (SYSDATE, " + safe.quoted_sql(periode) + ")" // De eerste van de deze maand of 1 januari dit jaar
                    : "")
                  + " GROUP BY b.bes_bestelling_key) tot"
                  + ", bes_bestelling b"
                  + " WHERE b.bes_bestelling_key = tot.bes_bestelling_key"
              oRs = Oracle.Execute(sql);
-              prstotaalbesteld = oRs("totaalbedrag").value || 0;
-              korting = oRs("korting").value || 0;
-              levkosten = oRs("levkosten").value || 0;
+              prstotaalbesteld = oRs("totaalbedrag").Value || 0;
+              korting = oRs("korting").Value || 0;
+              levkosten = oRs("levkosten").Value || 0;
              budgetbesteld = prstotaalbesteld - korting + levkosten;
            }
          }
@@ -1162,7 +1213,7 @@
        // Bepaal PGB limiet
        var sql = "SELECT prs.getprofiellimiet(" + prs_key + ", " + dis_key + ") pgblimiet FROM DUAL";
        var oRs = Oracle.Execute(sql);
-        var pgblimiet = oRs("pgblimiet").value;
+        var pgblimiet = oRs("pgblimiet").Value;

        if (pgblimiet != null)
        { // Verschil PGB limiet met het besteed budget van persoon en desbetreffende discipline voor dit jaar inclusief bestelbedrag
@@ -1179,7 +1230,7 @@
        // Bepaal AGB limiet
        var sql = "SELECT prs.getlimietagb(" + prs_key + ", " + S("prs_approvemethod") + ", " + dis_key + ") agblimiet FROM DUAL";
        var oRs = Oracle.Execute(sql);
-        var agblimiet = oRs("agblimiet").value;
+        var agblimiet = oRs("agblimiet").Value;

        if (agblimiet != null)
        { // Verschil AGB limiet met het besteed budget van persoon en desbetreffende discipline voor dit jaar inclusief bestelbedrag
@@ -1237,7 +1288,7 @@
      },

      // Levert de 'Is ter fiattering aangeboden bij approver' op.
-      sendNeedApprovalNotification: function(bes_key, requestor, approver)
+      sendNeedApprovalNotification: function(bes_key, approver)
      {
        if (approver == null)
            return false;
@@ -1250,19 +1301,19 @@
                + " AND b.bes_bestelling_key = " + bes_key;
        var oRs = Oracle.Execute(sql);
        if (!oRs.eof) {
-            var lsender = oRs(0).value;
+            var lsender = oRs(0).Value;
        } else {
            var lsender = null;
        }
        // notify approver and requestor by message & mail as configured in fac_srtnotificatie with BESAPx
        shared.trackaction("BESAP2", bes_key);

-        Oracle.Execute("BEGIN fac.putnotificationsrtprio(NULL, " + approver + ", 'BESAP1', " + bes_key + ", NULL, NULL, NULL, NULL, NULL, 2, " + (lsender ? "'" + lsender + "'" : "NULL") + "); END;");
+        Oracle.Execute("BEGIN fac.putnotificationsrtprio(NULL, " + approver + ", 'BESAP1', " + bes_key + ", NULL, NULL, NULL, NULL, NULL, 2, " + (lsender ? safe.quoted_sql(lsender) : "NULL") + "); END;");

        sql = "SELECT prs_perslid_naam_full FROM prs_v_perslid_fullnames WHERE prs_perslid_key = " + approver;
        oRs = Oracle.Execute(sql);
        if (!oRs.eof)
-          return L("lcl_bes_RFO_regApprov") + oRs("prs_perslid_naam_full").value;
+          return L("lcl_bes_RFO_regApprov") + oRs("prs_perslid_naam_full").Value;
        else
          return L("lcl_bes_RFO_regApprov");
      },
@@ -1304,13 +1355,13 @@
            oRs = Oracle.Execute(sql);
        while(!oRs.eof)
        {
-          var txt = S("bes_bestelopdr_prefix") + oRs("bes_bestelopdr_id").value;
-          if (oRs("bes_bestelopdr_status").value == 1) // afgewezen
-              txt += " (" + bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").value) + ")";
+          var txt = S("bes_bestelopdr_prefix") + oRs("bes_bestelopdr_id").Value;
+          if (oRs("bes_bestelopdr_status").Value == 1) // afgewezen
+              txt += " (" + bes.getbesopdrstatustext(oRs("bes_bestelopdr_status").Value) + ")";
          if (bes_bestelling.parent_key)
              txt += "*"; // wij zijn een change dus de opdracht ook
          l_orders_txt.push(txt);
-          l_orders_key.push(oRs("bes_bestelopdr_key").value);
+          l_orders_key.push(oRs("bes_bestelopdr_key").Value);
          oRs.MoveNext();
        }
        oRs.Close();
@@ -1353,8 +1404,5 @@
        }
        return message;
      }
-
-
    }
-
- %>
+%>
--- a/APPL/BES/bes_accept.asp
+++ b/APPL/BES/bes_accept.asp
@@ -13,7 +13,7 @@
 */ %>

 <%
-DOCTYPE_Disable = 1;
+var JSON_Result = true;
 %>

 <!-- #include file="../Shared/common.inc" -->
@@ -36,9 +36,22 @@ for (var i = 0; i < bes_key_arr.length; i++)
  var bes_bestelling = bes.bestelling_info(bes_key_arr[i]); // Globale variabele met alle bes_bestelling informatie
  var bes_disc_info = bes.disc_info(bes_bestelling.dis_key); // alle discipline informatie
  var this_bes = bes.func_enabled_bestelling(bes_bestelling);
-  if (this_bes.canAccept)
+  if (this_bes.canAccept || this_bes.canAccept2 || this_bes.canAccept3 || this_bes.canAccept4 || this_bes.canAccept5)
  {
-    ingesloten.push(bes_key_arr[i]);
+    ingesloten.push({ bes_key: bes_key_arr[i],
+                      kosten: bes_bestelling.totaal - bes_bestelling.rfoBesKosten + bes_bestelling.rfoLevKosten,
+                      approved: bes_bestelling.approved,
+                      bestellimiet: bes_disc_info.disc_params_bestellimiet,
+                      bestellimiet2: bes_disc_info.disc_params_bestellimiet2,
+                      bestellimiet3: bes_disc_info.disc_params_bestellimiet3,
+                      bestellimiet4: bes_disc_info.disc_params_bestellimiet4,
+                      bestellimiet5: bes_disc_info.disc_params_bestellimiet5,
+                      canAccept: this_bes.canAccept,
+                      canAccept2: this_bes.canAccept2,
+                      canAccept3: this_bes.canAccept3,
+                      canAccept4: this_bes.canAccept4,
+                      canAccept5: this_bes.canAccept5 }
+                      );
    tobeaccepted++;
  }
 }
@@ -46,13 +59,103 @@ user.anything_todo_or_abort(tobeaccepted > 0); // We klagen niet over enkele wel

 for (var i = 0; i < ingesloten.length; i++)
 {
-  bes.setbestellingstatus(ingesloten[i], 4); // Geaccepteerd BO
+  var bes_key = ingesloten[i].bes_key;
+  var setnextstatus = false;

-  if (bes_disc_info.disc_params_auto_order == "1")
-    bes.makeOrders(user_key, ingesloten[i]);
+  if (ingesloten[i].canAccept && (S("bes_approval_all") == 1 || !ingesloten[i].canAccept2)) // Kan ik deze bestelling accepteren tot de eerste limiet? Als ik ook al tot de tweede limiet kan accepteren dan direct maar tot de tweede limiet (volgende if).
+  {
+    var finalapproval = (S("bes_approval_all") == 1 || ingesloten[i].kosten <= ingesloten[i].bestellimiet2 || ingesloten[i].approved > ingesloten[i].bestellimiet2);

-  result.message =  tobeaccepted + " " + (tobeaccepted == 1 ? L("lcl_bes_accepted1") : L("lcl_bes_accepted"));
-  result.success = true;
+    sql = "UPDATE bes_bestelling"
+        + " SET bes_bestelling_approved = " + (ingesloten[i].kosten < ingesloten[i].bestellimiet2? ingesloten[i].kosten : ingesloten[i].bestellimiet2) // Gefiatteerd tot een bedrag van limiet1 (<=500 Euro)
+        + " WHERE bes_bestelling_key = " + bes_key;
+    oRs = Oracle.Execute(sql);
+
+    if (!finalapproval)
+    { // Tracking en alle tweede goedkeurders een notificatie sturen.
+      bes.trackbestellingaccepteren(bes_key);
+    }
+    else
+      // De bestelling is tot de bestellingkosten goedgekeurd. Verder goedkeuren hoeft niet.
+      // De status van de bestelling mag (indien mogelijk) naar Geaccepteerd(4) of Besteld(5).
+      setnextstatus = true;
+    result.success = true;
+  }
+  if (ingesloten[i].canAccept2 && (S("bes_approval_all") == 1 || !ingesloten[i].canAccept3)) // Kan ik deze bestelling accepteren tot de tweede limiet? Als ik ook al tot de derde limiet kan accepteren dan direct maar tot de derde limiet (volgende if).
+  {
+    var finalapproval = (S("bes_approval_all") == 1 || ingesloten[i].kosten <= ingesloten[i].bestellimiet3 || ingesloten[i].approved > ingesloten[i].bestellimiet3);
+    sql = "UPDATE bes_bestelling"
+        + " SET bes_bestelling_approved = " + (ingesloten[i].kosten < ingesloten[i].bestellimiet3? ingesloten[i].kosten : ingesloten[i].bestellimiet3) // Gefiatteerd tot een bedrag van limiet2 (<=5000 Euro)
+        + " WHERE bes_bestelling_key = " + bes_key;
+    oRs = Oracle.Execute(sql);
+
+    if (!finalapproval)
+    { // Tracking en alle derde goedkeurders een notificatie sturen.
+      bes.trackbestellingaccepteren(bes_key);
+    }
+    else
+      // De bestelling is tot de bestellingkosten goedgekeurd. Verder goedkeuren hoeft niet.
+      // De status van de bestelling mag (indien mogelijk) naar Geaccepteerd(4) of Besteld(5).
+      setnextstatus = true;
+    result.success = true;
+  }
+  if (ingesloten[i].canAccept3 && (S("bes_approval_all") == 1 || !ingesloten[i].canAccept4)) // Kan ik deze bestelling accepteren tot de derde limiet? Als ik ook al tot de vierde limiet kan accepteren dan direct maar tot de vierde limiet (volgende if).
+  {
+    var finalapproval = (S("bes_approval_all") == 1 || ingesloten[i].kosten <= ingesloten[i].bestellimiet4 || ingesloten[i].approved > ingesloten[i].bestellimiet4);
+    sql = "UPDATE bes_bestelling"
+        + " SET bes_bestelling_approved = " + (ingesloten[i].kosten < ingesloten[i].bestellimiet4? ingesloten[i].kosten : ingesloten[i].bestellimiet4) // Gefiatteerd tot een bedrag van limiet3 (<=125000 Euro)
+        + " WHERE bes_bestelling_key = " + bes_key;
+    oRs = Oracle.Execute(sql);
+
+    if (!finalapproval)
+    { // Tracking en alle derde goedkeurders een notificatie sturen.
+      bes.trackbestellingaccepteren(bes_key);
+    }
+    else
+      // De bestelling is tot de bestellingkosten goedgekeurd. Verder goedkeuren hoeft niet.
+      // De status van de bestelling mag (indien mogelijk) naar Geaccepteerd(4) of Besteld(5).
+      setnextstatus = true;
+    result.success = true;
+  }
+  if (ingesloten[i].canAccept4 && (S("bes_approval_all") == 1 || !ingesloten[i].canAccept5)) // Kan ik deze bestelling accepteren tot de derde limiet? Als ik ook al tot de vierde limiet kan accepteren dan direct maar tot de vierde limiet (volgende if).
+  {
+    var finalapproval = (S("bes_approval_all") == 1 || ingesloten[i].kosten <= ingesloten[i].bestellimiet5 || ingesloten[i].approved > ingesloten[i].bestellimiet5);
+    sql = "UPDATE bes_bestelling"
+        + " SET bes_bestelling_approved = " + (ingesloten[i].kosten < ingesloten[i].bestellimiet5? ingesloten[i].kosten : ingesloten[i].bestellimiet5) // Gefiatteerd tot een bedrag van limiet4 (<=1000000 Euro)
+        + " WHERE bes_bestelling_key = " + bes_key;
+    oRs = Oracle.Execute(sql);
+
+    if (!finalapproval)
+    { // Tracking en alle derde goedkeurders een notificatie sturen.
+      bes.trackbestellingaccepteren(bes_key);
+    }
+    else
+      // De bestelling is tot de bestellingkosten goedgekeurd. Verder goedkeuren hoeft niet.
+      // De status van de bestelling mag (indien mogelijk) naar Geaccepteerd(4) of Besteld(5).
+      setnextstatus = true;
+    result.success = true;
+  }
+  else if (ingesloten[i].canAccept5) // Kan ik deze bestelling volledig accepteren en geaccepteerd/besteld maken?
+  {
+    sql = "UPDATE bes_bestelling"
+        + " SET bes_bestelling_approved = " + ingesloten[i].kosten // Gefiatteerd boven bedrag van limiet5 (>1000000 Euro) voor het bedrag van de bestellingkosten.
+        + " WHERE bes_bestelling_key = " + bes_key;
+    oRs = Oracle.Execute(sql);
+
+    // De status van de opdracht mag (indien mogelijk) naar Ter fiattering(0) of Uitgegeven(5).
+    setnextstatus = true;
+    result.success = true;
+  }
+
+  if (setnextstatus)
+  { // Nu naar status 4 (Geaccepteerd) of opdrachten aanmaken en naar status 5 (Besteld).
+    bes.setbestellingstatus(bes_key, 4); // Geaccepteerd BO
+
+    if (bes_disc_info.disc_params_auto_order == "1")
+      bes.makeOrders(user_key, bes_key);
+
+    result.message = tobeaccepted + " " + (tobeaccepted == 1 ? L("lcl_bes_accepted1") : L("lcl_bes_accepted"));
+  }
 }

 Response.Write(JSON.stringify(result));
--- a/APPL/BES/bes_approve.asp
+++ b/APPL/BES/bes_approve.asp
@@ -84,8 +84,7 @@ for (var i = 0; i < ingesloten.length; i++)
      // vervolgens naar kostenplaatsgroep fiatteur sturen
      // Fiatteringsproces moet gevolgd worden op de naam van de "voor wie" (bestelling voor)
      // Als bes_disc_params_for_others niet is gezet zijn perslid_key en perslid_key_voor identiek
-      var bes_bestelling = bes.bestelling_info(ingesloten[i].bes_key); // fiatteur_key zal veranderd zijn
-      message = bes.sendNeedApprovalNotification(bes_bestelling.bes_key, bes_bestelling.perslid_key_voor, bes_bestelling.fiatteur_key);
+      message = bes.sendNeedApprovalNotification(ingesloten[i].bes_key, ingesloten[i].fiatteur_key);
  }

  result.success = true;
--- a/APPL/BES/bes_edit_bestelling.asp
+++ b/APPL/BES/bes_edit_bestelling.asp
@@ -105,7 +105,10 @@ else // nieuwe bestelling. Defaults bepalen
    bes_bestelling.rfoDeliverydate = new Date(leverdatum);
  else
  {
-    bes_bestelling.rfoDeliverydate = new Date();
+    if (bes_disc_info.disc_params_leverdagen < 0)
+        bes_bestelling.rfoDeliverydate = null;
+    else
+        bes_bestelling.rfoDeliverydate = new Date();
    if (bes_disc_info.disc_params_leverdagen > 0)
    {
      sql = "SELECT fac.DatumTijdPlusUitvoerTijd(" + (new Date).toSQL() + "," + bes_disc_info.disc_params_leverdagen + ", 'DAGEN')"
@@ -493,15 +496,17 @@ else // nieuwe bestelling. Defaults bepalen
            if (p_key > 0)
            {
              $.getJSON("../prs/get_prs_info_ajax.asp?req_info=prs_perslid&prs_aflever=1&prs_profiel=<%=bes_bestelling.dis_key%>&prs_perslid_key=" + p_key + "&setmandaat=" + setmandaat, process_besteller_info);
-              // Droom: niet reloaden igv geen persoonsafhankelijke kenmerken; dat weet ik hier echter niet..
-              // TEST: wat als niet bes_voor?
-              var s = "load_kenmerk.asp?urole=<%=urole%>"
-                    + "&bes_key=<%=bes_bestelling.bes_key%>"
-                    + "&disc_key="+ dis_key
-                    + "&kenmerktype=B"
-                    + (bes_key > 0 && !this_bes.canMainChange? "&reado=1" : "")   // testen
-                    + "&prs_key=" + p_key;
-              $("#besFlexList").load(s, function () { FcltMgr.resized () });
+              // Alleen reloaden als persoonsafhankelijke kenmerken; anders heel irritant
+              if ($("#k_flexsql").val() == 1)
+              {   // TEST: wat als niet bes_voor?
+                  var s = "load_kenmerk.asp?urole=<%=urole%>"
+                        + "&bes_key=<%=bes_bestelling.bes_key%>"
+                        + "&disc_key="+ dis_key
+                        + "&kenmerktype=B"
+                        + (bes_key > 0 && !this_bes.canMainChange? "&reado=1" : "")   // testen
+                        + "&prs_key=" + p_key;
+                  $("#besFlexList").load(s, function () { FcltMgr.resized () });
+              }
            }
          }
        </script>
@@ -621,7 +626,8 @@ else // nieuwe bestelling. Defaults bepalen
        FCLTcalendar( "calendar",
            { label   : (bes_disc_info.disc_params_leverdagen>0? L("lcl_bes_deli_date_exp") : L("lcl_bes_deli_date")),
              datum   : bes_bestelling.rfoDeliverydate,
-              maxPast : (bes_disc_info.disc_params_leverdagen >= 0)? 0 : null,
+              initEmpty: bes_key < 0 && bes_disc_info.disc_params_leverdagen < 0,
+              maxPast : 0,
              maxFuture: S("bes_datum_limiet"),
              readonly: (bes_key > 0 && !this_bes.canMainChange) || leverdatum,
              saveValue: (leverdatum!=null), // wel submitten
--- a/APPL/BES/bes_edit_bestelling_save.asp
+++ b/APPL/BES/bes_edit_bestelling_save.asp
@@ -479,11 +479,7 @@ if (UseRemoteApproval)
              // AP2 notificatie wordt al door sendNeedApprovalNotification gedaan
              // bes.setbestellingstatus(bes_key, 2); // terug naar Nieuw/ter acceptering
          }
-          // Fiatteringsproces moet gevolgd worden op de naam van
-          // S("prs_dep_default_kpn_voor") == 0: de contactpersoon prs_key
-          // S("prs_dep_default_kpn_voor") == 1: de "voor wie" (bestelling voor) prs_key_voor
-          // Als bes_disc_params_for_others niet is gezet zijn prs_key en prs_key_voor identiek
-          strState = bes.sendNeedApprovalNotification(bes_key, (S("prs_dep_default_kpn_voor") == 0? prs_key : prs_key_voor), approver_key);
+          strState = bes.sendNeedApprovalNotification(bes_key, approver_key);
        }
      }
   }
--- a/APPL/BES/bes_edit_opdr.asp
+++ b/APPL/BES/bes_edit_opdr.asp
@@ -199,20 +199,36 @@ var this_bestelopdr = bes.func_enabled_bestelopdracht(opdr_key);
          </tr>
 <%      }

-        sql = "SELECT mld_adres_key, mld_adres_naam "
-            + " FROM mld_v_aanwezigadres"
-            + " WHERE mld_adres_afleveradres IS NOT NULL"
-            + (authparams.ALGreadlevel >= 0?" AND alg_locatie_key IN (SELECT alg_locatie_key FROM fac_v_my_locations "
-            + " WHERE prs_perslid_key = " + user_key + " AND niveau="+authparams.ALGreadlevel+")":"")
+        sql = "SELECT aa.mld_adres_key"
+            + "     , aa.mld_adres_naam"
+            + "  FROM mld_v_aanwezigadres aa"
+            + " WHERE aa.mld_adres_afleveradres IS NOT NULL"
+            + (authparams.ALGreadlevel >= 0
+              ? " AND (EXISTS (SELECT ml.alg_locatie_key"
+              + "               FROM fac_v_my_locations ml"
+                + "            WHERE ml.prs_perslid_key = " + user_key
+                + "              AND ml.niveau = " + authparams.ALGreadlevel
+                + "              AND ml.alg_locatie_key = aa.alg_locatie_key)"
+                + " OR aa.alg_locatie_key IS NULL"
+                + " OR aa.mld_adres_key = " + bes_bestelopdr.mld_adres_key_lev + ")"
+              : "")
            + " ORDER BY 2";
        FCLTselector("levering", sql, {label: L("lcl_bes_adres_lev"),
                                       initKey: bes_bestelopdr.mld_adres_key_lev,
                                       emptyOption: (bes_bestelopdr.mld_adres_key_lev < 0? null : "")})

-        sql = "SELECT mld_adres_key, mld_adres_naam "
-            + " FROM mld_v_factuuradres"
-            + (authparams.ALGreadlevel>=0?" WHERE alg_locatie_key IN (SELECT alg_locatie_key FROM fac_v_my_locations "
-            + " WHERE prs_perslid_key="+user_key+" AND niveau="+authparams.ALGreadlevel+")":"")
+        sql = "SELECT fa.mld_adres_key"
+            + "     , fa.mld_adres_naam"
+            + "  FROM mld_v_factuuradres fa"
+            + (authparams.ALGreadlevel >= 0
+              ? " WHERE (EXISTS (SELECT ml.alg_locatie_key"
+              + "                 FROM fac_v_my_locations ml"
+                + "              WHERE ml.prs_perslid_key = " + user_key
+                + "                AND ml.niveau = " + authparams.ALGreadlevel
+                + "                AND ml.alg_locatie_key = fa.alg_locatie_key)"
+                + "  OR fa.alg_locatie_key IS NULL"
+                + "  OR fa.mld_adres_key = " + bes_bestelopdr.mld_adres_key_fac + ")"
+              : "")
            + " ORDER BY 2";
        FCLTselector("factuur", sql, {label: L("lcl_bes_adres_fac"),
                                     initKey: bes_bestelopdr.mld_adres_key_fac,
--- a/APPL/BES/bes_flexkenmerk.inc
+++ b/APPL/BES/bes_flexkenmerk.inc
@@ -135,7 +135,7 @@ function generateFlexKenmerkCode(params)
          +   " AND k.bes_kenmerk_verwijder IS NULL"
          +   " AND k.bes_srtkenmerk_key = sk.bes_srtkenmerk_key"
          +   " AND sk.bes_srtkenmerk_verwijder IS NULL"
-          +   " AND k.bes_kenmerk_type = '" + kenmerktype + "'"
+          +   " AND k.bes_kenmerk_type = " + safe.quoted_sql(kenmerktype)
          + (!besman ? " AND k.bes_kenmerk_volgnummer < 900 ":"")
          +   " ORDER BY k.bes_kenmerk_volgnummer, UPPER("+lcl.xsql('sk.bes_srtkenmerk_omschrijving', 'sk.bes_srtkenmerk_key')+")";

--- a/APPL/BES/bes_list.inc
+++ b/APPL/BES/bes_list.inc
@@ -196,6 +196,18 @@ function bes_list (pautfunction, params)
        return S("bes_bestelling_prefix") + (oRs.fields("bes_bestelling_parentkey").value > 0 ? oRs.fields("bes_bestelling_parentkey").value + "*" : oRs.fields("bes_bestelling_key").value);
      }

+      function fncolOordeel(oRs)
+      {
+        var result = null;
+        var displ_val = oRs("oordeel").Value;
+        var displ_txt = oRs("oordeel_opm").Value;
+        if (displ_val)
+        {
+          result = "<span id='oordeel' title='" + safe.htmlattr(displ_txt)+"'>" + displ_val + "</span>";
+        }
+        return result;
+      }
+
      /**********************************************
       * End general Callback functies ResultsetTable
       *********************************************/
@@ -208,7 +220,7 @@ function bes_list (pautfunction, params)
        if (pcatalogus_key || pgroep_key || pitem_key)
        {
          sqlDGI = (minfo && (groupbes == 1 || groupbes == 6) // Management Info Opdrachten
-                   ? " AND b.bes_bestelopdr_key IN"
+                   ? " AND bo.bes_bestelopdr_key IN"
                     + " (SELECT bes_bestelopdr_key"
                     + " FROM bes_bestelopdr_item boi"
                     + ", bes_bestelling_item bi"
@@ -312,7 +324,10 @@ function bes_list (pautfunction, params)
          sql_date = " < " + ora_date2;
        }

-        var sql_filter = "";
+        // Embargo bestellingen uitsluiten (als er eentje met parent is, willen we die zonder niet zien).
+        var sql_filter = " AND NOT EXISTS (SELECT b1.bes_bestelling_key"
+                       + "                   FROM bes_bestelling b1"
+                       + "                  WHERE bes_bestelling_parentkey = b.bes_bestelling_key)";

        if (params.mld_key)
            sql_filter += " AND b.mld_melding_key = " + params.mld_key;
@@ -525,6 +540,7 @@ function bes_list (pautfunction, params)
          sql += ", b.bes_bestelling_status"
               + ", b.bes_bestelling_module"
               + ", b.bes_bestelling_satisfaction oordeel"
+               + ", MAX(b.bes_bestelling_satisfaction_op) oordeel_opm"
               + " , SUM( bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
               + " , SUM( bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
               + " FROM bes_bestelling_item bi"
@@ -547,10 +563,7 @@ function bes_list (pautfunction, params)
               + " AND d.prs_afdeling_key = boom.prs_afdeling_key"
               + " AND b.mld_adres_key_lev = m.mld_adres_key"
               + " AND m.alg_locatie_key = l.alg_locatie_key(+)"
-               + " AND l.alg_district_key = di.alg_district_key(+)"
-               + " AND b.bes_bestelling_key NOT IN (SELECT b1.bes_bestelling_parentkey"
-               + "                                    FROM bes_bestelling b1"
-               + "                                   WHERE b1.bes_bestelling_parentkey IS NOT NULL)";
+               + " AND l.alg_district_key = di.alg_district_key(+)";

          sql += sql_filter;

@@ -597,7 +610,7 @@ function bes_list (pautfunction, params)
          rst.addColumn(new Column({caption: L("lcl_rfo_total_sum_eur"), content: "totaalbedrag", datatype: "currency", total: true})); //@@ TODO: AANPASSEN
          if (S("bes_show_inkprijs") == 1)
            rst.addColumn(new Column({caption: L("lcl_rfo_total_inksum"), content: "inktotaalbedrag", datatype: "currency", total: true}));
-          rst.addColumn(new Column({caption: L("lcl_bes_oordeel"), content: "oordeel", datatype: "float", decimals: 1, total: true}));
+          rst.addColumn(new Column({caption: L("lcl_bes_oordeel"), content: fncolOordeel, datatype: "float", decimals: 1, total: true}));

          // Acties
          rst.addAction({image: "../Pictures/spot1.jpg", action: "besEdit;", caption: L("lcl_edit"), isDefault: true});
@@ -643,17 +656,19 @@ function bes_list (pautfunction, params)
                       + ", COUNT(b.bes_bestelling_satisfaction) cnt_satisfaction"
                       + ", AVG(b.bes_bestelling_satisfaction) oordeel";

+
        if ((groupbes == 2) || (groupbes == 7))
        { // Aanvraag - Cluster/Aanvraag - Afdeling (Organisatie niveau 1 en 2)
          sql = "SELECT d.prs_afdeling_key"
-              + ", COUNT(b.bes_bestelling_key) aantalbes"
-              + ", " + S("prs_dep_string") + " afdeling"
-              + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
-              + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
+              + "     , b.bes_bestelling_key"
+              + "     , " + S("prs_dep_string") + " afdeling"
+              + "     , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
+              + "     , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
              + select_oordeel;

          sql_group_by = " GROUP BY d.prs_afdeling_key"
-                       + ", " + S("prs_dep_string");
+                       + "        , " + S("prs_dep_string")
+                       + "        , b.bes_bestelling_key";

          if (groupbes2)
          {
@@ -681,7 +696,7 @@ function bes_list (pautfunction, params)
               + " AND p.prs_perslid_key = b.prs_perslid_key"
               + " AND p.prs_afdeling_key = afd.prs_afdeling_key"
               + " AND afd.prs_afdeling_key = boom.prs_afdeling_key"
-               + " AND d.prs_afdeling_key = boom.prs_afdeling_key" + (groupbes == 2? "1" : "2")
+               + " AND d.prs_afdeling_key(+) = boom.prs_afdeling_key" + (groupbes == 2? "1" : "2")
               + " AND b.mld_adres_key_lev = adr.mld_adres_key"
               + " AND adr.alg_locatie_key = l.alg_locatie_key"
               + " AND l.alg_district_key = di.alg_district_key"
@@ -705,7 +720,24 @@ function bes_list (pautfunction, params)
                         2,
                         sql_group_by);

-          //sql += " ORDER BY " + S("prs_dep_string");
+          sql = "SELECT x.prs_afdeling_key"
+              + "     , COUNT(x.bes_bestelling_key) aantalbes"
+              + "     , COALESCE(x.afdeling, ' ') afdeling"
+              + "     , SUM(x.totaalbedrag) totaalbedrag"
+              + "     , SUM(x.inktotaalbedrag) inktotaalbedrag"
+              + "     , SUM(x.sum_satisfaction) sum_satisfaction"
+              + "     , SUM(x.cnt_satisfaction) cnt_satisfaction"
+              + (groupbes2
+                ? "     , x.sel2col sel2col"
+                : "")
+              + "     , AVG(x.oordeel) oordeel"
+              + " FROM (" + sql + ") x"
+              + " GROUP BY x.prs_afdeling_key"
+              + "        , x.afdeling"
+              + (groupbes2
+                ? "        , x.sel2col"
+                : "")
+              + " ORDER BY afdeling";

          var rst = new ResultsetTable({keyColumn: "prs_afdeling_key",
                                        ID: "bestable",
@@ -734,14 +766,15 @@ function bes_list (pautfunction, params)
        if (groupbes == 8)
        { // Aanvraag - Kostenplaats
          sql = "SELECT k.prs_kostenplaats_key"
-              + ", COUNT(b.bes_bestelling_key) aantalbes"
+              + ", b.bes_bestelling_key"
              + " , " + S("prs_kpn_string") + " kostenplaats"
              + " , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
              + " , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
              + select_oordeel;

          sql_group_by = " GROUP BY k.prs_kostenplaats_key"
-                       + ", " + S("prs_kpn_string");
+                       + "        , " + S("prs_kpn_string")
+                       + "        , b.bes_bestelling_key";

          if (groupbes2)
          {
@@ -791,7 +824,24 @@ function bes_list (pautfunction, params)
                         2,
                         sql_group_by);

-          sql += " ORDER BY 3";
+          sql = "SELECT x.prs_kostenplaats_key"
+              + "     , COUNT(x.bes_bestelling_key) aantalbes"
+              + "     , x.kostenplaats kostenplaats"
+              + "     , SUM(x.totaalbedrag) totaalbedrag"
+              + "     , SUM(x.inktotaalbedrag) inktotaalbedrag"
+              + "     , SUM(x.sum_satisfaction) sum_satisfaction"
+              + "     , SUM(x.cnt_satisfaction) cnt_satisfaction"
+              + "     , AVG(x.oordeel) oordeel"
+              + (groupbes2
+                ? "   , x.sel2col sel2col"
+                : "")
+              + " FROM (" + sql + ") x"
+              + " GROUP BY x.prs_kostenplaats_key"
+              + "        , x.kostenplaats"
+              + (groupbes2
+                ? "      , x.sel2col"
+                : "")
+              + " ORDER BY 3";

          var rst = new ResultsetTable({keyColumn: "prs_kostenplaats_key",
                                        sql: sql,
@@ -820,22 +870,22 @@ function bes_list (pautfunction, params)

        if ((groupbes == 10) || (groupbes == 11))
        { // District/Locatie -->
-          sql = "SELECT" + (groupbes == 10? " di.alg_district_key" : " l.alg_locatie_key")
-              + ", COUNT(b.bes_bestelling_key) aantalbes"
+          sql = "SELECT" + (groupbes == 10? " di.alg_district_key" : " l.alg_locatie_key") + " dlkey"
+              + "     , b.bes_bestelling_key"
              + (groupbes == 10
-                ? ", di.alg_district_omschrijving"
-                : ", l.alg_locatie_omschrijving")
-                + " dlomschrijving"
-              + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
-              + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
+                ? "   , di.alg_district_omschrijving"
+                : "   , l.alg_locatie_omschrijving") + " dlomschrijving"
+              + "     , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
+              + "     , SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
              + select_oordeel;

          sql_group_by = " GROUP BY"
                       + (groupbes == 10
                         ? " di.alg_district_key"
-                           + ", di.alg_district_omschrijving"
+                           + "    , di.alg_district_omschrijving"
                         : " l.alg_locatie_key"
-                           + ", l.alg_locatie_omschrijving");
+                           + "    , l.alg_locatie_omschrijving")
+                       + "        , b.bes_bestelling_key";

          if (groupbes2)
          {
@@ -883,12 +933,26 @@ function bes_list (pautfunction, params)
                         2,
                         sql_group_by);

-//          sql += " ORDER BY"
-//               + (groupbes == 10
-//                 ? " d.alg_district_omschrijving"
-//                 : " l.alg_locatie_omschrijving");
+          sql = "SELECT x.dlkey dlkey"
+              + "     , COUNT(x.bes_bestelling_key) aantalbes"
+              + "     , x.dlomschrijving dlomschrijving"
+              + "     , SUM(x.totaalbedrag) totaalbedrag"
+              + "     , SUM(x.inktotaalbedrag) inktotaalbedrag"
+              + "     , SUM(x.sum_satisfaction) sum_satisfaction"
+              + "     , SUM(x.cnt_satisfaction) cnt_satisfaction"
+              + "     , AVG(x.oordeel) oordeel"
+              + (groupbes2
+                ? "     , x.sel2col sel2col"
+                : "")
+              + " FROM (" + sql + ") x"
+              + " GROUP BY x.dlkey"
+              + "        , x.dlomschrijving"
+              + (groupbes2
+                ? "        , x.sel2col"
+                : "")
+              + " ORDER BY dlomschrijving";

-          var rst = new ResultsetTable({keyColumn: (groupbes == 10? "alg_district_key" : "alg_locatie_key"),
+          var rst = new ResultsetTable({keyColumn: "dlkey",
                                        ID: "bestable",
                                        sql: sql,
                                        filterParams: params,
@@ -913,7 +977,7 @@ function bes_list (pautfunction, params)
        }

        if ((groupbes == 12) || (groupbes == 3) || (groupbes == 4) || (groupbes == 5))
-        { // Geen - Aanvraag - Catalogus/Aanvraag - Groep/Aanvraag - Item
+        { // Geen/Aanvraag - Catalogus/Aanvraag - Groep/Aanvraag - Item
          if (groupbes == 12) // Geen
          {
            sql = "SELECT b.bes_bestelling_key"
@@ -933,15 +997,16 @@ function bes_list (pautfunction, params)

          if (groupbes == 3) // op catalogus
          {
-            sql = "SELECT dis.ins_discipline_key"
-                + ", "+ lcl.xsqla('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
-                + ", COUNT(*) aantalbes"
+            sql = "SELECT dis.ins_discipline_key ins_discipline_key"
+                + ", " + lcl.xsqla('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
+                + ", b.bes_bestelling_key"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
                + select_oordeel;

            sql_group_by = " GROUP BY dis.ins_discipline_key"
-                         + ", "+ lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key');
+                         + ", " + lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
+                         + ", b.bes_bestelling_key";
          }

          if (groupbes == 4) // op groep
@@ -949,14 +1014,15 @@ function bes_list (pautfunction, params)
            sql = "SELECT grp.bes_srtgroep_key"
                + ", "+ lcl.xsqla('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
                + ", "+ lcl.xsqla('grp.bes_srtgroep_omschrijving','grp.bes_srtgroep_key')
-                + ", COUNT(*) aantalbes"
+                + ", b.bes_bestelling_key"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
                + select_oordeel;

            sql_group_by = " GROUP BY grp.bes_srtgroep_key"
                         + ", "+ lcl.xsql('grp.bes_srtgroep_omschrijving','grp.bes_srtgroep_key')
-                         + ", "+ lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key');
+                         + ", "+ lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
+                         + ", b.bes_bestelling_key";
          }

          if (groupbes == 5) // op artikel
@@ -966,7 +1032,7 @@ function bes_list (pautfunction, params)
                + ", "+ lcl.xsqla('grp.bes_srtgroep_omschrijving','grp.bes_srtgroep_key')
                + ", "+ lcl.xsqla('srt.bes_srtdeel_nr','srt.bes_srtdeel_key')
                + ", "+ lcl.xsqla('srt.bes_srtdeel_omschrijving','srt.bes_srtdeel_key')
-                + ", COUNT(*) aantalbes"
+                + ", b.bes_bestelling_key"
                + ", SUM(bi.bes_bestelling_item_aantal) aantalart"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_prijs, 0)) totaalbedrag"
                + ", SUM(bi.bes_bestelling_item_aantal * COALESCE(bi.bes_bestelling_item_inkprijs, 0)) inktotaalbedrag"
@@ -976,7 +1042,8 @@ function bes_list (pautfunction, params)
                         + ", "+ lcl.xsql('srt.bes_srtdeel_nr','srt.bes_srtdeel_key')
                         + ", "+ lcl.xsql('srt.bes_srtdeel_omschrijving','srt.bes_srtdeel_key')
                         + ", "+ lcl.xsql('grp.bes_srtgroep_omschrijving','grp.bes_srtgroep_key')
-                         + ", "+ lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key');
+                         + ", "+ lcl.xsql('dis.ins_discipline_omschrijving','dis.ins_discipline_key')
+                         + ", b.bes_bestelling_key";
          }

          if (groupbes2)
@@ -1030,7 +1097,54 @@ function bes_list (pautfunction, params)
          if (groupbes == 12)
            sql += " ORDER BY 1, 3, 4, 5";
          else
-            sql += " ORDER BY 2, 3, 4";
+          {
+            if (groupbes == 3)
+              sql_start = "SELECT x.ins_discipline_key"
+                        + "     , x.ins_discipline_omschrijving";
+            if (groupbes == 4)
+              sql_start = "SELECT x.bes_srtgroep_key"
+                        + "     , x.ins_discipline_omschrijving"
+                        + "     , bes_srtgroep_omschrijving";
+            if (groupbes == 5)
+              sql_start = "SELECT x.bes_srtdeel_key"
+                        + "     , x.ins_discipline_omschrijving"
+                        + "     , x.bes_srtgroep_omschrijving"
+                        + "     , x.bes_srtdeel_nr"
+                        + "     , x.bes_srtdeel_omschrijving"
+                        + "     , x.aantalart";
+
+            sql = sql_start
+                + "     , COUNT(x.bes_bestelling_key) aantalbes"
+                + "     , SUM(x.totaalbedrag) totaalbedrag"
+                + "     , SUM(x.inktotaalbedrag) inktotaalbedrag"
+                + "     , SUM(x.sum_satisfaction) sum_satisfaction"
+                + "     , SUM(x.cnt_satisfaction) cnt_satisfaction"
+                + "     , AVG(x.oordeel) oordeel"
+                + (groupbes2
+                  ? "     , x.sel2col sel2col"
+                  : "")
+                + "  FROM (" + sql + ") x";
+
+            if (groupbes == 3)
+              sql += " GROUP BY x.ins_discipline_key"
+                   + "        , x.ins_discipline_omschrijving";
+            if (groupbes == 4)
+              sql += " GROUP BY x.bes_srtgroep_key"
+                   + "        , x.ins_discipline_omschrijving"
+                   + "        , x.bes_srtgroep_omschrijving";
+            if (groupbes == 5)
+              sql += " GROUP BY x.bes_srtdeel_key"
+                   + "        , x.ins_discipline_omschrijving"
+                   + "        , x.bes_srtgroep_omschrijving"
+                   + "        , x.bes_srtdeel_nr"
+                   + "        , x.bes_srtdeel_omschrijving"
+                   + "        , x.aantalart";
+
+            sql += (groupbes2
+                   ? "        , x.sel2col"
+                   : "")
+                 + " ORDER BY 2, 3, 4";
+          }

          var keyCol = "";
          if (groupbes == 3)
@@ -1091,12 +1205,12 @@ function bes_list (pautfunction, params)

          if (rfo_key)
          {
-            sql_filter += " AND UPPER(b.bes_bestelopdr_id) LIKE " + safe.quoted_sql_wild(rfo_key + "%");
+            sql_filter += " AND UPPER(bo.bes_bestelopdr_id) LIKE " + safe.quoted_sql_wild(rfo_key + "%");
          }
          else
          {
            if (showordstatus)
-               sql_filter += " AND b.bes_bestelopdr_status IN (" + showordstatus + ")";
+               sql_filter += " AND bo.bes_bestelopdr_status IN (" + showordstatus + ")";

            if (showbesstatus) {
              sql_filter += " AND bi.bes_bestelopdr_item_key IN"
@@ -1109,10 +1223,10 @@ function bes_list (pautfunction, params)
            }

            if (requestor_key)
-              sql_filter += " AND b.prs_perslid_key = " + requestor_key;
+              sql_filter += " AND bo.prs_perslid_key = " + requestor_key;

            if (personfor_key)
-              sql_filter += " AND b.prs_perslid_key_voor = " + personfor_key;
+              sql_filter += " AND bo.prs_perslid_key_voor = " + personfor_key;

            if (kp)
            {
@@ -1130,9 +1244,9 @@ function bes_list (pautfunction, params)
            sql_filter += makeDisGroepItemsSql(catalogus_key, besgroep_key, item_key);

            if (supplier_key)
-              sql_filter += " AND b.prs_bedrijf_key = " + supplier_key;
+              sql_filter += " AND bo.prs_bedrijf_key = " + supplier_key;
            if (sql_date)
-              sql_filter += " AND b.bes_bestelopdr_datum" + sql_date;
+              sql_filter += " AND bo.bes_bestelopdr_datum" + sql_date;
            if (dep_key)
              sql_filter += " AND d.prs_afdeling_key = " + dep_key;
          }
@@ -1142,9 +1256,9 @@ function bes_list (pautfunction, params)
        { // Opdracht
          sql = "SELECT bbi.bes_bestelling_key"
              + ", NULL bes_bestelling_parentkey"  // doen we hier mee?
-              + ", b.bes_bestelopdr_key"
-              + ", b.bes_bestelopdr_id"
-              + ", bes_bestelopdr_datum"
+              + ", bo.bes_bestelopdr_key"
+              + ", bo.bes_bestelopdr_id"
+              + ", bo.bes_bestelopdr_datum"
              + ", (SELECT bst.bes_bestelling_retourvan_key"
              + "     FROM bes_bestelling bst"
              + ",         bes_bestelling_item bbi"
@@ -1153,8 +1267,8 @@ function bes_list (pautfunction, params)
              + ", prs_bedrijf_naam supplier"
              + ", " + S("prs_pers_string") + " besteller"
              + ", " + S("prs_dep_string") + " organisation"
-              + ", b.bes_bestelopdr_status"
-              + ", b.bes_bestelopdr_module"
+              + ", bo.bes_bestelopdr_status"
+              + ", bo.bes_bestelopdr_module"
              + ", dis.ins_discipline_key"
              + ", d.prs_afdeling_key"
              + ", (bi.bes_bestelopdr_item_aantal * bes_bestelopdr_item_prijs) totaalbedrag"  // klopt dit wel?
@@ -1163,13 +1277,14 @@ function bes_list (pautfunction, params)
              + ", di.alg_district_key"
              + ", di.alg_regio_key"
              + " FROM bes_bestelopdr_item bi"
-              + ", bes_bestelopdr b"
+              + ", bes_bestelopdr bo"
              + ", prs_bedrijf be"
              + ", prs_perslid p"
              + ", prs_v_afdeling d"
              // next lines: tbv 3D autorisatie mbt discipline(catalogus) en afdeling (organisatie)
              + ", prs_v_afdeling_boom boom"
              + ", bes_bestelling_item bbi"
+              + ", bes_bestelling b"
              + ", bes_srtdeel srt"
              + ", bes_srtgroep grp"
              + ", ins_tab_discipline dis"
@@ -1179,9 +1294,10 @@ function bes_list (pautfunction, params)
              + ", mld_adres adr"
              + ", alg_locatie l"
              + ", alg_district di"
-              + " WHERE be.prs_bedrijf_key = b.prs_bedrijf_key"
-              + " AND bi.bes_bestelopdr_key = b.bes_bestelopdr_key"
-              + " AND p.prs_perslid_key = b.prs_perslid_key" // MB--indien op aanvrager:: deze regel uitcommentarieren
+              + " WHERE b.bes_bestelling_key = bbi.bes_bestelling_key"
+              + " AND be.prs_bedrijf_key = bo.prs_bedrijf_key"
+              + " AND bi.bes_bestelopdr_key = bo.bes_bestelopdr_key"
+              + " AND p.prs_perslid_key = bo.prs_perslid_key" // MB--indien op aanvrager:: deze regel uitcommentarieren
              // MB--indien op aanvrager: add next 2 lines
              // + " and p.prs_perslid_key = bstl.prs_perslid_key "
              // + " and bstl.bes_bestelling_key = bbi.bes_bestelling_key"
@@ -1194,7 +1310,7 @@ function bes_list (pautfunction, params)
              + " AND srt.bes_srtgroep_key = grp.bes_srtgroep_key"
              + " AND grp.ins_discipline_key = dis.ins_discipline_key"
              // next 3 lines: 3D-autoriatie op district en locatie
-              + " AND b.mld_adres_key_lev = adr.mld_adres_key"
+              + " AND bo.mld_adres_key_lev = adr.mld_adres_key"
              + " AND adr.alg_locatie_key = l.alg_locatie_key"
              + " AND l.alg_district_key = dI.alg_district_key"
              + sql_filter;
@@ -1202,27 +1318,25 @@ function bes_list (pautfunction, params)
          sql += makeDisGroepItemsFilter(catalogus_key, besgroep_key, item_key);

          sql = "SELECT x.bes_bestelling_key"
-//              + ", x.bes_bestelling_parentkey"
-              + ", x.bes_bestelopdr_key"
-              + ", x.bes_bestelopdr_id"
-              + ", x.bes_bestelopdr_datum"
-              + ", x.bes_bestelling_retourvan_key"
-              + ", x.bes_bestelopdr_status"
-              + ", x.bes_bestelopdr_module"
-              + ", x.supplier"
-              + ", x.besteller"
-              + ", x.organisation"
-              + ", SUM(x.totaalbedrag) totaalbedrag"
-              + ", SUM(x.inktotaalbedrag) inktotaalbedrag"
-              + ", x.alg_locatie_key"
-              + ", x.alg_district_key"
-              + ", x.alg_regio_key"
-              + " FROM (" + sql + ") x"
-              + ", prs_v_afdeling_boom boom"
+              + "     , x.bes_bestelopdr_key"
+              + "     , x.bes_bestelopdr_id"
+              + "     , x.bes_bestelopdr_datum"
+              + "     , x.bes_bestelling_retourvan_key"
+              + "     , x.bes_bestelopdr_status"
+              + "     , x.bes_bestelopdr_module"
+              + "     , x.supplier"
+              + "     , x.besteller"
+              + "     , x.organisation"
+              + "     , SUM(x.totaalbedrag) totaalbedrag"
+              + "     , SUM(x.inktotaalbedrag) inktotaalbedrag"
+              + "     , x.alg_locatie_key"
+              + "     , x.alg_district_key"
+              + "     , x.alg_regio_key"
+              + "  FROM (" + sql + ") x"
+              + "     , prs_v_afdeling_boom boom"
              + " WHERE x.prs_afdeling_key = boom.prs_afdeling_key";

          sql_group_by = " GROUP BY x.bes_bestelling_key"
-//                       + ", x.bes_bestelling_parentkey"
                       + ", x.bes_bestelopdr_key"
                       + ", x.bes_bestelopdr_id"
                       + ", x.bes_bestelopdr_datum"
@@ -1295,22 +1409,23 @@ function bes_list (pautfunction, params)

        if (groupbes == 6)
        { // Opdracht - Leverancier
-          sql = "SELECT be.prs_bedrijf_key"
-              + ", be.prs_bedrijf_naam supplier"
-              + ", COUNT(*) aantal"
-              + ", SUM(bi.bes_bestelopdr_item_aantal * bi.bes_bestelopdr_item_prijs) totaalbedrag"  // klopt dit wel?
-              + ", SUM(bi.bes_bestelopdr_item_aantal * bi.bes_bestelopdr_item_inkprijs) inktotaalbedrag";
+          sql = "SELECT be.prs_bedrijf_key prs_bedrijf_key"
+              + "     , be.prs_bedrijf_naam supplier"
+              + "     , bo.bes_bestelopdr_key"
+              + "     , SUM(bi.bes_bestelopdr_item_aantal * bi.bes_bestelopdr_item_prijs) totaalbedrag"  // klopt dit wel?
+              + "     , SUM(bi.bes_bestelopdr_item_aantal * bi.bes_bestelopdr_item_inkprijs) inktotaalbedrag";

-          sql_group_by = " GROUP BY be.prs_bedrijf_key, be.prs_bedrijf_naam";
+          sql_group_by = " GROUP BY be.prs_bedrijf_key, be.prs_bedrijf_naam, bo.bes_bestelopdr_key";

          sql += " FROM bes_bestelopdr_item bi"
-               + ", bes_bestelopdr b"
+               + ", bes_bestelopdr bo"
               + ", prs_bedrijf be"
               + ", prs_perslid p"
               + ", prs_v_afdeling d"
               // next line: tbv 3D autorisatie mbt discipline(catalogus) en afdeling (organisatie)
               + ", prs_v_afdeling_boom boom"
               + ", bes_bestelling_item bbi"
+               + ", bes_bestelling b"
               + ", bes_srtdeel srt"
               + ", bes_srtgroep grp"
               + ", ins_tab_discipline dis"
@@ -1318,9 +1433,10 @@ function bes_list (pautfunction, params)
               + ", alg_locatie l"
               + ", alg_district di";

-          sql += " WHERE be.prs_bedrijf_key = b.prs_bedrijf_key"
-               + " AND bi.bes_bestelopdr_key = b.bes_bestelopdr_key"
-               + " AND p.prs_perslid_key = b.prs_perslid_key"
+          sql += " WHERE b.bes_bestelling_key = bbi.bes_bestelling_key"
+               + " AND be.prs_bedrijf_key = bo.prs_bedrijf_key"
+               + " AND bi.bes_bestelopdr_key = bo.bes_bestelopdr_key"
+               + " AND p.prs_perslid_key = bo.prs_perslid_key"
               // next 2 lines: 3D-autoriatie op organisatie
               + " AND p.prs_afdeling_key = d.prs_afdeling_key"
               + " AND d.prs_afdeling_key = boom.prs_afdeling_key"
@@ -1329,7 +1445,7 @@ function bes_list (pautfunction, params)
               + " AND bbi.bes_srtdeel_key = srt.bes_srtdeel_key"
               + " AND srt.bes_srtgroep_key = grp.bes_srtgroep_key"
               + " AND grp.ins_discipline_key = dis.ins_discipline_key"
-               + " AND b.mld_adres_key_lev = adr.mld_adres_key"
+               + " AND bo.mld_adres_key_lev = adr.mld_adres_key"
               + " AND adr.alg_locatie_key = l.alg_locatie_key"
               + " AND l.alg_district_key = dI.alg_district_key";

@@ -1351,9 +1467,15 @@ function bes_list (pautfunction, params)
                         2,
                         sql_group_by);

-//          sql += " ORDER BY prs_bedrijf_naam"
-//               + ", aantal"
-//               + ", totaalbedrag DESC";
+          sql = "SELECT x.prs_bedrijf_key"
+              + "     , x.supplier supplier"
+              + "     , COUNT (x.bes_bestelopdr_key) aantal"
+              + "     , SUM (x.totaalbedrag) totaalbedrag"
+              + "     , SUM (x.inktotaalbedrag) inktotaalbedrag"
+              + "  FROM (" + sql + ") x"
+              + " GROUP BY x.prs_bedrijf_key"
+              + "        , x.supplier"
+              + " ORDER BY supplier";

          var rst = new ResultsetTable({keyColumn: "prs_bedrijf_key",
                                        sql: sql,
@@ -1601,8 +1723,6 @@ function bes_list (pautfunction, params)

        if (rfo_key)
        {
-          // TODO: een decode oid, als er eentje met parent is, willen we die zonder niet zien
-          // niet hier overigens, maar in de where.
          sql += " AND COALESCE(b.bes_bestelling_parentkey, b.bes_bestelling_key) = " + rfo_key;
        }
        else
@@ -1701,20 +1821,19 @@ function bes_list (pautfunction, params)
        function fnrowActionEnablerFOBO(oRs)
        {
          var eEdit   = true; // Altijd aanwezig
-          var eAccept = false;
-          var eReject = false;
-          var eSubmit = false;
          var m_stat = oRs("bes_bestelling_status").value;
-
-          if (backo)
-          { // SEE NOTE A
-            eAccept = (m_stat == 3);
-            eReject = (m_stat == 3);
-            // Gathering of RFOs is not switched on yet
-            eSubmit = (m_stat == 4 && !oRs("isordered").value);
+          if (m_stat == 3) // func_enabled_bestelling is traag, alleen als echt noodzakelijk
+          {
+            // We weten al dat we mogen lezen. Geef dat mee aan func_enabled_bestelling, die wordt daar efficienter van
+            var bes_bestelling = bes.bestelling_info(oRs("bes_bestelling_key").Value);
+            var this_bes = bes.func_enabled_bestelling(bes_bestelling, { knownread: true });
+            var eAccept = this_bes.canAccept || this_bes.canAccept2 || this_bes.canAccept3 || this_bes.canAccept4 || this_bes.canAccept5;
+            var eReject = this_bes.canReject;
          }
+          var eSubmit = (m_stat == 4 && !oRs("isordered").value); // eigenlijk this_bes.canSubmit maar we hebben niet
+                                                                  // altijd bes.func_enabled_bestelling gedaan

-          var data = {eAccept:eAccept, eReject:eReject, eEdit:eEdit, eSubmit:eSubmit};
+          var data = {eAccept: eAccept, eReject: eReject, eEdit: eEdit, eSubmit: eSubmit};

          return data;
        }
--- a/APPL/BES/bes_reject.asp
+++ b/APPL/BES/bes_reject.asp
@@ -36,7 +36,7 @@ for (var i = 0; i < bes_key_arr.length; i++)
  var bes_bestelling = bes.bestelling_info(bes_key_arr[i]); // Globale variabele met alle bes_bestelling informatie
  var bes_disc_info = bes.disc_info(bes_bestelling.dis_key); // alle discipline informatie
  var this_bes = bes.func_enabled_bestelling(bes_bestelling);
-  if (this_bes.canApprove || this_bes.canAccept) // Als je mag accepteren mag je ook rejecten
+  if (this_bes.canApprove || this_bes.canReject) // Als je mag fiatteren mag je ook rejecten
  {
    ingesloten.push(bes_key_arr[i]);
    if (bes_bestelling.parent_key)
--- a/APPL/BES/bes_search.asp
+++ b/APPL/BES/bes_search.asp
@@ -86,7 +86,7 @@ var supplier = getQParamInt("supplier", -1); // Leverancier
 var groupby = getQParamInt("groupby", 0); // Groepering 1 (Aanvraag (key = 0) is default)
 var groupby2 = getQParamInt("groupby2", -1); // Groepering 2
 var rfo_key = getQParamInt("rfo_key", ""); // Aanvraag nummer (rfo key, request for order)
-var rfostatus_key_arr = getQParamIntArray("rfostatus", [2,3,4,5,6,7,8]); // Aanvraag status string
+var rfostatus_key_arr = getQParamIntArray("rfostatus", [2,3,4,5,6,7]); // Aanvraag status string
 var order_key = getQParamInt("order_key", ""); // Opdracht nummer
 var orderstatus_key_arr = getQParamIntArray("orderstatus", []); // Opdracht status string
 var prs_key = getQParamInt("prs_key", -1); // Aanvrager (Requestor_key)
--- a/APPL/BES/bes_show_bestelling.asp
+++ b/APPL/BES/bes_show_bestelling.asp
@@ -128,6 +128,18 @@ var buttons =  [];
  if (this_bes.canChange)
    buttons.push({title: L("lcl_change"), icon: "wijzigen.png", action: "bes_change()"});

+  if (this_bes.canAccept ||
+      this_bes.canAccept2 ||
+      this_bes.canAccept3 ||
+      this_bes.canAccept4 ||
+      this_bes.canAccept5)
+  {
+    buttons.push({ icon: "accept.png", title: L("lcl_approve"), action: "bes_accept()" });
+  }
+
+  if (this_bes.canReject)
+    buttons.push({ icon: "reject.png", title: L("lcl_reject"), action: "bes_reject()" });
+
  if (bes_bestelling.fac_activiteit_key == -1)
  {
    if (this_bes.canDelete)
@@ -218,9 +230,21 @@ var show_price = '<%=show_price%>';
 var lower = false;
 var inclBTW = <%=bes_bestelling.inclBTW%> == 1;

+function bes_accept()
+{
+  if (confirm(L("lcl_bes_accepteren1").format("<%=bes_key%>")))
+  {
+    $.post("bes_accept.asp",
+           { urole: "<%=urole%>",
+             bes_key: <%=bes_key%> },
+           FcltCallbackRefresh,
+           "json");
+  }
+}
+
 function bes_approve()
 {
-  if (confirm(L("lcl_bes_approve_1") + "<%=bes_key%>" + L("lcl_bes_approve_2")))
+  if (confirm(L("lcl_bes_approve").format("<%=bes_key%>")))
  {
    var data = { bes_key: <%=bes_key%>
               };
--- a/APPL/BES/bes_srtdeel_search_list.asp
+++ b/APPL/BES/bes_srtdeel_search_list.asp
@@ -39,7 +39,7 @@ var authparams = user.checkAutorisation("WEB_BESMSU");
        function bes_new()
        {
          <% if (disc_key<0) { %>
-            alert(L("lcl_Filter eerst op catalogus"));
+            alert(L("lcl_bes_srtdeel_need_cat"));
          <% } else {
            var addurl = "appl/bes/bes_srtdeel.asp?disc_key=" + disc_key;
          %>
--- a/APPL/BES/opdr_delivery.asp
+++ b/APPL/BES/opdr_delivery.asp
@@ -54,7 +54,7 @@ user.auth_required_or_abort(this_bestelopdr.canDeliver);
    var besopdr_id = "";
    for (i = 0; i < max_o_i; i++)
    {
-      ontv = getFParamInt('cnt' + i);
+      ontv = getFParamInt('cnt' + i, 0);
      oldcnt = getFParamInt('amto' + i);
      bokey = getFParamInt('bokey' + i);
      bikey = getFParamInt('bi_key' + i);
--- a/APPL/BEZ/bez_edit_afspraak.asp
+++ b/APPL/BEZ/bez_edit_afspraak.asp
@@ -58,6 +58,7 @@ if (afspr_key > 0)

 var timeBeginInitEmpty = false;
 var timeEindInitEmpty = false;
+var actie_key = -1;
 if (afspr_key < 0)
 { // defaults zetten
  contact_key = user_key;
@@ -105,7 +106,15 @@ if (afspr_key < 0)
  {
    timeEindInitEmpty = true;
  }
-  actie_key = -1;
+
+  // Is er een default actie.
+  var sql = "SELECT bez_actie_key"
+          + "  FROM bez_actie"
+          + " WHERE bez_actie_verwijder IS NULL"
+          + "   AND bez_actie_default = 1";
+  var oRs = Oracle.Execute(sql);
+  if (!oRs.eof)
+    actie_key = oRs("bez_actie_key").Value;

  locatie_key = user.alg_locatie_key();
  gebouw_key = user.alg_gebouw_key();
@@ -120,22 +129,24 @@ if (afspr_key < 0)
 }
 else
 {
-  sql = "SELECT ba.bez_afspraak_gastheer gastheer"
-      + "     , ba.bez_afspraak_telefoonnr"
-      + "     , ba.bez_afspraak_datum"
-      + "     , ba.bez_afspraak_eind"
-      + "     , ba.bez_actie_key actie_key"
-      + "     , ba.bez_afspraak_ruimte"
-      + "     , ba.bez_afspraak_opmerking"
-      + "     , ba.alg_locatie_key locatie_key"
-      + "     , ba.alg_onrgoed_keys alg_onrg_key"
-      + "     , ba.bez_afspraak_host_key gastheer_key"
-      + "     , bez_afspraak_contact_key contact_key"
-      + "     ," + S("prs_pers_string") + " aanvrager"
-      + " FROM bez_afspraak ba, prs_perslid p"
-      + " WHERE ba.bez_afspraak_key = " + afspr_key
-      + "   AND p.prs_perslid_key = bez_afspraak_contact_key";
+  var sql = "SELECT ba.bez_afspraak_gastheer gastheer"
+          + "     , ba.bez_afspraak_telefoonnr"
+          + "     , ba.bez_afspraak_datum"
+          + "     , ba.bez_afspraak_eind"
+          + "     , ba.bez_actie_key actie_key"
+          + "     , ba.bez_afspraak_ruimte"
+          + "     , ba.bez_afspraak_opmerking"
+          + "     , ba.alg_locatie_key locatie_key"
+          + "     , ba.alg_onrgoed_keys alg_onrg_key"
+          + "     , ba.bez_afspraak_host_key gastheer_key"
+          + "     , bez_afspraak_contact_key contact_key"
+          + "     ," + S("prs_pers_string") + " aanvrager"
+          + " FROM bez_afspraak ba, prs_perslid p"
+          + " WHERE ba.bez_afspraak_key = " + afspr_key
+          + "   AND p.prs_perslid_key = bez_afspraak_contact_key";
  oRs = Oracle.Execute(sql);
+  if (oRs.Eof)
+    shared.record_not_found("<!--" + afspr_key + "-->");

  gastheer = oRs("gastheer").value;
  contact_key = oRs("contact_key").value;
@@ -326,7 +337,9 @@ else
        FCLTselector("actie",
                     sql,
                     { label: L("lcl_action"),
-                       initKey: actie_key
+                       initKey: actie_key,
+                       emptyOption: afspr_key < 0 && actie_key < 0? "" : null,
+                       required: true
                     }
                    )
        RWTEXTAREATR("remark", "fldtxt", L("lcl_vis_remark"), afspr_key == -1? "" : opm);
--- a/APPL/BEZ/bez_edit_afspraak_save.asp
+++ b/APPL/BEZ/bez_edit_afspraak_save.asp
@@ -280,6 +280,13 @@ if (S("vis_warning_limit") != -1)
  }
 }

+// Klantspecifieke check functie (hookfunction) voor de invoer
+var pResult = new HookResult();
+if (!custfunc.bez_postsave(result.bezkeyArr, pResult))
+{
+  abort_with_warning(pResult.errmsg);
+}
+
 var closeParams = { afspr_key: afspr_key,
                    bezkeyArr: result.bezkeyArr,
                    verynew: verynew == 1,
--- a/APPL/BEZ/bez_edit_bezoekers_save.asp
+++ b/APPL/BEZ/bez_edit_bezoekers_save.asp
@@ -105,6 +105,13 @@ if (isRes && appointmentisdeleted)
  }
 }

+// Klantspecifieke check functie (hookfunction) voor de invoer
+var pResult = new HookResult();
+if (!custfunc.bez_postsave(result.bezkeyArr, pResult))
+{
+  abort_with_warning(pResult.errmsg);
+}
+
 var closeParams = { afspraak_key: afspraak_key,
                    bezkeyArr: result.bezkeyArr,
                    warning: result.warning
--- a/APPL/BEZ/bez_show_bezoekers.asp
+++ b/APPL/BEZ/bez_show_bezoekers.asp
@@ -48,15 +48,19 @@ else

 if (afspraak_key == -1) // deeplink met bezoeker ondersteunen
 {                       // vanuit Pacta of vanuit Outlook
-  var bez_naam_arr = getQParamArray("bez_naam", "");
+  var bez_naam_arr = getQParamArray("bez_naam", "", true); // De individuele QParams niet splitsen bij komma
  var bez_bedrijf = getQParam("bez_bedrijf", ""); // wel allemaal hetzelfde bedrijf
-  for (var i=0; i < bez_naam_arr.length; i++)
+  var outlook_organizer = (getQParam("host_key", -1) == -1);
+  var start_index = ((getQParam("host_key", -1) == -1) ? 1 : 0); // host_key wordt alleen vanuit Pacta meegegeven.
+  // Als er geen host_key is, dan komen de namen in bez_naam_arr uit Outlook. De eerste in de lijst is de organisator.
+  // Die mag niet in de bezoekerslijst staan, want dat ben jezelf.
+  for (var i=start_index; i < bez_naam_arr.length; i++)
  {
    var result =
      saveOneBezoeker(afspraak_key, rsv_ruimte_key, -1 /* volg */,
                        { urole: urole, naam: bez_naam_arr[i], bedrijf: bez_bedrijf,
                          noValidateToken: true
-                             });
+                        });
    afspraak_key = result.afspr_key;
  }
 }
--- a/APPL/CAD/3Dize.asp
+++ b/APPL/CAD/3Dize.asp
@@ -15,7 +15,7 @@
 <!--#include file="../slnkdwf/Slnk2IMG.inc" -->
 <%
  FCLTHeader.Requires({ plugins: ["jQuery"],
-                        js: ["jquery-ui.js", "./js/three.js", "./js/Detector.js", "./js/loaders/ColladaLoader.js"],
+                        js: ["jquery-ui.js", "./js/three.js", "./js/Detector.js"],
                        css: []});

  // Jos's PC WebGL kan maximaal 2048 in een richting aan
@@ -70,6 +70,8 @@
 		<script>
 var gSLNKEvent;
 var gCustomParameters; // wat er inhoudelijk getoond moet worden (verdieping, thema's etc)
+var gimgurl;
+
 var offsetX=<%=offsetX%>;
 var offsetY=<%=offsetY%>;
 var scale=<%=scl%>;
@@ -86,6 +88,8 @@ function SetCustomParameters(custParams)

 function Refresh(actual)
 {
+    document.removeEventListener( 'mousedown', onDocumentMouseDown, false );  // Even geen onclicks
+
    init();
 }

@@ -114,7 +118,9 @@ function zoom2DWG(centerX, centerY, newScale)
    offsetY = Math.round((centerY - autoMaxY) * newScale + vpix/2);
    scale = Math.round(1000.0 / currScale * newScale);
 }
-
+function noAutoResize()
+{
+}
 			if ( ! Detector.webgl ) Detector.addGetWebGLMessage();

 			var SCREEN_WIDTH = window.innerWidth;
@@ -134,6 +140,37 @@ function zoom2DWG(centerX, centerY, newScale)
                        allCast(elm.children[i]);
            }

+            // http://stackoverflow.com/questions/15248872/dynamically-create-2d-text-in-three-js
+            var projector = new THREE.Projector();
+            // image XY to canvasXY to 3D
+            function toXYCoords (imgX, imgY)
+            {
+                    var imgPos = new THREE.Vector3(imgX - hpix / 2, vpix / 2 - imgY, 10)
+                    camera.lookAt( scene.position );
+    				camera.rotation.z = <%= safe.jsfloat(rot) %>;
+
+                    camera.updateMatrixWorld();
+                    var vector = projector.projectVector(imgPos.clone(), camera);
+                    vector.x = (vector.x + 1)/2 * window.innerWidth;
+                    vector.y = -(vector.y - 1)/2 * window.innerHeight;
+                    return vector;
+            }
+            // 3D to canvas XY to imageXY
+            function fromXYCoords (vector)
+            {   var projector = new THREE.Projector();
+
+				projector.unprojectVector( vector, camera );
+                var dir = vector.sub( camera.position ).normalize();
+                var distance = - camera.position.z / dir.z;
+                var pos = camera.position.clone().add( dir.multiplyScalar( distance ) );
+
+				//alert("Image pos.X=" + pos.x + " pos.Y=" + pos.y);
+
+                var imgX = pos.x + hpix / 2;
+                var imgY = vpix / 2 - pos.y;
+                return { x: imgX, y: imgY };
+            }
+
 			function init() {

 				container = document.createElement( 'div' );
@@ -151,7 +188,7 @@ function zoom2DWG(centerX, centerY, newScale)
 				// GROUND

 				// PAINTING
-                var imgurl = "../CAD/mySlnk2IMG.asp?labelPos=2" + gCustomParameters
+                gimgurl = "../CAD/mySlnk2IMG.asp?labelPos=2" + gCustomParameters
                           + "&sizeX="+hpix+"&sizeY="+vpix + "&labelrot=<%=labelrot%>"
                           + "&offsetX="+offsetX+"&offsetY="+offsetY+"&scale="+scale+"&paperColor=16777214";

@@ -173,22 +210,8 @@ function zoom2DWG(centerX, centerY, newScale)

 				    //mesh.receiveShadow = true;

-					$.getJSON(imgurl + "&AsMap=1",  { }, callbackWalls );
+					$.getJSON(gimgurl + "&AsMap=1",  { }, callbackWalls );
                }
-
-                // http://stackoverflow.com/questions/15248872/dynamically-create-2d-text-in-three-js
-                var projector = new THREE.Projector();
-                function toXYCoords (pos) {
-                        camera.lookAt( scene.position );
-        				camera.rotation.z = <%= safe.jsfloat(rot) %>;
-
-                        camera.updateMatrixWorld();
-                        var vector = projector.projectVector(pos.clone(), camera);
-                        vector.x = (vector.x + 1)/2 * window.innerWidth;
-                        vector.y = -(vector.y - 1)/2 * window.innerHeight;
-                        return vector;
-                }
-
                function drawBord(imgX, imgY, tekst)
                {
                    //console.log("Bord: " + tekst+  " x=" + imgX + " y=" + imgY)
@@ -204,8 +227,7 @@ function zoom2DWG(centerX, centerY, newScale)
                    //text2.style.zIndex = 1;    // if you still don't see the label, try uncommenting this

                    text2.innerHTML = tekst;
-                    var imgPos = new THREE.Vector3(x0 - image.width / 2, image.height / 2 - y0, 10)
-                    var pos = toXYCoords(imgPos);
+                    var pos = toXYCoords(x0, y0);
                    // Eigenlijk willen we centreren maar ik weet de breedte van het bord niet.
                    text2.style.top = pos.y - 20 + "px";
                    text2.style.left = pos.x - 40 + "px";
@@ -226,7 +248,7 @@ function zoom2DWG(centerX, centerY, newScale)
                    //img.style.zIndex = 1;    // if you still don't see the label, try uncommenting this

                    var imgPos = new THREE.Vector3(imgX - image.width / 2, image.height / 2 - imgY, 10)
-                    var pos = toXYCoords(imgPos);
+                    var pos = toXYCoords(imgX, imgY);
                    // Eigenlijk willen we centreren maar ik weet de grootte van het symbool niet.
                    img.style.top = pos.y + "px";
                    img.style.left = pos.x + "px";
@@ -305,16 +327,16 @@ function zoom2DWG(centerX, centerY, newScale)
    				}

    				// Werkplekken
-                    var loader = new THREE.ColladaLoader();
+//                  var loader = new THREE.ColladaLoader();

-                    loader.load('./models/Desk.dae.txt', function (result)
-                    {
-                      var werkplekSymbol = result.scene;
-                      allCast(werkplekSymbol);
+//                    loader.load('./models/Desk.dae.txt', function (result)
+//                    {
+//                      var werkplekSymbol = result.scene;
+//                      allCast(werkplekSymbol);

                      //alert(werkplekSymbol.scale.x); // default is 0.0254 ?
-                      werkplekSymbol.scale.set(25.4 / gSLNKEvent.scaleX , 25.4 / gSLNKEvent.scaleX, 25.4 / gSLNKEvent.scaleX);
-                      werkplekSymbol.rotation.set(0, 0, Math.PI / 4);
+//                      werkplekSymbol.scale.set(25.4 / gSLNKEvent.scaleX , 25.4 / gSLNKEvent.scaleX, 25.4 / gSLNKEvent.scaleX);
+//                      werkplekSymbol.rotation.set(0, 0, Math.PI / 4);
                      //var mat = new THREE.MeshLambertMaterial( { map: modelTex });

                      // Coordinaten werkplekken
@@ -394,7 +416,7 @@ function zoom2DWG(centerX, centerY, newScale)
                                render(); // Alles klaar, renderen!!!
                        });

-                    });
+//                    });

    				// Lights

@@ -411,7 +433,7 @@ function zoom2DWG(centerX, centerY, newScale)
 				};

                // Hier begint de echte init() code
-                var png = imgurl;
+                var png = gimgurl;
                var TIMU = THREE.ImageUtils;
                TIMU.crossOrigin = null; // Anders wordt voor de IMG-request geen ASP-session meegestuurd
                                         // door Chrome en is het plaatje direct 'expired'
@@ -428,7 +450,6 @@ function zoom2DWG(centerX, centerY, newScale)
 				container.appendChild( renderer.domElement );

 				document.addEventListener( 'mousemove', onDocumentMouseMove, false );
-				document.addEventListener( 'mousedown', onDocumentMouseDown, false );
 				$(document).on( "mousewheel DOMMouseScroll", function(e){
                    e.preventDefault();
                    var delta = e.originalEvent.wheelDelta;
@@ -454,14 +475,25 @@ function zoom2DWG(centerX, centerY, newScale)
 				}
 			}

+            function callbackClicked(data)
+            {
+                //alert(data.ContourLabel);
+                data.Param = "onclick";
+                parent.MMap_onClick(data);
+            }
 			function onDocumentMouseDown( event ) {

 				event.preventDefault();

 				var vector = new THREE.Vector3( ( event.clientX / window.innerWidth ) * 2 - 1, - ( event.clientY / window.innerHeight ) * 2 + 1, 0.5 );
-				//alert("Geklikt X=" + event.clientX + " Y=" + event.clientY);
-				//alert("Geklikt X=" + vector.x + " Y=" + vector.y);
+				var xy = fromXYCoords(vector)

+                var imgX = xy.x;
+                var imgY = xy.y;
+
+				//alert("Image imgX=" + imgX + " imgX=" + imgY);
+
+                $.getJSON(gimgurl + "&AsFND=1&findX=" + imgX + "&findY=" + imgY, callbackClicked );
    		}

 			function render() {
@@ -471,6 +503,8 @@ function zoom2DWG(centerX, centerY, newScale)

 				renderer.render( scene, camera );

+                // Onderstaande niet te vroeg doen, anders kloppen de coordinaten bij onclick mogelijk niet goed
+				document.addEventListener( 'mousedown', onDocumentMouseDown, false );
 			}

 // Dee moet eigenlijk naar ToonIMG.js
--- a/APPL/CAD/InfoBord.asp
+++ b/APPL/CAD/InfoBord.asp
@@ -223,7 +223,11 @@ if (fac_usrrap_key > -1)

      function MMap_onClick(SlnkEvent)
      {
-        // TODO: Doorgeven aan refresher.asp dat hij even geen reload moet doen resetReload();
+        // Voorkom dat de popup verdwijnt door de reload. Laat wel een timeout staan zodat
+        // het scherm uiteindelijk zich wel ververst als iemand wegloopt met open popup
+        if (parent.resetReload)
+            parent.resetReload();
+
        switch (SlnkEvent.Param)
        {
          case "onclick":
@@ -237,8 +241,7 @@ if (fac_usrrap_key > -1)
                var intKey = parseInt(SlnkEvent.Key.substring(2),10);
                window.ins_key = intKey; // onthouden
                window.alg_ruimte_key = -1
-                myRefresh();
-                var url = "../pda/reserveringen.asp?qrc=1&ins_key=" + intKey;
+                var url = "../pda/reserveringen.asp?qrc=1&modal=1&ins_key=" + intKey;
                // alwaysCall zetten lijkt niet genoeg: die reageert niet op het kruisje? alwaysCallbackParams: {} werkt wel
                MMap.noAutoResize(true); // rustiger
                FcltMgr.openModalDetail(url, "", { callback: callback_reserved, alwaysCallbackParams: {}, xnoClose: true });
@@ -250,8 +253,7 @@ if (fac_usrrap_key > -1)
                var alg_ruimte_key = SlnkEvent.Key;
                window.ins_key = -1;
                window.alg_ruimte_key = alg_ruimte_key; // onthouden
-                myRefresh();
-                var url = "../pda/reserveringen.asp?qrc=1&alg_ruimte_key=" + alg_ruimte_key;
+                var url = "../pda/reserveringen.asp?qrc=1&modal=1&alg_ruimte_key=" + alg_ruimte_key;
                MMap.noAutoResize(true); // rustiger
                FcltMgr.openModalDetail(url, "", { callback: callback_reserved, alwaysCallbackParams: {}, xnoClose: true });
                MMap.noAutoResize(false);
@@ -289,6 +291,7 @@ if (fac_usrrap_key > -1)
 var /*global*/ resizeTimerID=null;
      function init()
      {
+// IE11?      window.MMap = document.getElementById("MMap");
        resizeIframes();
        resetMap();
        myRefresh();
--- a/APPL/CAD/LoadInsNew.asp
+++ b/APPL/CAD/LoadInsNew.asp
@@ -33,7 +33,7 @@ sql = "SELECT " + lcl.xsqla('isg.ins_srtgroep_omschrijving', 'isg.ins_srtgroep_k
    + "   AND ins_srtdeel_acadsymbol IS NOT NULL"
    + "   AND isg.ins_discipline_key IN (" + pDiscs_arr.join(",") + ")"
    + "   AND idd.ins_discipline_key = isg.ins_discipline_key"
-    + "   AND fac_functie_code = '" + (scenario_key <= 0? 'WEB_INSMAN' : 'WEB_INSPRJ') + "'"
+    + "   AND fac_functie_code = " + safe.quoted_sql(scenario_key <= 0? 'WEB_INSMAN' : 'WEB_INSPRJ')
    + "   AND fac_gebruiker_alg_level_write < 9"
    + "   AND ins_srtdeel_verwijder IS NULL"
    + " ORDER BY UPPER(" + lcl.xsql('isg.ins_srtgroep_omschrijving', 'isg.ins_srtgroep_key') + "), UPPER(" + lcl.xsql('isd.ins_srtdeel_omschrijving', 'isd.ins_srtdeel_key') + ")";
--- a/APPL/CAD/Symbols.inc
+++ b/APPL/CAD/Symbols.inc
@@ -39,7 +39,7 @@ function canWriteInsDeel(deel_key, vKey, scenario_key)
             + " WHERE w.ins_discipline_key =  " + disc_key
             + "   AND w.fac_functie_key = f.fac_functie_key "
             + "   AND w.prs_perslid_key = " + user_key
-             + "   AND fac_functie_code = '" + (scenario_key <= 0? 'WEB_INSMAN' : 'WEB_INSPRJ') + "'";
+             + "   AND fac_functie_code = " + safe.quoted_sql(scenario_key <= 0? 'WEB_INSMAN' : 'WEB_INSPRJ');
    var oRs = Oracle.Execute(sql);
    if (oRs.eof)
        return false; // Geen rechten
--- a/APPL/CAD/cad_contour_search_list.asp
+++ b/APPL/CAD/cad_contour_search_list.asp
@@ -26,7 +26,7 @@ var showall = getQParamInt("showall", 0) == 1;
 var loc_key = getQParamInt("locatiekey", -1); // Locatie
 var bld_key = getQParamInt("gebouwkey", -1); // Gebouw
 var flr_key = getQParamInt("verdiepingkey", -1); // verdieping
-var bttype = getQParam("bttype", "");
+var bttype = getQParamSafe("bttype", "");
 var concept = getQParamInt("concept", 0) == 1;


--- a/APPL/CAD/cad_verify.asp
+++ b/APPL/CAD/cad_verify.asp
@@ -129,7 +129,10 @@ xd = new ActiveXObject("SLNKDWF.DWFFile");
 xd.Open(fullnameDWF)

 xc = new ActiveXObject("SLNKDWF.Whip2PNG")
-xc.LoadStream(xd.EplotSections.Item(0))
+if (xd.EplotSections.Count == 0)
+    xc.Load(fullnameDWF);
+else
+    xc.LoadStream(xd.EplotSections.Item(0));
 //xc.Maximize=true
 //xc.dwgScale=10
 xc.SetDimensions(1200,800, 0, 0, 1, 180)
@@ -140,14 +143,17 @@ var layers = [];
 for (i = 0; i < xc.layercount; i++)
    layers[xc.LayerItem(i)] = 1;

-function analyze(stream, contlayer, labellayer)
+function analyze(contlayer, labellayer)
 {
    var y = new ActiveXObject("SLNKDWF.WhipFile")
    var opt = new ActiveXObject("SLNKDWF.Options")
    opt.SetOption("MINCONTSIZE", 4e6) // 1 vierkante meter

    y.SetLayers("^"+contlayer.replace(/\|/g,"\\|")+"$", "^"+ labellayer.replace(/\|/g,"\\|")+"$")
-    y.LoadStream(xd.EplotSections.Item(0))
+    if (xd.EplotSections.Count == 0)
+        y.Load(fullnameDWF);
+    else
+        y.LoadStream(xd.EplotSections.Item(0));

    var result = { nCont: y.ContourCount,
                   Labels: [],
@@ -203,7 +209,7 @@ Response.Write("<tr><th>fg_contlayer</th><th>#cont</th><th>fg_labellayer</th><th
 var lastcont="";
 for (contlayer in layers)
 {
-    var res = analyze(xd.EplotSections.Item(0), contlayer, ".*")
+    var res = analyze(contlayer, ".*")
    if (res.nCont)
    {
        contlayers.push({ l: contlayer, n: res.nCont});
@@ -212,7 +218,7 @@ for (contlayer in layers)
 }
 for (labellayer in layers)
 {
-    var res = analyze(xd.EplotSections.Item(0), ".*", labellayer, ".*")
+    var res = analyze(".*", labellayer, ".*")
    if (res.Labels.length)
    {
        labellayers.push({ l: labellayer, n: res.Labels.length});
@@ -228,7 +234,7 @@ for (contlayer in contlayers)
    for (labellayer in labellayers)
    {
        ll = labellayers[labellayer];
-        var res = analyze(xd.EplotSections.Item(0), cl.l, ll.l)
+        var res = analyze(cl.l, ll.l)
        if (res.Labels.length)
        {
            Response.Write("<tr><td class='lcont'>"+(lastcont==cl.l?"":cl.l) + "</td>"
--- a/APPL/CAD/cad_verify_proc.asp
+++ b/APPL/CAD/cad_verify_proc.asp
@@ -51,7 +51,7 @@ function myContourProcessor(cHandle)
    cHandle.SetFilterLayers("{SLNK Labels}|{SLNK Contours}|" + llt);
    //cHandle.SetFilterLayers("{A--LSE--_ruimte element}");

-    Response.AddHeader("jgl", llt);
+    // Response.AddHeader("jgl", llt);

    //cHandle.SetColor("", S("fg_contourColor"), S("S("fg_contourAlpha")")); // Alle herkende ruimtes initieel transparant
    //cHandle.SetColor("", 0x00FF00, 32); // Alle herkende ruimtes initieel transparant
--- a/APPL/CAD/default.asp
+++ b/APPL/CAD/default.asp
@@ -197,7 +197,7 @@ if (scenario_key != 0)
        if (floor_key > 0)
        {
          MMap.SetCustomParameters(getCustomParameters())
-          MMap.Refresh(); // Try not to zoom extents
+          MMap.Refresh(false, true); // Try not to zoom extents, wel force
 <%        if (concept)
          { %>
            MMap2.SetCustomParameters(getCustomParameters() + "&concept=1")
@@ -218,7 +218,7 @@ if (scenario_key != 0)
        if (loc_key)
        {
          MMap.SetCustomParameters(getCustomParameters())
-          MMap.Refresh(false); // Try not to zoom extents
+          MMap.Refresh(false, true); // Try not to zoom extents, wel force
          showReport(null);
        }
        else
@@ -644,16 +644,6 @@ if (scenario_key != 0)
 <%      } %>
      }

-      // Toon de locatie foto's in een popupje
-      function openLocFoto()
-      {
-        var loc_key = $("#locatiekey").val();
-        if (loc_key >= 0)
-        {
-            FcltMgr.openDetail("appl/shared/show_foto.asp?root_path=<%=custpath%>/location_images/&loc_key=" + loc_key, "<%=L("lcl_photos")%>");
-        }
-      }
-
      // Toon de locatie mbv Google Maps
      function openLocGMaps()
      {
--- a/APPL/CAD/mykeyToSymbol.asp
+++ b/APPL/CAD/mykeyToSymbol.asp
@@ -20,7 +20,7 @@
 <!--#include file='../CAD/symbols.inc'-->
 <!--#include file="../Shared/WPFunctions.inc" -->
 <%
-    var SLNKSymbolkey = getQParam("pSymbolkey", ""); // pSymbolkey is defined SLNKDWF
+    var SLNKSymbolname = getQParam("pSymbolkey", ""); // pSymbolkey kan nog tekst bevatten
    var vKey = getQParamInt("vKey");
    var scenario_key = getQParamInt("scenario_key"); // current scenario of 0 for actual.
    var pRot = getQParamInt("rotation",0);
@@ -30,9 +30,9 @@

 function myContourProcessor(cHandle)
 {
-    if (SLNKSymbolkey.match(/^I:/) || SLNKSymbolkey.match(/^P:/)) // Ins_deel of PRJ_DEEL
+    if (SLNKSymbolname.match(/^I:/) || SLNKSymbolname.match(/^P:/)) // Ins_deel of PRJ_DEEL
    {
-        SLNKSymbolkey = parseInt(SLNKSymbolkey.substring(2));
+        var SLNKSymbolkey = parseInt(SLNKSymbolname.substring(2));
        if (!canWriteInsDeel(SLNKSymbolkey, vKey, scenario_key))
        {
            new SLNKDWF({maximize : true}).Warning(L("lcl_fg_obj_noedit"));
@@ -57,9 +57,10 @@ function myContourProcessor(cHandle)
        var scl = oRs("scl").value!=null?oRs("scl"):1.0;
        var rot = oRs("rot").value;
    }
-    else if (SLNKSymbolkey.match(/^IW:/)) // werkplek gebonden Ins_deel
+    else if (SLNKSymbolname.match(/^IW:/)) // werkplek gebonden Ins_deel
    {
-        SLNKSymbolkey = SLNKSymbolkey.substring(3);
+        var SLNKSymbolkey = parseInt(SLNKSymbolname.substring(3));
+
        if (!canWriteInsDeel(SLNKSymbolkey, vKey, scenario_key))
        {
            new SLNKDWF({maximize : true}).Warning(L("lcl_fg_obj_noedit"));
@@ -92,9 +93,10 @@ function myContourProcessor(cHandle)
        var scl = oRs("scl").value!=null?oRs("scl"):1.0;
        var rot = wRot;
    }
-    else if (SLNKSymbolkey.match(/^W:/)) // Werkplek
+    else if (SLNKSymbolname.match(/^W:/)) // Werkplek
    {
-        SLNKSymbolkey = SLNKSymbolkey.substring(2);
+        SLNKSymbolkey = parseInt(SLNKSymbolname.substring(2));
+
        if (scenario_key==0&&!WPCanWrite(vKey))
        {
            new SLNKDWF({maximize : true}).Warning(L("lcl_fg_obj_noedit"));
--- a/APPL/CAD/rap_insXY.asp
+++ b/APPL/CAD/rap_insXY.asp
@@ -16,7 +16,7 @@
 <%
 var discs = getQParamIntArray("discs", []);
 var highlight_arr  = getQParamIntArray("highlight", []); // Comma-separated room_key_list (terrains). Optional
-var floorKey = getQParamInt("vKey", "");
+var floorKey = getQParamInt("vKey", -1);

 var outputmode = getQParamInt("outputmode", 0);
 var showall = getQParamInt("showall", 0) == 1;
@@ -30,7 +30,7 @@ if (dwfPath)
 // ==========================
 //
 // ==========================
-if (floorKey !="" && discs != "")
+if (floorKey > 0 && discs.length)
 {
  var sql = "SELECT ins_deel_key, ins_deel_omschrijving, ins_deel_dwgX, ins_deel_dwgY, "
          + "  alg_ruimte_nr, cadlabel, " + lcl.xsqla('isd.ins_srtdeel_omschrijving', 'isd.ins_srtdeel_key')
--- a/APPL/CARE/cak_rapport.asp
+++ b/APPL/CARE/cak_rapport.asp
@@ -8,7 +8,7 @@

 */ %>
 <%
-DOCTYPE_Disable = 1;
+JSON_Result = true;
 %>
 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../../appl/shared/json2.js" -->
@@ -18,7 +18,7 @@ var autfunction = "WEB_USRRAP";
 var authparams = user.checkAutorisation(autfunction);

  var cak_periode = getQParam("cak_periode");
-  var message = "U heeft periode " + cak_periode + " gezet";
+  var message = "U heeft periode " + safe.html(cak_periode) + " gezet";
  if (cak_periode != "")
  {
    sql = " UPDATE fac_usrdata "
--- a/APPL/CNT/cnt.inc
+++ b/APPL/CNT/cnt.inc
@@ -57,11 +57,11 @@ cnt = { setcontractstatus:
             var functie_code;
             if (kosten <= S("cnt_contract_limit1")) // Dit eerst testen i.v.m. Ter goedkeuring. Verder moet sowieso goedgekeurd worden.
               return []; // Het bedrag is lager als de eerste limiet. Het contract hoeft niet goed gekeurd te worden, dus een lege fiatteurs array teruggeven.
-             else if ((S("cnt_approval_all") == 0 && approved < S("cnt_contract_limit1")) || (S("cnt_approval_all") == 1 && kosten <= S("cnt_contract_limit2")))
+             else if ((S("cnt_approval_all") == 0 && approved <= S("cnt_contract_limit1")) || (S("cnt_approval_all") == 1 && kosten <= S("cnt_contract_limit2")))
               functie_code = "WEB_CNTGO1";
-             else if ((S("cnt_approval_all") == 0 && approved < S("cnt_contract_limit2")) || (S("cnt_approval_all") == 1 && kosten <= S("cnt_contract_limit3")))
+             else if ((S("cnt_approval_all") == 0 && approved <= S("cnt_contract_limit2")) || (S("cnt_approval_all") == 1 && kosten <= S("cnt_contract_limit3")))
               functie_code = "WEB_CNTGO2";
-             else if ((S("cnt_approval_all") == 0 && approved < S("cnt_contract_limit3")) || (S("cnt_approval_all") == 1 && kosten > S("cnt_contract_limit3")))
+             else if ((S("cnt_approval_all") == 0 && approved <= S("cnt_contract_limit3")) || (S("cnt_approval_all") == 1 && kosten > S("cnt_contract_limit3")))
               functie_code = "WEB_CNTGO3";
             else return []; // Het goedgekeurde bedrag zit al boven de derde limiet. Geen approval meer nodig.

@@ -70,7 +70,7 @@ cnt = { setcontractstatus:
                 + "  FROM fac_functie f"
                 + "     , fac_v_webgebruiker g"
                 + " WHERE f.fac_functie_key = g.fac_functie_key"
-                 + "   AND f.fac_functie_code LIKE '" + functie_code + "'";
+                 + "   AND f.fac_functie_code = " + safe.quoted_sql(functie_code);
             oRs = Oracle.Execute(sql);
             while(!oRs.eof)
             {
@@ -216,6 +216,8 @@ cnt = { setcontractstatus:
                        + "     , cc.cnt_contract_looptijd_tot"
                        + "     , cc.prs_contactpersoon_key"
                        + "     , cc.cnt_contract_verwijder"
+                        + "     , cc.cnt_contract_locked_user_key"
+                        + "     , cc.cnt_contract_locked_date"
                        + "     , cc.bes_bestelopdr_key"
                        + "     , cc.cnt_contract_opzegtermijn"
                        + "     , (SELECT " + lcl.xsqla('cnt_termijn_omschrijving', 'cnt_termijn_key')
@@ -296,6 +298,8 @@ cnt = { setcontractstatus:
                             looptijd_tot: new Date(oRs("cnt_contract_looptijd_tot").Value),
                             contactpersoon_key: oRs("prs_contactpersoon_key").Value,
                             verwijderdatum: oRs("cnt_contract_verwijder").Value,
+                             locked_user_key: oRs("cnt_contract_locked_user_key").value,
+                             locked_date: new Date(oRs("cnt_contract_locked_date").value),
                             bestelopdr_key: oRs("bes_bestelopdr_key").Value,
                             opzegtermijn: oRs("cnt_contract_opzegtermijn").Value,
                             opzegtermijn_oms: oRs("opzegtermijn_oms").Value,
@@ -328,6 +332,18 @@ cnt = { setcontractstatus:
                             isAbonnement: oRs("bes_disc_params_contract").Value == 1
                           };
              oRs.Close()
+
+              if (result.locked_user_key)
+              {
+                var expire = new Date;
+                expire.setMinutes(expire.getMinutes() - S("mld_locked_expire"));
+                if (result.locked_date < expire)
+                { // In de database laten we het lock gewoon staan ter analyse achteraf welke locks niet worden vrijgegeven.
+                  result.locked_user_key = null;
+                  result.locked_date = null;
+                }
+              }
+
              return result;
           },

@@ -375,14 +391,15 @@ cnt = { setcontractstatus:
                                   cnt_info.approved <= S("cnt_contract_limit1");                                      // Welke goedkeur? 1, 2 of 3?
            cresult.canGoedkeur2 = cresult.canWrite("WEB_CNTGO2") &&
                                   terGoedkeuring &&
-                                   ((S("cnt_approval_all") == 0 && cnt_info.kosten >= S("cnt_contract_limit2")) ||
-                                     (S("cnt_approval_all") == 1 && cnt_info.kosten <= S("cnt_contract_limit3"))) &&
-                                   cnt_info.approved <= S("cnt_contract_limit2");
+                                   // Setting cnt_approval_all is
+                                   // 0: Het approved bedrag is eigen bestellimiet of vorige goedkeur niveau rechten heb ik al (dan direct niveau hoger)
+                                   // 1: Het approved bedrag is kleiner of gelijk aan eigen bestellimiet
+                                   ((S("cnt_approval_all") == 0 && cnt_info.kosten >= S("cnt_contract_limit2") && (cnt_info.approved == S("cnt_contract_limit2") || cresult.canGoedkeur1)) ||
+                                    (S("cnt_approval_all") == 1 && cnt_info.kosten <= S("cnt_contract_limit3") && cnt_info.approved <= S("cnt_contract_limit2")));
            cresult.canGoedkeur3 = cresult.canWrite("WEB_CNTGO3") &&
                                   terGoedkeuring &&
-                                   ((S("cnt_approval_all") == 0 && cnt_info.kosten >= S("cnt_contract_limit3")) ||
-                                     (S("cnt_approval_all") == 1 && cnt_info.kosten > S("cnt_contract_limit3"))) &&
-                                   cnt_info.approved <= S("cnt_contract_limit3") &&
+                                   ((S("cnt_approval_all") == 0 && cnt_info.kosten >= S("cnt_contract_limit3") && (cnt_info.approved == S("cnt_contract_limit3") || cresult.canGoedkeur2)) ||
+                                    (S("cnt_approval_all") == 1 && cnt_info.kosten > S("cnt_contract_limit3") && cnt_info.approved <= S("cnt_contract_limit3"))) &&
                                   cnt_info.kosten > cnt_info.approved;
            cresult.forApproval = nieuw && cresult.canUSEwrite;
            cresult.canReject = cresult.canGoedkeur1 || cresult.canGoedkeur2 || cresult.canGoedkeur3;
@@ -491,7 +508,27 @@ cnt = { setcontractstatus:
            result.writeuse = xfunc.canWrite("WEB_CNTUSE");

            return result;
+          },
+
+          lock: function (cnt_key)
+          {
+            var sql = "UPDATE cnt_contract"
+                    + "   SET cnt_contract_locked_user_key = " + user_key
+                    + "     , cnt_contract_locked_date = SYSDATE"
+                    + " WHERE cnt_contract_key = " + cnt_key;
+            Oracle.Execute(sql);
+          },
+
+          unlock: function (cnt_key)
+          {
+            var sql = "UPDATE cnt_contract"
+                    + "   SET cnt_contract_locked_user_key = NULL"
+                    + "     , cnt_contract_locked_date = SYSDATE"
+                    + " WHERE cnt_contract_key = " + cnt_key
+                    + "   AND cnt_contract_locked_user_key = " + user_key; // Alleen als we zelf het lock hadden
+            Oracle.Execute(sql);
          }
+
      }

 %>
--- a/APPL/CNT/cnt_contract.asp
+++ b/APPL/CNT/cnt_contract.asp
@@ -123,8 +123,11 @@ if (cnt_key > 0) {
        // Give the user a list and let him select a srtdiscipline.
        mySRTsql = "SELECT cs.ins_discipline_key"
                 + "     , "+ lcl.xsqla('cs.ins_discipline_omschrijving','cs.ins_discipline_key')
+                 + "     , "+ lcl.xsqla('dp.cnt_disc_params_opmerking','dp.cnt_ins_discipline_key')
                 + "  FROM cnt_discipline cs"
-                 + " WHERE cs.ins_discipline_verwijder IS NULL"
+                 + "     , cnt_disc_params dp"
+                 + " WHERE cs.ins_discipline_key = dp.cnt_ins_discipline_key"
+                 + "   AND cs.ins_discipline_verwijder IS NULL"
                 + "   AND cs.ins_discipline_key IN"
                   + " (SELECT ins_discipline_key"
                   + "    FROM fac_v_webgebruiker g"
@@ -139,10 +142,11 @@ if (cnt_key > 0) {
        oRs = Oracle.Execute(mySRTsql);
        while (!oRs.eof)
        {
-          srtdisc = oRs("ins_discipline_key").value;
-          buttons.push({ title: oRs("ins_discipline_omschrijving").value,
+          srtdisc = oRs("ins_discipline_key").Value;
+          buttons.push({ title: oRs("ins_discipline_omschrijving").Value,
                         action: "srtdisc=" + srtdisc + ";$('div#dmodal').dialog('close').remove();",
-                         showText: false
+                         showText: false,
+                         tooltip: oRs("cnt_disc_params_opmerking").Value
                       });
          oRs.MoveNext();
        }
--- a/APPL/CNT/cnt_edit_contract.asp
+++ b/APPL/CNT/cnt_edit_contract.asp
@@ -35,6 +35,12 @@ if (cnt_key > -1)
  var cnt_info = cnt.cnt_contract_info(cnt_key); // nog heel beperkt
  var this_cnt = cnt.func_enabled_contract(cnt_key, cnt_info); // Wat heb ik zoal aan rechten op dit contract?
  user.auth_required_or_abort(this_cnt.canChange);
+
+  if (!cnt_info.locked_user_key || cnt_info.locked_user_key == user_key)
+  {
+    cnt.lock(cnt_key);
+    cnt_info.locked_user_key = user_key;
+  }
 }
 else // nieuw contract
 {
@@ -52,21 +58,23 @@ else // nieuw contract

  var sql = "SELECT dp.cnt_srtcontract_type,"
          + lcl.xsqla('cs.ins_discipline_omschrijving','cs.ins_discipline_key')
+          +",      (SELECT prs_kostensoort_oms || '-' || " + lcl.xsqla('prs_kostensoort_opmerking', 'prs_kostensoort_key')
+          + "         FROM prs_kostensoort"
+          + "        WHERE prs_kostensoort_key = cs.prs_kostensoort_key) kostensoort_naam"
          + " FROM cnt_disc_params dp,"
          + "      cnt_discipline cs"
          + " WHERE dp.cnt_ins_discipline_key = " + l_cnt_srt
          + "   AND cs.ins_discipline_key =  " + l_cnt_srt;
  var oRs = Oracle.Execute( sql );
-  var cnt_type = oRs("cnt_srtcontract_type").value;
-  var ins_discoms  = oRs("ins_discipline_omschrijving").value;
-  oRs.close();
  var this_cnt = {canChangeKosten: true,
                  canChangeAlg: true,
                  isAbonnement: false};
  var cnt_info = {contract_status: S("cnt_contract_approval") == 1? 2 : 0,
-                  srtcontract_type: cnt_type,
-                  discipline_omschrijving: ins_discoms,
-                  discipline_key: l_cnt_srt};
+                  srtcontract_type: oRs("cnt_srtcontract_type").value,
+                  discipline_omschrijving: oRs("ins_discipline_omschrijving").value,
+                  discipline_key: l_cnt_srt,
+                  kostensoort_naam: oRs("kostensoort_naam").Value};
+  oRs.close();
 }
 %>
 <html>
@@ -93,16 +101,42 @@ else // nieuw contract
          FcltMgr.closeDetail(window, { cancel: true } );
      }

+      // Meestal unlocken we gewoon in showmode die er achteraan komt
+      // maar soms wordt het tabblad daarvoor al gesloten. Dan komen
+      // we hier langs.
+      function onCloseHot()
+      {
+         var data = { cnt_key: <%=cnt_key%> };
+          <% protectRequest.dataToken("data"); %>
+          jQuery.ajaxSetup({async: false}); // Anders faalt o.a. bij IE9 de $.post bij afsluiten
+          $.post("cnt_unlock.asp",
+                 data,
+                 FcltCallback,
+                 "json");
+      }
    </script>

  </head>
  <body id="editbody">
 <%
    var buttons = [];
-    buttons.push({title: L("lcl_submit"), action:"cnt_submit()", icon: "opslaan.png"});
+    if (!cnt_info.locked_user_key || cnt_info.locked_user_key == user_key)
+      buttons.push({title: L("lcl_submit"), action:"cnt_submit()", icon: "opslaan.png"});
    buttons.push({title: L("lcl_cancel"), action:"cnt_cancel()", icon: "undo.png" });

    IFRAMER_HEADER(L("lcl_cnt_frame_algemeen"), buttons);
+      if (cnt_info.locked_user_key && cnt_info.locked_user_key != user_key)
+      {
+        var other = new Perslid(cnt_info.locked_user_key);
+%>
+        <script type="text/javascript">
+          jQuery(document).ready(function()
+                                 {
+                                   FcltMgr.closeDetail(window, {cancel: true});
+                                 });
+        </script>
+<%      Response.End;
+      }
      if (cnt_info.contract_status == 1)
      {
 %>      <div class="cnt_inactive"><%=L("lcl_cnt_is_inactive")%></div><%
@@ -331,11 +365,14 @@ else // nieuw contract
        if (cnt_info.isAbonnement || !this_cnt.canChangeAlg)
            ROFIELDTR ("fldkp", L("lcl_cnt_kostensoort"), cnt_info.kostensoort_naam, {suppressEmpty: true});
        else
+        {
+            ROFIELDTR ("fldkp", L("lcl_cnt_kostensoort_standaard"), cnt_info.kostensoort_naam, {suppressEmpty: true});
            FCLTkostensoortselector("prs_kstsrtkey",
                                    "prs_kstsrtkey",
                                    { kostensoortKey: cnt_info.prs_kostensoort_key,
-                                      label: L("lcl_cnt_kostensoort")
+                                      label: L("lcl_cnt_kostensoort_specifiek")
                                    });
+        }

        RWFIELDTR("cnt_cntkstn",  "fld",  L("lcl_cnt_contract_sum") + " " + S("currency_pref"),
                                    safe.curreditable(cnt_info.kosten),
--- a/APPL/CNT/cnt_edit_contract_save.asp
+++ b/APPL/CNT/cnt_edit_contract_save.asp
@@ -174,6 +174,8 @@ if (!warning)
  // Als de contractkosten aangepast zijn wordt nooit opnieuw gefiatteerd. Dan moet er een nieuw contract worden afgesplitst.
  // Tijdens het opslaan veranderd nooit de status in Ter goedkeuring. Dus geen cnt.sendNeedApprovalNotifications(..,..).
 }
+
+cnt.unlock(cnt_key);
 %>
 <html>
  <head>
--- a/APPL/CNT/cnt_edit_scope.asp
+++ b/APPL/CNT/cnt_edit_scope.asp
@@ -250,8 +250,7 @@ var cnt_srtcontract_type = oRs("cnt_srtcontract_type").value;
                             + " WHEN 'G'"
                             + " THEN gg.alg_locatie_omschrijving ||"
                               + " ' (' ||"
-                               + " gg.alg_locatie_code || ' - ' || "
-                               + " gg.alg_gebouw_code || ')'"
+                               + " gg.alg_gebouw_omschrijving || ')'"
                             + " WHEN 'T'"
                             + " THEN lo2.alg_locatie_omschrijving ||"
                               + " ' (' ||"
--- a/APPL/CNT/cnt_edit_scope.js
+++ b/APPL/CNT/cnt_edit_scope.js
@@ -441,7 +441,7 @@ function checkWeight(evt)
  var obj = evt.srcElement || evt.target;
  var ival = parseInt(obj.value,10);
  var retVal = false;
-  if (( !isNaN(ival) && ival >= 0 && ival < 1000000000) || obj.value =="")
+  if (( !isNaN(ival) && Math.abs(ival) < 1000000000) || obj.value =="")
    retVal = true;
  if ( !retVal )
  {
--- a/APPL/CNT/cnt_forapproval.asp
+++ b/APPL/CNT/cnt_forapproval.asp
@@ -51,7 +51,14 @@ for (var i = 0; i < ingesloten.length; i++)
    result.message = cnt.sendNeedApprovalNotifications(ingesloten[i], approver_arr);
  }
  else // Geen fiatteur, dan direct goedkeuren en naar status Actief(0).
+  {
+    sql = "UPDATE cnt_contract"
+        + "   SET cnt_contract_teverzenden = 1"
+        + " WHERE cnt_contract_key = " + ingesloten[i];
+    oRs = Oracle.Execute(sql);
+
    cnt.setcontractstatus(ingesloten[i], 0); // Zorgt ook voor tracking en daarmee notificatie.
+  }
  result.success = true;
 }
 if (multi) // Dan een algemener bericht geven.
--- a/APPL/CNT/cnt_list.inc
+++ b/APPL/CNT/cnt_list.inc
@@ -154,6 +154,7 @@ function cnt_list (pautfunction, params)
      sql = "SELECT c.cnt_contract_nummer"
          + "     , c.cnt_contract_versie"
          + "     , c.cnt_contract_omschrijving"
+          + "     , c.cnt_contract_document"
          + "     , COALESCE(b.prs_bedrijf_naam, afd2.prs_afdeling_naam) uitvoerder"
          + "     , " + S("prs_dep_string") + " eigenaar"
          + "     , c.cnt_contract_looptijd_van begindatum"
@@ -585,9 +586,13 @@ function cnt_list (pautfunction, params)
      }
      function fnrowActionEnabler(oRs)
      {
-        var this_cnt = cnt.func_enabled_contract(oRs("cnt_contract_key").Value);
-        var eForApproval = this_cnt.forApproval; // Ter goedkeuring
-        var data = { eForApproval: eForApproval };
+        var data = {};
+        // status 2 is 'ter goedkeuring'
+        if (S("cnt_contract_approval") == 1 && oRs("cnt_contract_status").Value == 2) // Voorkennis. Voorkom dure cnt.func_enabled_contract
+        {
+            var this_cnt = cnt.func_enabled_contract(oRs("cnt_contract_key").Value);
+            data.eForApproval = this_cnt.forApproval; // Ter goedkeuring
+        }
        return data;
      }

@@ -665,6 +670,10 @@ function cnt_list (pautfunction, params)
      }
      rst.addColumn(new Column({caption: L("lcl_cnt_contractnr"), content: "cnt_contract_nummer"}));
      rst.addColumn(new Column({caption: L("lcl_cnt_beschrijv"), content: "cnt_contract_omschrijving"}));
+      if (outputmode != 0)
+      {
+        rst.addColumn(new Column({caption: L("lcl_cnt_document"), content: "cnt_contract_document"}));
+      }
      rst.addColumn(new Column({caption: L("lcl_cnt_contractant"), content: "uitvoerder"}));
      rst.addColumn(new Column({caption: L("lcl_cnt_owner"), content: "eigenaar"}));
      rst.addColumn(new Column({caption: L("lcl_cnt_status"), content: fncolStatus}));
@@ -676,10 +685,13 @@ function cnt_list (pautfunction, params)
      }
      rst.addColumn(new Column({caption: L("lcl_cnt_enddate"), content: "einddatum"}));
      if (outputmode != 0)
+      {
        rst.addColumn(new Column({caption: L("lcl_cnt_contract_sum") + " " + "(" + S("currency_pref") + ")", content: "cnt_contract_kosten", datatype: "currency"}));
+      }

      rst.addAction({ action: "cntEdit", caption: L("lcl_edit"), isDefault: true });
-      rst.addAction({ action: "cntForApproval", caption: L("lcl_cnt_forapproval"), enabler:"eForApproval", multi: true, multiOnce: true });
+      if (S("cnt_contract_approval") == 1)
+        rst.addAction({ action: "cntForApproval", caption: L("lcl_cnt_forapproval"), enabler:"eForApproval", multi: true, multiOnce: true });
      // PF: ik vermoed dat de opdrachten -action niet meer nodig is, ik denk aan een opdrachten-frame in het contractdetail (cnt_contract.asp)
      //rst.addAction({ action: "cntOrders", caption: L("lcl_cnt_order"), enabler: "eOrder"});
      // TODO: IK mis hier nog opdrachten algemeen zonder dat contract_key automatisch wordt ingevuld. Is niet afhankelijk van de geselecteerde regel
--- a/APPL/CNT/cnt_search_list.asp
+++ b/APPL/CNT/cnt_search_list.asp
@@ -68,12 +68,22 @@ else
  var cntInact = getFParamInt("cntInact", 0) == 1; // Status Inactief(1)
  var cntNew = getFParamInt("cntNew", 0) == 1; // Status Nieuw(2)
  var cntTgoe = getFParamInt("cntTgoe", 0) == 1; // Status Ter goedkeuring(3)
+
  var cntFFutu = getFParamInt("cntFFutu", 0) == 1; // Fase Toekomstig binnen status actief
  var cntFAct = getFParamInt("cntFAct", 0) == 1; // Fase Actueel binnen status actief
  var cntFRap = getFParamInt("cntFRap", 0) == 1; // Fase Rappel binnen status actief
  var cntFOpz = getFParamInt("cntFOpz", 0) == 1; // Fase In opzegtermijn binnen status actief
  var cntFVerl = getFParamInt("cntFVerl", 0) == 1; // Fase Verlopen binnen status actief

+if (!cntAct && !cntInact && !cntNew && !cntTgoe)
+{
+  // geen parameters voor status, dan defaults zetten (voor gebruikt vanuit ins_show_deel).
+  cntAct = true;
+  cntInact = false;
+  cntNew = true;
+  cntTgoe = true;
+}
+
  params.cntsrt_key = (cntsrt_key != -1? cntsrt_key : null);
  params.dienst_key = (dienst_key != -1? dienst_key : null);
  params.uitvoerder_key = (uitvoerder_key != -1? uitvoerder_key : null);
--- a/APPL/CNT/cnt_show_contract.asp
+++ b/APPL/CNT/cnt_show_contract.asp
@@ -24,6 +24,9 @@ var cnt_key = getQParamInt("cnt_key");
 var cnt_info = cnt.cnt_contract_info(cnt_key); // Nog heel beperkt
 var this_cnt = cnt.func_enabled_contract(cnt_key, cnt_info); // Wat heb ik zoal aan rechten op dit contract?
 user.auth_required_or_abort(this_cnt.canReadAny); // Heb ik enige lees rechten op dit contract?
+
+if (cnt_info.locked_user_key == user_key)
+  cnt.unlock(cnt_key);
 %>
 <html>
  <head>
@@ -143,7 +146,8 @@ user.auth_required_or_abort(this_cnt.canReadAny); // Heb ik enige lees rechten o
  </head>
  <body id="showbody">
 <%  var buttons = [];
-    if (cnt_info.verwijderdatum == null)
+    var isLocked = (cnt_info.locked_user_key && cnt_info.locked_user_key != user_key);
+    if (cnt_info.verwijderdatum == null && !isLocked)
    {
      if (this_cnt.canChange)
        buttons.push({title: L("lcl_change"),     icon: "wijzigen.png", action:"cnt_change()" });
@@ -173,6 +177,17 @@ user.auth_required_or_abort(this_cnt.canReadAny); // Heb ik enige lees rechten o
    buttons.push({ icon: "print.png", title: L("lcl_print"),          action: 'cnt_print()' });

    IFRAMER_HEADER(L("lcl_cnt_frame_algemeen"), buttons);
+    if (cnt_info.locked_user_key && cnt_info.locked_user_key != user_key)
+    {
+      var other = new Perslid(cnt_info.locked_user_key);
+%>    <div class="warning"><%=L("lcl_cnt_contract_locked").format(safe.html(other.naam()), toTimeString(cnt_info.locked_date))%>
+        <div class="buttoncontainer" style="float:right">
+<%        var buttonsM = [];
+          buttonsM.push({ icon: "page_refresh.png", title: L("lcl_refresh"), action: "parent.FcltMgr.reload()" });
+          CreateButtons(buttonsM, { showIcons: true }) %>
+        </div>
+      </div><%
+    }
 %>
    <div id="show">
 <%    if (cnt_info.verwijderdatum != null)
@@ -231,7 +246,7 @@ user.auth_required_or_abort(this_cnt.canReadAny); // Heb ik enige lees rechten o
        ROFIELDTR ("flddate", L("lcl_cnt_date_start"), toDateString(cnt_info.looptijd_van));
        var fldcls = "flddate";
        if (cnt_info.looptijd_tot < new Date())
-            fldcls += " activeinter`al";
+            fldcls += " activeinterval";
        ROFIELDTR (fldcls, L("lcl_cnt_date_end"), toDateString(cnt_info.looptijd_tot));

        // fancy is: als deze periodes nu van toepassing zijn dat tonen (met class activeinterval)
--- a/APPL/CNT/cnt_show_scope.asp
+++ b/APPL/CNT/cnt_show_scope.asp
@@ -167,7 +167,7 @@ var showall = getQParamInt("showall", 0) == 1;
                  + " AND co.cnt_mld_melding_key IS NULL"
                  + " AND co.cnt_contract_key = " + cnt_key + ""
                  + " UNION"
-                  + " SELECT '" + L("lcl_location") + "' plaatsaanduiding"
+                  + " SELECT " + safe.quoted_sql(L("lcl_location")) + " plaatsaanduiding"
                  + ", null totaal_opp"
                  + ", co.cnt_contract_onrgoed_opp contract_opp"
                  + ", sr.alg_srtruimte_code tariefsrt"
--- a/APPL/CNT/cnt_unlock.asp
+++ b/APPL/CNT/cnt_unlock.asp
@@ -0,0 +1,29 @@
+<%@language = "javascript" %>
+<% /*
+     $Revision$
+     $Id$
+
+     Unlock een cnt-lock
+     Meestal doen we dat gewoon in showmode maar als je een hot tabblad
+     sluit dan komen we daar niet. Dan wordt dit bestand aangeroepen
+  */ %>
+<%
+var JSON_Result = true;
+%>
+
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<!-- #include file="cnt.inc" -->
+
+<%
+protectRequest.validateToken();
+var cnt_key = getFParamInt("cnt_key");
+
+// Autorisatie is niet echt relevant. Er wordt alleen een unlock gedaan
+// als jij het lock had.
+cnt.unlock(cnt_key);
+
+result = { success: true };
+
+Response.Write(JSON.stringify(result));
+%>
--- a/APPL/CNT/loadRuimteObjecten.asp
+++ b/APPL/CNT/loadRuimteObjecten.asp
@@ -47,7 +47,7 @@ else if (locatiekey > 0)
  alg_niveau = "L";
 }

-var sql = get_objecten_sql(alg_key, alg_niveau, prs_key, dept_key, -1, true /*geenToolTip*/);
+var sql = get_objecten_sql(alg_key, alg_niveau, prs_key, dept_key, -1);

 FCLTselectorOptions(sql,
                    { multi: true,
--- a/APPL/EXP/exp_export.asp
+++ b/APPL/EXP/exp_export.asp
@@ -0,0 +1,69 @@
+<%@ LANGUAGE = JavaScript %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           exp_export.asp
+    Description:    Export, resultaat direct downloaden
+    Parameters:
+        export_key  Export key uit fac_export_app
+        compress    Optional 0 of 1, overrules flag in fac_export_app
+    Context:
+    Note:           De download limiet ligt meestal rond de 5MB
+                    Daar kun je een beetje omheen werken dooe &compress=1 mee te geven
+
+    TODO: Er is nog geen interface om aanroep van dit bestand te regelen
+*/ %>
+<%
+Server.ScriptTimeout = 6000; // Extra tijd
+DOCTYPE_Disable = 1;
+%>
+<!-- #include file="../Shared/common.inc" -->
+<!-- #include file="../Shared/json2.js" -->
+<script language="javascript" src="exp_shared.js" runat="server"></script>
+
+<%
+    var export_key = getQParamInt("export_key"); // 24=HV_DUMP,25=CPUA
+
+    var params        = getSettings(export_key);
+    user.checkAutorisation(params.functie_key);
+
+    params.custid     = customerId;
+    params.compress   = getQParamInt("compress", params.compress?1:0) == 1; // Je mag in de url overrulen
+    params.tempFolder = Server.MapPath("../../temp/");
+    params.applrun    = new Date();
+    params.preview    = getQParamInt("preview", "0") == 1; // dan geen _EXPORT_ achteraan aanroepen?
+
+    var streamObj = expCreateStream(export_key, params);
+
+    Response.clear;
+    streamObj.streamData.Type = 1; // verder als adTypeBinary
+    if (params.compress)
+    {
+        Response.contenttype = 'application/zip';
+    }
+    else
+    {
+        if (params.charset.toUpperCase() == 'UTF-8')
+        {
+            Session.Codepage = 65001;
+            Response.Charset = 'utf-8'; // Alleen voor de header var, we doen zo een binary write
+        }
+        Response.contenttype = "application/octet-stream";
+    }
+    Response.AddHeader("content-disposition", "attachment; filename= \"" + streamObj.exportFile + "\"");
+    try
+    {
+        Response.BinaryWrite(streamObj.streamData.Read());
+    }
+    catch (e)
+    {   // Meestal te groot
+        var msg = L("lcl_export_oversized").format(params.code, export_key, streamObj.streamData.Size); // S("maxdownloadsize")
+        __DoLog(e.description + "<br>" + msg);
+        Response.clear;
+        Response.contenttype = "text/html";
+        // De content-disposition krijgen we niet echt weg
+        Response.Write(msg);
+    }
+
+%>
--- a/APPL/EXP/exp_shared.js
+++ b/APPL/EXP/exp_shared.js
@@ -13,6 +13,9 @@
                            DUS: Geen L() functie voor locale!!!!
                             EN: Geen Server.CreateObject maar new ActiveXObject
                        ========= LET OP LET OP =========
+
+                        gen_export_app_flags: 00001 (1)  zip het resultaat
+                                              00010 (2)  manual
 */

 // fileStream moet onze data bevatten
@@ -23,17 +26,18 @@
 //        filepathname: optioneel: stoppen we in fac_export_filenaam
 function expCreateStream(export_key, params)
 {
-    // params.customerId
-    var ini = getSettings(export_key);
-    ini.applrun = new Date();
-    ini.custid = params.customerId;
+    preExport(params);
+    var exportFile = getFileName(params.prefix, params.postfix, params.applrun, params.timestamp);
+    var streamData = exportToStream(params, exportFile); // exportFile voor als compress
+    if (!params.preview)
+        postExport(params);

-    exportResults(ini);
-    var streamObj = { exportFile: getFileName(ini.prefix, ini.postfix, ini.applrun, ini.timestamp)
-                    , streamData: exportToStream(ini)
-                    };
+    if (params.compress)
+        exportFile += '.zip';

-    return streamObj;
+    return { exportFile: exportFile
+           , streamData: streamData
+           };
 }


@@ -60,26 +64,31 @@ function getSettings(app_key)
                   , prefix:  oRs("fac_export_app_prefix").value  || ""
                   , postfix: oRs("fac_export_app_postfix").value || ""
                   , timestamp:   oRs("fac_export_app_timestamp").value || ""
+                   , flags:   oRs("fac_export_app_flags").value || ""
                   , functie_key: oRs("fac_functie_key").value
                   , logpostfix: oRs("fac_export_app_log_postfix").value || ""
                   }
    }
    oRs.Close();
+    if (settings.flags & 1)
+        settings.compress = true;
+    if (settings.flags & 2)
+        settings.manual = true;
    return settings;
 }


-function exportResults(ini)
+function preExport(params)
 {
    // Clean up the mess of the previous run
    //
    var sql = "DELETE FROM imp_log"
-            + " WHERE imp_log_applicatie = " + safe.quoted_sql(ini.code);
+            + " WHERE imp_log_applicatie = " + safe.quoted_sql(params.code);
    __Log("SQL: " + sql);
    Oracle.Execute(sql);
    //
    // Call the database procedure for selecting the export results.
-    var selectProc = (ini.custid + "_SELECT_" + ini.code).toUpperCase();
+    var selectProc = (params.custid + "_SELECT_" + params.code).toUpperCase();
    var sql = "SELECT DISTINCT name"
            + "  FROM user_source"
            + " WHERE type = 'PROCEDURE'"
@@ -88,22 +97,52 @@ function exportResults(ini)
    var oRs = Oracle.Execute(sql);
    if(!oRs.Eof)
    {
-        sql = "BEGIN " + selectProc + "(" + "'" + ini.code + "', '" + ini.applrun + "'" + "); END;";
+        sql = "BEGIN " + selectProc + "(" + "'" + params.code + "', '" + toDateTimeString(params.applrun) + "'" + "); END;";
        __Log("SQL: " + sql);
        Oracle.Execute(sql);
    }
    else
    {
-        __Log("Select procedure not found: " + selectProc);
+        __Log("Optional select/pre-export procedure not found: " + selectProc);
    }
    oRs.Close();
 }

+function postExport(ini)
+{
+  // Call the database procedure for creation of exportfile.
+  var filename = getFileName(ini.prefix, ini.postfix, ini.applrun, ini.timestamp);
+  var exportProc = ini.custid + "_EXPORT_" + ini.code;
+  var sql = "SELECT DISTINCT name"
+          + "  FROM user_source"
+          + " WHERE type='PROCEDURE'"
+          + "   AND name = " + safe.quoted_sql(exportProc);
+  __Log("SQL: " + sql);
+  var oRs = Oracle.Execute(sql);
+  if (!oRs.Eof)
+  {
+    var sql = "BEGIN "
+            + exportProc + "(" + safe.quoted_sql(ini.code)
+                         + "," + safe.quoted_sql(toDateTimeString(ini.applrun))
+                         + ",'-1'"                            //+ safe.quoted_sql(iniOraclePath)  // ??
+                         + "," + safe.quoted_sql(filename)
+                         + ");"
+            + " END;"
+    __Log("SQL: " + sql);
+    Oracle.Execute(sql);
+  }
+  else
+  {
+    __Log("Optional (post-)export procedure not found: " + exportProc);
+  }
+  oRs.Close();
+}

-function exportToStream(ini)
+// Lever null op als er geen select-view is gedefinieerd.
+function exportToStream(params, exportFile)
 {
    var fstr;
-    var exportView = (ini.custid + "_V_EXPORT_" + ini.code).toUpperCase();
+    var exportView = (params.custid + "_V_EXPORT_" + params.code).toUpperCase();
    var sql = "SELECT DISTINCT view_name"
            + "  FROM USER_VIEWS"
            + " WHERE view_name = " + safe.quoted_sql(exportView);
@@ -111,12 +150,14 @@ function exportToStream(ini)
    var oRs = Oracle.Execute(sql);
    if (oRs.Eof)
    {
-        __Log("Export view not found: " + exportView);
+        __Log("Optional export view not found: " + exportView);
+        oRs.Close()
+        return null;
    }
    else
    {
        // Write data to stream.
-        fstr = openStreamWriteText({charset: ini.charset});
+        fstr = openStreamWriteText({charset: params.charset});
        var sql_v = "SELECT result"
                  + "  FROM  " + exportView
                  + " ORDER BY result_order";
@@ -130,7 +171,25 @@ function exportToStream(ini)
        oRs_v.Close();
    }
    oRs.Close();
-    return fstr;
+    fstr.Position = 0;
+
+    if (!params.compress)
+        return fstr;
+
+    var oZIP = new ActiveXObject("SLNKDWF.Zip");
+    var fso = new ActiveXObject("Scripting.FileSystemObject");
+    var temp = params.tempFolder + fso.GetTempName();
+    oZIP.New(temp) //;; Helaas niet *naar* stream
+    oZIP.ZipFromStream(exportFile, fstr);
+    oZIP.Close();
+    var oStream = new ActiveXObject("ADODB.Stream");
+    oStream.Open;
+    oStream.Type = 1; // adTypeBinary
+
+    oStream.LoadFromFile(temp);
+    oStream.Position = 0;
+    fso.DeleteFile(temp);
+    return oStream;
 }


@@ -172,6 +231,7 @@ function formatDate(datum, format)
            , "s"  : datum.getMilliseconds()             //millisecond
            , "w+" : Math.ceil((((datum - onejan) / 86400000) + onejan.getDay()+1)/7) // weeknumber
            };
+    format = format.replace('hhmm', 'HHMM');
    if (/(y+)/.test(format))
        format = format.replace(RegExp.$1, (datum.getFullYear()+"").substr(4 - RegExp.$1.length));
    for(var k in o)
--- a/APPL/FAC/Facilitor.asp
+++ b/APPL/FAC/Facilitor.asp
@@ -19,6 +19,8 @@
 <%
  // Als we hier komen hebben we gegarandeerd een user_key > 0

+  user.auth_required_or_abort(!user.isGroupedUser()); // Die heeft hier niets te zoeken.
+
  FCLTHeader.Requires({ plugins: ["jQuery"],
                        js: ["jquery-ui.js"]}); // css voor header.asp

--- a/APPL/FAC/NotifyMessage.asp
+++ b/APPL/FAC/NotifyMessage.asp
@@ -11,9 +11,14 @@
     We worden elke S("NotifyMessageInterval") seconde (default 90) gecontroleerd

     NOOT: Per interval wordt 1 popup gegeven met alle berichten sinds de vorige keer, met een tijdstip.
+
+     LET OP: Dit bestand wordt bij UWVA op drukke momenten consequent 10 keer per seconde/
+             34000 keer per uur opgeroepen. Performance is essentieel!
+             In het bijzonder bijvoorbeeld een aanroep van user.__require_prs_perslid voorkomen
 */
 LCL_Disable = 1; // Performance
 var JSON_Result = true;
+var EXPIRED_PASSWORD_OK = true; // performance
 %>
 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../Shared/json2.js" -->
--- a/APPL/FAC/Verify.asp.inc
+++ b/APPL/FAC/Verify.asp.inc
@@ -0,0 +1,17 @@
+<%@language = "javascript" %>
+<% /*
+    $Revision$
+    $Id$
+
+    File:           appl/fac/verify.asp.inc
+    Description:    Verify Facilitor installation
+    Parameters:     ?XXXX optional customerId
+    Context:        Manual call to check installation
+    Note:           Dit bestand is zonder autorisatie aan te roepen en heet daarom
+                    verify.asp.inc
+                    Kopieer dit bestand tijdelijk(!) naar verify.asp om het echt bruikbaar
+                    te maken.
+                    Als je de gelegenheid hebt om in te loggen met PRSSYS gebruik dan
+                    gewoon appl/fac/fac_verify2.asp
+*/ %>
+<!--#include file="fac_verify.inc "-->
--- a/APPL/FAC/fac.inc
+++ b/APPL/FAC/fac.inc
@@ -178,7 +178,7 @@ fac = {myfunctionssqlstring:
          return v_sql_verantwoordelijk;
        },

-        getSqlFiatBes: function(fiatstatus, prsKeys)
+        getSqlFiatBes: function(fiatstatus, prsKeys, params)
        {
           var v_sql_bestelling_bedrag = "(SELECT b.bes_bestelling_key"
                                      + "      , SUM(bi.bes_bestelling_item_prijs * bi.bes_bestelling_item_aantal) bestelling_bedrag"
@@ -251,6 +251,9 @@ fac = {myfunctionssqlstring:
                    : "")
                  + "      , mld_v_afleveradres m"
                  + "      , alg_locatie l"
+                  + (params.bld_key
+                    ? ", alg_gebouw g"
+                    : "")
                  + "  WHERE bi.bes_bestelling_key = b.bes_bestelling_key"
                  + "    AND prijs.bes_bestelling_key = b.bes_bestelling_key"
                  + "    AND sd.bes_srtdeel_key = bi.bes_srtdeel_key"
@@ -272,9 +275,18 @@ fac = {myfunctionssqlstring:
                      + " AND ft.fac_srtnotificatie_key = fno.fac_srtnotificatie_key"
                      + " AND fno.fac_srtnotificatie_code IN (" + (fiatstatus == "close"? "'BESFIT', 'BESACP'" : "'BESREJ'") + ")"
                      + " AND ft.prs_perslid_key IN (" + prsKeys + ")")
-                    + (fiatstatus == "open" // Als nog gefiatteerd moet worden door kostenplaatsgroep verantwoordelijke en ik heb net gefiatteerd dan wil ik die niet meer zien (want dan was het wel in 1 keer goedgekeurd).
-                      ? " AND (bes_bestelling_fiat_user <> " + user_key + " OR bes_bestelling_fiat_user IS NULL)" // Geldt alleen voor nog te fiatteren bestellingen, zie canApprove bij bestellingen. Dan heb je toch de rechten niet.
-                      : "") // Door mij goedgekeurde of afgekeurde bestellingen hoef ik niet meer af te melden maar wil ik nog wel zien
+                  + (fiatstatus == "open" // Als nog gefiatteerd moet worden door kostenplaatsgroep verantwoordelijke en ik heb net gefiatteerd dan wil ik die niet meer zien (want dan was het wel in 1 keer goedgekeurd).
+                    ? " AND (bes_bestelling_fiat_user <> " + user_key + " OR bes_bestelling_fiat_user IS NULL)" // Geldt alleen voor nog te fiatteren bestellingen, zie canApprove bij bestellingen. Dan heb je toch de rechten niet.
+                    : "") // Door mij goedgekeurde of afgekeurde bestellingen hoef ik niet meer af te melden maar wil ik nog wel zien
+                  + (params.bld_key
+                    ? " AND l.alg_locatie_key = g.alg_locatie_key AND g.alg_gebouw_key = " + params.bld_key
+                    : "")
+                  + (params.loc_key_arr && !params.bld_key
+                    ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                    : "")
+                  + (params.opdrtype_key
+                    ? " AND 0=1" // Er wordt gezocht naar een opdrachttype, die bestaan niet voor BES.
+                    : "")
                  + " GROUP BY b.bes_bestelling_key"
                  + "        , b.bes_bestelling_datum"
                  + "        , p.prs_perslid_naam_full"
@@ -290,7 +302,7 @@ fac = {myfunctionssqlstring:
          return sql;
        },

-        getSqlFiatCnt: function(fiatstatus, prsKeys)
+        getSqlFiatCnt: function(fiatstatus, prsKeys, params)
        { // Contracten: Goedkeuren tot de drie limieten
          var scope = " SELECT l.alg_locatie_key loc"
                    + "      , " + S("alg_loc_string") + " loc_oms"
@@ -302,6 +314,9 @@ fac = {myfunctionssqlstring:
                    + "  WHERE cnt_alg_plaats_key = l.alg_locatie_key"
                    + "    AND cnt_alg_plaats_code = 'L'"
                    + "    AND cnt_contract_plaats_verwijder IS NULL"
+                    + (params.loc_key_arr
+                      ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                      : "")
                    + " UNION"
                    + " SELECT l.alg_locatie_key loc"
                    + "      , " + S("alg_loc_string") + " loc_oms"
@@ -315,6 +330,11 @@ fac = {myfunctionssqlstring:
                    + "    AND cnt_alg_plaats_key = g.alg_gebouw_key"
                    + "    AND g.alg_locatie_key = l.alg_locatie_key"
                    + "    AND cnt_contract_plaats_verwijder IS NULL"
+                    + (params.bld_key
+                      ? " AND g.alg_gebouw_key = " + params.bld_key
+                      : (params.loc_key_arr
+                        ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                        : ""))
                    + " UNION"
                    + " SELECT l.alg_locatie_key loc"
                    + "      , " + S("alg_loc_string") + " loc_oms"
@@ -327,11 +347,51 @@ fac = {myfunctionssqlstring:
                    + "  WHERE cnt_alg_plaats_code = 'T'"
                    + "    AND cnt_alg_plaats_key = t.alg_terreinsector_key"
                    + "    AND t.alg_locatie_key = l.alg_locatie_key"
-                    + "    AND cnt_contract_plaats_verwijder IS NULL";
+                    + "    AND cnt_contract_plaats_verwijder IS NULL"
+                    + (params.loc_key_arr
+                      ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                      : "");

          var loc_count = "(SELECT COUNT(loc) FROM theScope scope WHERE scope.cnt_key = c.cnt_contract_key)";
          var loc_oms = "(SELECT loc_oms FROM theScope scope WHERE scope.cnt_key = c.cnt_contract_key)";
          var gebter_oms = "(SELECT gebter_oms FROM theScope scope WHERE scope.cnt_key = c.cnt_contract_key)";
+          var filterlocatie = (params.dist_key ? true : false);
+          var filter_gebonden = "";
+          if (filterlocatie)
+          {
+            filter_gebonden = " AND c.cnt_contract_key = cp.cnt_contract_key"
+            if (params.bld_key)
+            {
+              // Filteren op gebouw levert alleen de gebouwgebonden contracten.
+              filter_gebonden += " AND cp.cnt_alg_plaats_key = " + params.bld_key
+                               + " AND cp.cnt_alg_plaats_code = 'G'";
+            }
+            else
+            {
+              // Filteren op locatie moet zowel de locatie gebonden contracten opleveren
+              // als de gebouwgebonden contracten binnen deze locatie.
+              var locaties = params.loc_key_arr.join(","); // De geselecteerde locatie, of alle locaties in het geselecteerde district.
+              var gebouwen = "";
+              sql_f = "SELECT alg_gebouw_key"
+                    + "  FROM alg_gebouw"
+                    + " WHERE alg_locatie_key IN (" + locaties + ")";
+              var bld_key_arr = [];
+              var oRsf = Oracle.Execute(sql_f);
+              if (!oRsf.eof)
+              {
+                while (!oRsf.eof)
+                {
+                  bld_key_arr.push(oRsf("alg_gebouw_key").value);
+                  oRsf.moveNext();
+                }
+                oRsf.Close();
+                gebouwen = bld_key_arr.join(",");
+              }
+              filter_gebonden += " AND (  (cp.cnt_alg_plaats_code = 'L' AND cp.cnt_alg_plaats_key IN (" + locaties + "))"
+                       + (gebouwen ? " OR (cp.cnt_alg_plaats_code = 'G' AND cp.cnt_alg_plaats_key IN (" + gebouwen + "))" : "")
+                                   + " )";
+            }
+          }

          var sql = " WITH theScope AS (" + scope + ")"
                  + " SELECT DISTINCT TO_CHAR (c.cnt_contract_key) aanvraagnummer"
@@ -356,7 +416,7 @@ fac = {myfunctionssqlstring:
                      + "    ELSE '0'"
                      + "    END fiatteur"
                    : "    , ' '")
-                  + "      , NULL" // bes_bestelling_parentkey,
+                  + "      , NULL bes_bestelling_parentkey"
                  + "      , NULL prefix"
                  + "      , NULL uitvoerende"
                  + "      , CASE " + loc_count
@@ -374,7 +434,7 @@ fac = {myfunctionssqlstring:
                    + "      END gebouw"
                  + "      , NULL terrein"
                  + "  FROM prs_v_perslid_fullnames_all p"
-                  + "      , cnt_contract c"
+                  + "      , cnt_v_aanwezigcontract c"
                  + "      , ins_tab_discipline td"
                  + "      , prs_kostenplaats k"
                  + "      , fac_v_webgebruiker w"
@@ -383,6 +443,9 @@ fac = {myfunctionssqlstring:
                    ? ", fac_tracking ft"
                      + ", fac_srtnotificatie fno"
                    : "")
+                  + (filterlocatie
+                    ? ", cnt_contract_plaats cp"
+                    : "")
                  + " WHERE c.ins_discipline_key = td.ins_discipline_key"
                  + "   AND c.prs_perslid_key_beh = p.prs_perslid_key"
                  + "   AND c.prs_kostenplaats_key = k.prs_kostenplaats_key"
@@ -419,11 +482,17 @@ fac = {myfunctionssqlstring:
                      + " AND ft.fac_srtnotificatie_key = fno.fac_srtnotificatie_key"
                      + " AND fno.fac_srtnotificatie_code IN (" + (fiatstatus == "close"? "'CNTFIT'" : "'CNTREJ'") + ")"
                      + " AND ft.prs_perslid_key IN (" + prsKeys + ")")
+                  + (filterlocatie
+                    ? filter_gebonden
+                    : "")
+                  + (params.opdrtype_key
+                    ? " AND 0=1" // Er wordt gezocht naar een opdrachttype, die bestaan niet voor CNT.
+                    : "");
          return " SELECT * FROM (" + sql + ")";
        },


-        getSqlFiatMld: function(fiatstatus, prsKeys)
+        getSqlFiatMld: function(fiatstatus, prsKeys, params)
        { // opdrachten: te fiatteren op mijn budgetten
          var sql = " SELECT sd.ins_srtdiscipline_prefix || op.mld_melding_key || '/' || op.mld_opdr_bedrijfopdr_volgnr aanvraagnummer"
                  + "      , mld_opdr_datumbegin"
@@ -437,9 +506,9 @@ fac = {myfunctionssqlstring:
                  + "      , mld_opdr_datumbegin sortdate"
                  + "      , "+ lcl.xsql('td.ins_discipline_omschrijving','td.ins_discipline_key') +" categorie"
                  + (fiatstatus == "open"
-                    ? "    , p2.prs_perslid_naam_full fiatteur"
-                    : "    , ' '")
-                  + "      , NULL"
+                    ? "    , p2.prs_perslid_naam_full"
+                    : "    , ' '") + " fiatteur"
+                  + "      , NULL bes_bestelling_parentkey"
                  + "      , sd.ins_srtdiscipline_prefix prefix"
                  + "      , NULL uitvoerende"
                  + "      , CASE "
@@ -503,12 +572,20 @@ fac = {myfunctionssqlstring:
                      + "                          END"
                      + " AND p2.prs_perslid_key IN (" + prsKeys + ")"                                   // Wel ORDFOK tracking aanwezig. Neem kostenplaatsgroepverantwoordelijke
                    : " AND fno.fac_srtnotificatie_code = " + (fiatstatus == "close"? "'ORDFOK'" : "'ORDFNO'") // Er is gefiatteerd.
-                      + " AND ft.prs_perslid_key IN (" + prsKeys + ")"); // Gefiatterd door jezelf of waarvoor je vervanger bent
+                      + " AND ft.prs_perslid_key IN (" + prsKeys + ")") // Gefiatterd door jezelf of waarvoor je vervanger bent
+                  + (params.bld_key // sortering op gebouw, locatie of district
+                    ? " AND g.alg_gebouw_key = " + params.bld_key
+                    : (params.loc_key_arr
+                      ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                      : ""))
+                  + (params.opdrtype_key
+                    ? " AND ot.mld_typeopdr_key = " + params.opdrtype_key
+                    : "");
          return sql;
        },

        // opdrachten die eerst nog goedgekeurd moet worden (nog voordat ze gefiatteerd mogen worden)
-        getSqlGoedkeurMld: function(fiatstatus, prsKeys)
+        getSqlGoedkeurMld: function(fiatstatus, prsKeys, params)
        { // opdrachten: goedkeuren
          var sql = " SELECT sd.ins_srtdiscipline_prefix || op.mld_melding_key || '/' || op.mld_opdr_bedrijfopdr_volgnr aanvraagnummer"
                  + "      , mld_opdr_datumbegin"
@@ -522,7 +599,7 @@ fac = {myfunctionssqlstring:
                  + "      , mld_opdr_datumbegin sortdate"
                  + "      , "+ lcl.xsql('td.ins_discipline_omschrijving','td.ins_discipline_key') +" categorie"
                  + "      , ' ' fiatteur" // dat kunnen er meerdere met WEB_ORDGOE zijn
-                  + "      , NULL"
+                  + "      , NULL bes_bestelling_parentkey"
                  + "      , sd.ins_srtdiscipline_prefix prefix"
                  + "      , NULL uitvoerende"
                  + "      , CASE "
@@ -582,25 +659,69 @@ fac = {myfunctionssqlstring:
                  + "                                       FROM   fac_v_my_locations"
                  + "                                      WHERE   prs_perslid_key = p.prs_perslid_key"
                  + "                                              AND niveau = fac_gebruiker_alg_level_write)))"
-                  + "                  AND fac_functie_code = 'WEB_ORDGOE')"
+                  + (fiatstatus == "open"
+                    ? (S("mld_opdr_approval_all") == 0
+                      ? "                AND ((fac_functie_code = 'WEB_ORDGOE'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO2'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet2"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) = mdp.mld_disc_params_bestellimiet2)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO3'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet3"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) = mdp.mld_disc_params_bestellimiet3)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO4'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet4"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) = mdp.mld_disc_params_bestellimiet4)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO5'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet5"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) >= mdp.mld_disc_params_bestellimiet5)"
+                        + "                  )"
+                      : "                AND ((fac_functie_code = 'WEB_ORDGOE'"
+                        + "                    AND op.mld_opdr_kosten <= mdp.mld_disc_params_bestellimiet2"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO2'"
+                        + "                    AND op.mld_opdr_kosten <= mdp.mld_disc_params_bestellimiet3"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet2)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO3'"
+                        + "                    AND op.mld_opdr_kosten <= mdp.mld_disc_params_bestellimiet4"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet3)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO4'"
+                        + "                    AND op.mld_opdr_kosten <= mdp.mld_disc_params_bestellimiet5"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet4)"
+                        + "                OR (fac_functie_code = 'WEB_ORDGO5'"
+                        + "                    AND op.mld_opdr_kosten >= mdp.mld_disc_params_bestellimiet5"
+                        + "                    AND COALESCE(op.mld_opdr_approved, 0) <= mdp.mld_disc_params_bestellimiet5)"
+                        + "                  )")
+                    : "")
+                  + "              )"
                  + "    AND m.mld_alg_locatie_key = l.alg_locatie_key(+)"
                  + "    AND m.mld_alg_onroerendgoed_keys = onrg.alg_onroerendgoed_keys(+)"
                  + "    AND onrg.alg_gebouw_key = g.alg_gebouw_key(+)"
                  + "    AND onrg.alg_terreinsector_key = t.alg_terreinsector_key(+)"
-                 + (fiatstatus == "open"
-                    ? " AND op.mld_statusopdr_key = 10"
-                    :  " AND op.mld_statusopdr_key <> 10"
-                      + " AND mld_opdr_kosten > mdp.mld_disc_params_bestellimiet" // zo duur, moet wel een goedkeur geweest zijn
+                  + (fiatstatus == "open"
+                     ? " AND op.mld_statusopdr_key = 10"
+                     :  " AND mld_opdr_kosten > mdp.mld_disc_params_bestellimiet" // zo duur, moet wel een goedkeur geweest zijn
                      + " AND ft.fac_tracking_refkey = op.mld_opdr_key"
                      + " AND ft.prs_perslid_key IN (" + prsKeys + ")"
                      + " AND ft.fac_srtnotificatie_key = fno.fac_srtnotificatie_key"
-                      + " AND fno.fac_srtnotificatie_code = " + (fiatstatus == "close"? "'ORDFOK'" : "'ORDGNO'"));
-
+                      + " AND fno.fac_srtnotificatie_code IN"
+                      + (fiatstatus == "close"
+                        ? " ('ORDFOK', 'ORDGOE') AND m.prs_perslid_key != ft.prs_perslid_key" // Als goedkeurder ook de opdracht heeft aangemaakt dan komt opdracht niet in de gefiatteerd lijst. Is niet zo gemakkelijk en zal performance kosten.
+                        : " ('ORDGNO')"))
+                  + (params.bld_key // sortering op gebouw, locatie of district
+                    ? " AND g.alg_gebouw_key = " + params.bld_key
+                    : (params.loc_key_arr
+                      ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                      : ""))
+                  + (params.opdrtype_key
+                    ? " AND ot.mld_typeopdr_key = " + params.opdrtype_key
+                    : "");
          return sql;
        },

       // Offertes die geaccepteerd of afgewezen dienen te worden van meldingen waarvoor nog geen uitvoeringsopdracht is aangemaakt.
-        getSqlAccAfwOff: function()
+        getSqlAccAfwOff: function(params)
        { // opdrachten: accepten/afwijzen
          var sql = " SELECT o.mld_melding_key || '/' || o.mld_opdr_bedrijfopdr_volgnr aanvraagnummer"
                  + "      , mld_opdr_datumbegin"
@@ -614,7 +735,7 @@ fac = {myfunctionssqlstring:
                  + "      , mld_opdr_einddatum sortdate"
                  + "      , "+ lcl.xsql('td.ins_discipline_omschrijving','td.ins_discipline_key') +" categorie"
                  + "      , ' ' fiatteur" // dat kunnen er meerdere met WEB_ORDOAP zijn
-                  + "      , NULL"
+                  + "      , NULL bes_bestelling_parentkey"
                  + "      , sd.ins_srtdiscipline_prefix prefix"
                  + "      , COALESCE((SELECT b.prs_bedrijf_naam FROM prs_bedrijf b WHERE b.prs_bedrijf_key = o.mld_uitvoerende_keys),"
                  + "                 COALESCE((SELECT " + S("prs_pers_string") + " FROM prs_perslid p WHERE p.prs_perslid_key = o.mld_uitvoerende_keys),"
@@ -659,7 +780,15 @@ fac = {myfunctionssqlstring:
                  + "    AND m.mld_alg_locatie_key = l.alg_locatie_key(+)"
                  + "    AND m.mld_alg_onroerendgoed_keys = onrg.alg_onroerendgoed_keys(+)"
                  + "    AND onrg.alg_gebouw_key = g.alg_gebouw_key(+)"
-                  + "    AND onrg.alg_terreinsector_key = t.alg_terreinsector_key(+)";
+                  + "    AND onrg.alg_terreinsector_key = t.alg_terreinsector_key(+)"
+                  + (params.bld_key // sortering op gebouw, locatie of district
+                    ? " AND g.alg_gebouw_key = " + params.bld_key
+                    : (params.loc_key_arr
+                      ? " AND l.alg_locatie_key IN (" + params.loc_key_arr.join(",") + ")"
+                      : ""))
+                  + (params.opdrtype_key
+                    ? " AND ot.mld_typeopdr_key = " + params.opdrtype_key
+                    : "");
          return sql;
        },

--- a/APPL/FAC/fac_bookmark.asp
+++ b/APPL/FAC/fac_bookmark.asp
@@ -29,7 +29,7 @@ var bkm_title = "";
    <script type="text/javascript" >
 <%    if (bkm_id != "")
      { %>
-        FcltMgr.setTitle("<%=bkm_title%>", {hot: false});
+        FcltMgr.setTitle("<%=safe.jsstring(bkm_title)%>", {hot: false});
 <%    } %>

      function bkmClose(params)
@@ -49,7 +49,7 @@ var bkm_title = "";
          if (params.close)
            FcltMgr.closeDetail(window, {close: true})
          if (!params.keepForm)
-            $("#bkmFrame")[0].src = "fac_show_bookmark.asp?bkm_id=<%=bkm_id%>";
+            $("#bkmFrame")[0].src = "fac_show_bookmark.asp?bkm_id=<%=safe.jsstring(bkm_id)%>";
 <%      } %>
      }
    </script>
--- a/APPL/FAC/fac_edit_faq.asp
+++ b/APPL/FAC/fac_edit_faq.asp
@@ -137,7 +137,7 @@ else
          var sql = "SELECT '', '', 1 FROM DUAL";
          for (var i = 0; i< S("language_toggles").length; i++)
          {
-            sql += (sql != ""? " UNION ": "") + "SELECT " + "'" + S("language_toggles")[i] + "', '" + S("language_toggles")[i] + "', 2 FROM DUAL"
+            sql += (sql != ""? " UNION ": "") + "SELECT " + safe.quoted_sql(S("language_toggles")[i]) + ", " + safe.quoted_sql(S("language_toggles")[i]) + ", 2 FROM DUAL";
          }
          sql += " ORDER BY 3, 2";
          FCLTselector("fac_faq_lang", sql,
--- a/APPL/FAC/fac_edit_menu.asp
+++ b/APPL/FAC/fac_edit_menu.asp
@@ -286,7 +286,7 @@ function fncolGroep(oRsvalue)
                + "       fac_menuitems_label"
                + "  FROM fac_menuitems, fac_locale_xsl xsl"
                + " WHERE xsl.fac_locale_xsl_label(+) = fac_menuitems_label"
-                + "   AND xsl.fac_locale_xsl_lang(+) = '" + user.lang() + "'"
+                + "   AND xsl.fac_locale_xsl_lang(+) = " + safe.quoted_sql(user.lang())
                + " ORDER BY 2 ";

            FCLTselector("fac_mikey", sql,{  label: L("lcl_fac_menuoptie"),
--- a/APPL/FAC/fac_faq_search.asp
+++ b/APPL/FAC/fac_faq_search.asp
@@ -177,7 +177,7 @@ user.auth_required_or_abort(authparamsBOF || authparamsFOF || authparamsUSE);
                sql = "";
                for (var i = 0; i < S("language_toggles").length; i++)
                {
-                  sql += (sql != ""? " UNION ": "") + "SELECT " + "'" + S("language_toggles")[i] + "', '" + S("language_toggles")[i] + "', 2 FROM DUAL"
+                  sql += (sql != ""? " UNION ": "") + "SELECT " + safe.quoted_sql(S("language_toggles")[i]) + ", " + safe.quoted_sql(S("language_toggles")[i]) + ", 2 FROM DUAL";
                }
                sql += " ORDER BY 3, 2";
                FCLTselector("fac_faq_lang",
--- a/APPL/FAC/fac_fiattering_list.asp
+++ b/APPL/FAC/fac_fiattering_list.asp
@@ -36,7 +36,7 @@
            Ik heb gefiatteerd of afgewezen als er tracking is geweest
                BES) gefiateerd: 'BESFIT' (kostenplaatsverantwoordelijke) of 'BESACP'" (kostenplaatsgroepverantwoordelijke)
                     afgewezen:  'BESREJ'
-                MLD) gefiateerd: 'CNTFIT'
+                CNT) gefiateerd: 'CNTFIT'
                     afgewezen:  'CNTREJ'
                MLD) gefiateerd: 'ORDFOK'
                     afgewezen:  'ORDREJ'
@@ -61,9 +61,45 @@ var showall = getQParamInt("showall", 0) == 1;
 var getOpen = getQParamInt("open", 0) == 1;
 var getClosed = getQParamInt("close", 0) == 1;
 var getRejected = getQParamInt("reject", 0) == 1;
+var opdrtype_key = getQParamInt("opdrtype_key", -1); // Opdrachttype
+var dis_key = getQParamInt("districtkey", -1); // District
+var loc_key = getQParamInt("locatiekey", -1); // Locatie
+var bld_key = getQParamInt("gebouwkey", -1); // Gebouw
+
 if (!getOpen && !getClosed && !getRejected)
    getOpen = true;
-var params = {getopen: getOpen, getclosed: getClosed, getrejected: getRejected}
+
+var loc_key_arr = [];
+if (dis_key > -1)
+{
+  if (loc_key > -1)
+  { // Een locatie geselecteerd.
+    loc_key_arr.push(loc_key);
+  }
+  else
+  { // Zoek alle locaties die bij het gekozen district horen.
+    sqld = "SELECT alg_locatie_key"
+         + "  FROM alg_locatie"
+         + " WHERE alg_district_key = " + dis_key;
+    var oRsd = Oracle.Execute(sqld);
+    while (!oRsd.eof)
+    {
+      loc_key_arr.push(oRsd("alg_locatie_key").value);
+      oRsd.MoveNext();
+    }
+    oRsd.Close();
+  }
+}
+
+var params = { getopen: getOpen
+             , getclosed: getClosed
+             , getrejected: getRejected
+             , opdrtype_key: (opdrtype_key != -1 ? opdrtype_key : null)
+             , dist_key: (dis_key != -1 ? dis_key : null)
+             , loc_key: (loc_key != -1 ? loc_key : null)
+             , bld_key: (bld_key != -1 ? bld_key : null)
+             , loc_key_arr: (loc_key_arr.length > 0 ? loc_key_arr : null)
+             }

 FCLTHeader.Requires({ plugins: ["jQuery"], js: ["jquery-ui.js"] });
 %>
--- a/APPL/FAC/fac_fiattering_list.inc
+++ b/APPL/FAC/fac_fiattering_list.inc
@@ -33,64 +33,64 @@ function fiattering_sql(params)
    var sql = "";
    // Sql gedeelte voor bestellingen (BES) ophalen
    if (params.getopen)
-      sql = fac.getSqlFiatBes("open", prsKeys);  // Te fiatteren
+      sql = fac.getSqlFiatBes("open", prsKeys, params);  // Te fiatteren

    if (params.getclosed)
      sql = (params.getopen
            ? sql + " UNION ALL "
            : "")
-          + fac.getSqlFiatBes("close", prsKeys); // Gefiatteerd
+          + fac.getSqlFiatBes("close", prsKeys, params); // Gefiatteerd

    if (params.getrejected)
      sql = (params.getopen || params.getclosed
            ? sql + " UNION ALL "
            : "")
-          + fac.getSqlFiatBes("reject", prsKeys); // Afgewezen
+          + fac.getSqlFiatBes("reject", prsKeys, params); // Afgewezen

    // Sql gedeelte voor contracten (CNT) ophalen
    if (params.getopen)
      sql += " UNION ALL "
-           + fac.getSqlFiatCnt("open", prsKeys);  // Ter goedkeuring
+           + fac.getSqlFiatCnt("open", prsKeys, params);  // Ter goedkeuring

    if (params.getclosed)
      sql += " UNION ALL "
-           + fac.getSqlFiatCnt("close", prsKeys); // Goedgekeurd
+           + fac.getSqlFiatCnt("close", prsKeys, params); // Goedgekeurd

    if (params.getrejected)
      sql += " UNION ALL "
-           + fac.getSqlFiatCnt("reject", prsKeys); // Afgewezen
+           + fac.getSqlFiatCnt("reject", prsKeys, params); // Afgewezen

    // Sql gedeelte voor meldingen (MLD) ophalen
    if (params.getopen)
      sql += " UNION ALL "
-           + fac.getSqlFiatMld("open", prsKeys);  // Te fiatteren
+           + fac.getSqlFiatMld("open", prsKeys, params);  // Te fiatteren

    if (params.getclosed)
      sql += " UNION ALL "
-           + fac.getSqlFiatMld("close", prsKeys); // Gefiatteerd
+           + fac.getSqlFiatMld("close", prsKeys, params); // Gefiatteerd

    if (params.getrejected)
      sql += " UNION ALL "
-           + fac.getSqlFiatMld("reject", prsKeys); // Afgewezen
+           + fac.getSqlFiatMld("reject", prsKeys, params); // Afgewezen

    // Sql gedeelte voor goedkeur meldingen (MLD) ophalen
    if (params.getopen)
      sql += " UNION ALL "
-           + fac.getSqlGoedkeurMld("open", prsKeys);  // Goed te keuren
+           + fac.getSqlGoedkeurMld("open", prsKeys, params);  // Goed te keuren

    if (params.getclosed)
      sql += " UNION ALL "
-           + fac.getSqlGoedkeurMld("close", prsKeys); // Gefiatteerd
+           + fac.getSqlGoedkeurMld("close", prsKeys, params); // Gefiatteerd

    if (params.getrejected)
      sql += " UNION ALL "
-           + fac.getSqlGoedkeurMld("reject", prsKeys); // Afgewezen
+           + fac.getSqlGoedkeurMld("reject", prsKeys, params); // Afgewezen


    if (haveORDOAPrights && params.getopen)
    {
      sql += " UNION ALL "
-           + fac.getSqlAccAfwOff(); // Te accepteren/Af te wijzen offertes (offerte opdrachten) van meldingen waarvoor nog geen uitvoeringsopdracht is aangemaakt.
+           + fac.getSqlAccAfwOff(params); // Te accepteren/Af te wijzen offertes (offerte opdrachten) van meldingen waarvoor nog geen uitvoeringsopdracht is aangemaakt.
    }

    sql = "SELECT * FROM (" + sql + ") ORDER BY sortdate, aanvraagnummer ASC";
--- a/APPL/FAC/fac_fiattering_search.asp
+++ b/APPL/FAC/fac_fiattering_search.asp
@@ -18,20 +18,23 @@

 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../Shared/iface.inc" -->
+<!-- #include file="../Shared/selector.inc" -->
+<!-- #include file="../Shared/plaatsselector.inc" -->

 <%
 FCLTHeader.Requires({plugins:["jQuery"], js: ["jquery-ui.js"]});

 var autosearch = getQParamInt("autosearch", 1) == 1;
+var opdrtype_key = getQParamInt("opdrtype_key", -1); // Opdrachttype
+var dis_key = getQParamInt("district_key", -1); // District
+var loc_key = getQParamInt("locatie_key", -1); // Locatie
+var bld_key = getQParamInt("gebouw_key", -1); // Gebouw
 var getOpen = getQParamInt("open", 0) == 1;
 var getClosed = getQParamInt("close", 0) == 1;
 var getRejected = getQParamInt("reject", 0) == 1;
 if (!getOpen && !getClosed && !getRejected)
    getOpen = true;

-var autfunction = "WEB_ORDOAP";
-var haveORDOAPrights = user.checkAutorisation(autfunction, true);
-
 %>
 <html>
  <head>
@@ -67,11 +70,60 @@ var haveORDOAPrights = user.checkAutorisation(autfunction, true);
      <form name="u2" method="get" action="fac_fiattering_list.asp" target="workFrame">
 <%      BLOCK_START("searchtable", L("lcl_filterblok"));%>
        <tr>
-          <td><label><%=L("lcl_status")%>:</label></td>
-          <td><input id="copen" name="open" type="checkbox" value="1" <%=getOpen?"checked":""%> onClick="checkCheckboxes()"></td><td><label for="copen"><%=L("lcl_bes_chek1")%></label></td>
-          <td><input id="cclose" name="close" type="checkbox" value="1" <%=getClosed?"checked":""%> onClick="checkCheckboxes()"></td><td><label for="cclose"><%=L("lcl_fac_gefiatteerd")%></label></td>
-          <td><input id="creject" name="reject" type="checkbox" value="1" <%=getRejected?"checked":""%> onClick="checkCheckboxes()"></td><td><label for="creject"><%=L("lcl_fac_afgewezen")%></label></td>
+          <td class="searchkolom1"><!-- start column 1 -->
+            <table><!-- x rijen, 2 kolommen: label + veld -->
+              <!-- Locatie/gebouw -->
+<%
+// Weet niet zeker of het volgende dekkend is
+//var autfunctions = 'WEB_MLD,USEWEB_INSMAN,WEB_INSUSE,WEB_ALGMAN,WEB_ALGUSE,WEB_MLDBO2,WEB_ORDBO2,WEB_MLDBOF';
+//var authparams = user.checkAutorisation(autfunctions.split(","));
+
+              FCLTplaatsselector(-1,
+                                 { districtkey: dis_key,
+                                   locatiekey: loc_key,
+                                   gebouwkey: bld_key,
+                                   startlevel: 1, // district
+                                   eindlevel: 3, // gebouw
+                                   terrein: true,
+                                   whenEmpty: L("lcl_search_generic")  // want filter
+                                 });
+%>
+            </table>
+          </td><!-- end column 1 -->
+
+          <!-- Second column -->
+          <td class="searchkolom2">
+            <table><!-- x rijen, 2 kolommen: label + veld -->
+              <!-- Opdrachttype -->
+<%            sql = "SELECT mld_typeopdr_key"
+                  + ", mld_typeopdr_omschrijving"
+                  + " FROM mld_typeopdr"
+                  + " ORDER BY 2"
+              FCLTselector("opdrtype_key",
+                           sql,
+                           { initKey: opdrtype_key,
+                             label: L("lcl_mld_typeopdr"),
+                             trclass: "primsearch",
+                             emptyOption: "",
+                             initEmpty: true
+                           })
+%>
+            </table>
+          </td><!-- end column 2 -->
        </tr>
+
+        <!-- Status checkboxen -->
+        <tr>
+          <td colspan="2">
+            <div id="statusboxes">
+              <label><%=L("lcl_status")%>:</label>
+              <input id="copen" name="open" type="checkbox" value="1" <%=getOpen?"checked":""%> onClick="checkCheckboxes()"><label for="copen"><%=L("lcl_bes_chek1")%></label>
+              <input id="cclose" name="close" type="checkbox" value="1" <%=getClosed?"checked":""%> onClick="checkCheckboxes()"><label for="cclose"><%=L("lcl_fac_gefiatteerd")%></label>
+              <input id="creject" name="reject" type="checkbox" value="1" <%=getRejected?"checked":""%> onClick="checkCheckboxes()"><label for="creject"><%=L("lcl_fac_afgewezen")%></label>
+            </div>
+          </td>
+        </tr>
+
 <%      BLOCK_END();

        CreateButtons([{title: L("lcl_search"), action: "document.forms.u2.submit()"}]);
--- a/APPL/FAC/fac_iirf.ini
+++ b/APPL/FAC/fac_iirf.ini
@@ -0,0 +1,24 @@
+# IsapiRewrite4.ini
+#
+# ini file for the ISAPI rewriter.
+#
+#
+# $Id$
+#
+
+# RewriteLog  c:\temp\iirf2
+# RewriteLogLevel 0
+
+RewriteHeader FCLT-REWRITER ^$ 1.00
+
+RewriteBase ON
+
+# /api2/buildings/1234.xml?apikey=apikey123          /default.asp?api2=buildings&format=xml&id=1234&apikey=apikey123
+RewriteRule ^/api2/([a-z]+)/(\d+)\.(xml|json|html)/? /default.asp?api2=$1&format=$3&id=$2 [QSA]
+
+# /api2/buildings.xml?apikey=apikey123               /default.asp?api2=buildings&format=xml&apikey=apikey123
+RewriteRule ^/api2/([a-z]+)\.(xml|json|html)/?       /default.asp?api2=$1&format=$2 [QSA]
+
+# /melding/1234          /appl/mld/mld_melding.asp?mld_key=1234
+# Geeft relatieve pad problemen
+# RewriteRule ^/melding/(\d+)       /appl/mld/mld_melding.asp?mld_key=$1 [QSA]
--- a/APPL/FAC/fac_kenmerkdomein.asp
+++ b/APPL/FAC/fac_kenmerkdomein.asp
@@ -42,6 +42,7 @@ if (domein_key > 0)
                domein_objectnaam: oRs("fac_kenmerkdomein_objectnaam").value,
                domein_kolomnaam: oRs("fac_kenmerkdomein_kolomnaam").value,
                domein_kolomtxt: oRs("fac_kenmerkdomein_kolomtxt").value,
+                domein_kolomverval: oRs("fac_kenmerkdomein_verval").value,
                domein_xmlnode: oRs("fac_kenmerkdomein_xmlnode").value,
                fac_usrtab_key: oRs("fac_usrtab_key").value,
                fac_usrtab_omschrijving: oRs("fac_usrtab_omschrijving").value
@@ -70,6 +71,7 @@ else
                          { dbs: "fac_kenmerkdomein_objectnaam", typ: "varchar", frm: "objectnaam" },
                          { dbs: "fac_kenmerkdomein_kolomnaam", typ: "varchar", frm: "kolomnaam" },
                          { dbs: "fac_kenmerkdomein_kolomtxt", typ: "varchar", frm: "kolomtxt" },
+                          { dbs: "fac_kenmerkdomein_verval", typ: "varchar", frm: "kolomverval" },
                          { dbs: "fac_kenmerkdomein_module", typ: "varchar", frm: "module" },
                          { dbs: "fac_kenmerkdomein_xmlnode", typ: "varchar", frm: "xmlnode" },
                          { dbs: "fac_usrtab_key", typ: "key", frm: "usrtabkey" }
@@ -225,6 +227,7 @@ else
        myRWFIELD("objectnaam", "fld", L("lcl_kenmerkdomein_objectnaam"), domein.domein_objectnaam);
        myRWFIELD("kolomnaam", "fld", L("lcl_kenmerkdomein_kolomnaam"), domein.domein_kolomnaam);
        myRWFIELD("kolomtxt", "fld", L("lcl_kenmerkdomein_kolomtxt"), domein.domein_kolomtxt);
+        myRWFIELD("kolomverval", "fld", L("lcl_kenmerkdomein_verval"), domein.domein_kolomverval);
        myRWFIELD("xmlnode", "fld", L("lcl_kenmerkdomein_xmlnode"), domein.domein_xmlnode);
        BLOCK_END();
 IFACE.FORM_END();
--- a/APPL/FAC/fac_like.asp
+++ b/APPL/FAC/fac_like.asp
@@ -7,18 +7,22 @@
     Description:   Beoordelen van een (eigen) afgehandelde melding etc
     Parameters:    key
                    xmlnode
-     Context:       vanuit de lijst van eigen afgemelden zaken
-     Status:        Opzetje
+     Context:       vanuit de lijst van eigen afgemelde zaken
+                    of een deeplink vanuit een bon

 */ %>
 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../Shared/iface.inc" -->
+<!-- #include file="./fac_like.inc" -->
 <%
 FCLTHeader.Requires({ plugins: ["jQuery"] });

 var key = getQParamInt("key");
 var node = getQParam("node");

+var this_like = like.func_enabled_like(key, node);
+user.auth_required_or_abort(this_like.canChange);
+
 var oordeel = getFParam("oordeel", null);
 var TransitParam = buildTransitParam(["key", "node"]);

@@ -34,27 +38,39 @@ var TransitParam = buildTransitParam(["key", "node"]);
  </head>

  <script type="text/javascript">
+
    function fac_cancel()
    {
      FcltMgr.closeDetail(window, { cancel: true } );
    }

-    function setOordeel(w)
+    function fac_submit()
    {
-      $("#oordeel").val(w);
+      if (!$("[name=flike_oordeel]:checked").val())
+      {
+        alert("<%=L('lcl_fac_like_geenoordeel')%>");
+        return false;
+      }
      $.post($("form[name=flike]")[0].action, $("[name=flike]").serialize(), FcltCallbackClose, "json");
      return true; // disable button
    }
+
+    function togglerPressed()
+    {
+      $("#flike_opmerk").show();
+      FcltMgr.resized(window);
+    }
  </script>

  <body class="modal" id="fac_like">
    <form id="flike" name="flike" action="fac_like_save.asp?x=x<%=TransitParam%>" method="post">
-        <input id="oordeel" name="oordeel" type="hidden">
 <%
      BLOCK_START("facLike", L("lcl_fac_like_block"));
+      var table = "";
      var txt= "??";
      switch (node) {
-         case "melding"    : var sql = "SELECT isd.ins_srtdiscipline_prefix || TO_CHAR (m.mld_melding_key) item"
+         case "melding"    : table = "mld_melding";
+                             var sql = "SELECT isd.ins_srtdiscipline_prefix || TO_CHAR (m.mld_melding_key) item"
                                     + "  FROM mld_melding m"
                                     + "     , ins_srtdiscipline isd"
                                     + "     , ins_tab_discipline id"
@@ -65,21 +81,55 @@ var TransitParam = buildTransitParam(["key", "node"]);
                                     + "   AND m.mld_melding_key = " + key;
                             oRs = Oracle.Execute(sql);
                             txt = L("lcl_complain").toLowerCase() + " " + oRs("item").Value;  break;
-         case "reservering": txt = L("lcl_reservation").toLowerCase() + " R" + key; break;
-         case "bestelling" : txt = L("lcl_bes_bestelling").toLowerCase() + " B" + key;  break;
+                             oRs.Close();
+         case "reservering": table = "res_rsv_ruimte";
+                             var sql = "SELECT TO_CHAR(res_reservering_key) || '/' || TO_CHAR(res_rsv_ruimte_volgnr) item"
+                                     + "  FROM res_rsv_ruimte"
+                                     + " WHERE res_rsv_ruimte_key = " + key;
+                             oRs = Oracle.Execute(sql);
+                             txt = L("lcl_reservation").toLowerCase() + " R" + oRs("item").Value; break;
+                             oRs.Close();
+         case "bestelling" : table = "bes_bestelling";
+                             txt = L("lcl_bes_bestelling").toLowerCase() + " B" + key;  break;
      }
+      var sql = "SELECT " + table + "_satisfaction"
+              + ", "      + table + "_satisfaction_op"
+              + "  FROM " + table
+              + " WHERE " + table + "_key = " + key;
+      var oRs = Oracle.Execute(sql);
+      var oordeel = oRs(0).value;
+      var opmerking = oRs(1).value;
+      oRs.Close();
 %>
      <div class="flikehead"><%=L("lcl_fac_like_oordeel").format(txt)%></div>
      <ul class="flikeopts">
-         <li><a onclick="setOordeel(<%=S('fac_like_good')%>)" class="flike"><img src='../Pictures/flike_good.png'><%=L("lcl_faclike_statisf3")%></a></li>
-         <li><a onclick="setOordeel(<%=S('fac_like_normal')%>)" class="flike"><img src='../Pictures/flike_normal.png'><%=L("lcl_faclike_statisf2")%></a></li>
-         <li><a onclick="setOordeel(<%=S('fac_like_bad')%>)" class="flike"><img src='../Pictures/flike_bad.png'><%=L("lcl_faclike_statisf1")%></a></li>
+        <li>
+          <input type="radio" id="flike_oordeel" name="flike_oordeel" value="<%=S('fac_like_good')%>"<%=(oordeel==S("fac_like_good")? " checked" : "")%>>
+          <img src="../Pictures/flike_good.png">&nbsp&nbsp<%=L("lcl_faclike_statisf3")%>
+        </li>
+        <li>
+          <input type="radio" id="flike_oordeel" name="flike_oordeel" value="<%=S('fac_like_normal')%>"<%=(oordeel==S("fac_like_normal")? " checked" : "")%>>
+          <img src="../Pictures/flike_normal.png">&nbsp&nbsp<%=L("lcl_faclike_statisf2")%>
+        </li>
+        <li>
+          <input type="radio" id="flike_oordeel" name="flike_oordeel" value="<%=S('fac_like_bad')%>"<%=(oordeel==S("fac_like_bad")? " checked" : "")%>>
+          <img src="../Pictures/flike_bad.png">&nbsp&nbsp<%=L("lcl_faclike_statisf1")%>
+        </li>
      </ul>
+
+      <div id="flike_op">
+        <img src="../pictures/togglerdown.png" onClick="togglerPressed()">
+        <label onClick="togglerPressed()"><%=L("lcl_fac_like_remark")%></label>
+      </div>
+      <textarea class="fldtxt" rows="3" maxlength="2000" id="flike_opmerk" name="flike_opmerk"
+                    style="<%=(opmerking ? null : "display:none")%>"><%=safe.textarea(opmerking)%></textarea>
+
      <div class="flikefoot"><%=L("lcl_fac_help_improve")%></div>
 <%
      BLOCK_END();
      buttons = [];

+      buttons.push({title: L("lcl_fac_like_submit"), icon: "submit.png", action: "fac_submit()" });
      buttons.push({title: L("lcl_cancel"), icon: "cancel.png", action: "fac_cancel()" });
      CreateButtons(buttons);
      IFACE.FORM_END();
--- a/APPL/FAC/fac_like.inc
+++ b/APPL/FAC/fac_like.inc
@@ -0,0 +1,36 @@
+<% /*
+     $Revision$
+     $Id$
+
+     File:    fac/fac_like.inc
+     Context:
+
+     Hulpfuncties voor fac_like
+*/
+
+like = {
+          // TODO: S("facilities_flike_past") er nog in betrekken?
+
+          // Autorisatie is relatief simpel: hij moet op jou naam staan of je moet contactpersoon zijn
+          func_enabled_like: function (key, node)
+          {
+            var result = {};
+            var sql;
+            switch (node.toUpperCase().substring(0,1))
+            {
+                case "M": sql = "SELECT prs_perslid_key, prs_perslid_key_voor FROM mld_melding WHERE mld_melding_key = " + key; break;
+                case "R": sql = "SELECT res_rsv_ruimte_host_key, res_rsv_ruimte_contact_key FROM res_rsv_ruimte WHERE res_rsv_ruimte_key = " + key; break;
+                case "B": sql = "SELECT prs_perslid_key, prs_perslid_key_voor FROM bes_bestelling WHERE bes_bestelling_key = " + key; break;
+                default: INTERNAL_ERROR_UNKNOWN_LIKENODE;
+            }
+            var oRs = Oracle.Execute(sql);
+            if (!oRs.Eof)
+            {
+                result.canChange = oRs(0).Value == user_key || oRs(1).Value == user_key;
+            }
+            oRs.Close();
+
+            return result;
+          }
+       }
+%>
--- a/APPL/FAC/fac_like_save.asp
+++ b/APPL/FAC/fac_like_save.asp
@@ -3,45 +3,45 @@
     $Revision$
     $Id$

-     File:          fac_like.asp
-     Description:   Beoordelen van een (eigen) afgehandelde melding etc
+     File:          fac_like_save.asp
+     Description:   Opsla script voor fac_like.asp
     Parameters:    key
                    xmlnode
-     Context:       vanuit de lijst van eigen afgemelden zaken
-     Status:        Opzetje
-
 */ %>
 <%
 JSON_Result = true;
 %>
 <!-- #include file="../Shared/common.inc" -->
 <!-- #include file="../Shared/json2.js" -->
+<!-- #include file="./fac_like.inc" -->
 <%
 protectRequest.validateToken();
+
 var result = { message: "", success: false };
 var key = getQParamInt("key");
 var node = getQParam("node");

-var oordeel = getFParamInt("oordeel");
-var TransitParam = buildTransitParam(["key", "node"]);
+var this_like = like.func_enabled_like(key, node);
+user.auth_required_or_abort(this_like.canChange);

-
-// validatie:
-// is het van mij
-// mag ik het etc.
+var oordeel = getFParamInt("flike_oordeel");
+var opmerking = getFParam("flike_opmerk", "");

 if (oordeel)
 {
-  var sql;
+  var table = "";
  switch (node.toUpperCase().substring(0,1))
  {
-      case "M": sql = "UPDATE mld_melding SET mld_melding_satisfaction = " + oordeel + " WHERE mld_melding_key = " + key; break;
-      case "R": sql = "UPDATE res_rsv_ruimte SET res_rsv_ruimte_satisfaction = " + oordeel + " WHERE res_rsv_ruimte_key = " + key; break;
-      case "B": sql = "UPDATE bes_bestelling SET bes_bestelling_satisfaction = " + oordeel + " WHERE bes_bestelling_key = " + key; break;
-      default: sql = null;
+      case "M": table = "mld_melding"; break;
+      case "R": table = "res_rsv_ruimte"; break;
+      case "B": table = "bes_bestelling"; break;
+      default: INTERNAL_ERROR_UNKNOWN_LIKENODE;
  }
-  if (sql)
-    Oracle.Execute(sql);
+  var sql = "UPDATE " + table
+          + "   SET " + table + "_satisfaction = " + oordeel
+          + "     , " + table + "_satisfaction_op = " + safe.quoted_sql(opmerking)
+          + " WHERE " + table + "_key = " + key;
+  Oracle.Execute(sql);
 }

 result.success = true;
--- a/APPL/FAC/fac_list.asp
+++ b/APPL/FAC/fac_list.asp
@@ -115,8 +115,10 @@ function isGereed(pxmlnode, pstatuskey)
  return isgereed;
 }

-function fnLike(oRs)
+function fnLike(oRs, processParams)
 {
+  var isRemote = (processParams && processParams.disc_key);
+
  var likesymbol = "";
  var xmlnode = oRs.Fields("xmlnode").Value;
  var statuskey = oRs.Fields("status_key").Value;
@@ -124,9 +126,9 @@ function fnLike(oRs)

  if (isGereed(xmlnode, (xmlnode == "reservering"? bostatuskey : statuskey)))
  {
-    //likesymbol = "<img src='" + shared.satisfactionsymbol(oRs.Fields("satisfaction").Value, {shownone: true}) + "'>";
-    likesymbol = rater(oRs.Fields("satisfaction").Value, {shownone: true, readonly: true});
-    likesymbol = "<div onclick='fLike(event, \"" + oRs.Fields("item_key").Value + "\", \"" + oRs.Fields("xmlnode").Value +"\")'>" + likesymbol + "</div>";
+    likesymbol = "<img src='" + shared.satisfactionsymbol(oRs.Fields("satisfaction").Value, {shownone: true}) + "' title='" + safe.htmlattr(oRs.Fields("satisfaction_op").Value) + "'>";
+    //likesymbol = rater(oRs.Fields("satisfaction").Value, {shownone: true, readonly: true});
+    likesymbol = "<div onclick='fLike(event, \"" + oRs.Fields("item_key").Value + "\", \"" + oRs.Fields("xmlnode").Value +"\", "+(isRemote?1:0)+")'>" + likesymbol + "</div>";
  }
  return likesymbol;
 }
@@ -210,7 +212,7 @@ function sqlTracking(refkey, node)
  <head>
 <%  FCLTHeader.Generate({outputmode: outputmode}) %>
    <script type='text/javascript'>
-      function facDetail(row)
+      function facDetail(row, autolike)
      {
        var facData = eval('(' + row.getAttribute("ROWDATA") + ')');
        var item_key = row.getAttribute("ROWKEY");
@@ -223,8 +225,11 @@ function sqlTracking(refkey, node)
          case "reservering":
              if (facData.disc_key)
              {
-                url = "appl/res/res_goto_extern.asp?res_disc_key=" + facData.disc_key + "&deepurl=" + escape(facData.deepurl);
-                FcltMgr.openDetail(url, { reuse: true, is_extern: true, titel: L("lcl_reservation") + " " + facData.item });
+                var deepurl = facData.deepurl;
+                if (autolike)
+                    deepurl += "&autolike=1";
+                url = "appl/res/res_goto_extern.asp?res_disc_key=" + facData.disc_key + "&deepurl=" + escape(deepurl);
+                FcltMgr.openDetail(url, { reuse: true, is_extern: true, titel: L("lcl_reservation_extern") + " " + facData.item });
              }
              else // Gewoon intern
                FcltMgr.openDetail("appl/res/res_reservering.asp?urole=<%=urole%>&rsv_ruimte_key=" + item_key, { reuse: true });
@@ -238,11 +243,18 @@ function sqlTracking(refkey, node)
        }
      }

-       function fLike (event, itemkey, node)
+       function fLike (event, itemkey, node, isRemote)
       {
-         // Dit is een opzetje, moet vast anders.
         FcltMgr.stopPropagation(event);
-         FcltMgr.openModalDetail("fac_like.asp?key=" + itemkey + "&node=" + node, L("lcl_fac_like"), {callback: FcltCallbackRefresh});
+         if (!isRemote)
+         {
+            FcltMgr.openModalDetail("fac_like.asp?key=" + itemkey + "&node=" + node, L("lcl_fac_like"), {callback: FcltCallbackRefresh});
+         }
+         else
+         {
+            var deze = event.srcElement || event.target;
+            facDetail($(deze).closest("tr")[0], true);
+         }

       }
    </script>
@@ -284,6 +296,7 @@ function sqlTracking(refkey, node)
               : "   ,   " + lcl.xsql('sm.mld_stdmelding_omschrijving', 'sm.mld_stdmelding_key') + " detail")
             + "     , ' ' status"
             + "     , m.mld_melding_satisfaction satisfaction"
+             + "     , m.mld_melding_satisfaction_op satisfaction_op"
             + "     , m.mld_melding_status status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('m.mld_melding_key', 'melding')
@@ -304,9 +317,7 @@ function sqlTracking(refkey, node)
             + "      OR (m.mld_melding_status IN (1, 5, 6)"
             + "          AND tr.fac_tracking_datum > SYSDATE - " + S("facilities_flike_past")
             + "          AND str.fac_srtnotificatie_code = 'MLDAFM'))"
-             + (!showall
-               ? " AND (m.mld_melding_einddatum BETWEEN SYSDATE - " + S("facilitiespast_mld") + " AND SYSDATE + " + S("facilitiesfuture_mld") + " OR m.mld_melding_einddatum IS NULL)"
-               : "")
+             + "   AND (m.mld_melding_einddatum BETWEEN SYSDATE - " + S("facilitiespast_mld") + " AND SYSDATE + " + S("facilitiesfuture_mld") + " OR m.mld_melding_einddatum IS NULL)"
             + " UNION ALL "
             + "SELECT m.prs_perslid_key_voor prs_perslid_key"  // melding voor jou
             + "     , isd.ins_srtdiscipline_prefix || TO_CHAR (m.mld_melding_key) item"
@@ -321,6 +332,7 @@ function sqlTracking(refkey, node)
               : "   ,   " + lcl.xsql('sm.mld_stdmelding_omschrijving', 'sm.mld_stdmelding_key') + " detail")
             + "     , ' ' status"
             + "     , m.mld_melding_satisfaction satisfaction"
+             + "     , m.mld_melding_satisfaction_op satisfaction_op"
             + "     , m.mld_melding_status status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('m.mld_melding_key', 'melding')
@@ -342,9 +354,7 @@ function sqlTracking(refkey, node)
             + "      OR (m.mld_melding_status IN (1, 5, 6)"
             + "          AND tr.fac_tracking_datum > SYSDATE - " + S("facilities_flike_past")
             + "          AND str.fac_srtnotificatie_code = 'MLDAFM'))"
-             + (!showall
-               ? " AND (m.mld_melding_einddatum BETWEEN SYSDATE - " + S("facilitiespast_mld") + " AND SYSDATE + " + S("facilitiesfuture_mld") + " OR m.mld_melding_einddatum IS NULL)"
-               : "")
+             + "   AND (m.mld_melding_einddatum BETWEEN SYSDATE - " + S("facilitiespast_mld") + " AND SYSDATE + " + S("facilitiesfuture_mld") + " OR m.mld_melding_einddatum IS NULL)"
             + " UNION ALL "
             + "SELECT b.prs_perslid_key prs_perslid_key" // Bestelling door jou
             + "     , TO_CHAR (bes_bestelling_key)"
@@ -362,7 +372,8 @@ function sqlTracking(refkey, node)
             + "                                         AND bi.bes_srtdeel_key = sd.bes_srtdeel_key "
             + "                                         AND bi.bes_bestelling_key = b.bes_bestelling_key)) oms"
             + "     , ' ' status"
-             + "     , b.bes_bestelling_satisfaction"
+             + "     , b.bes_bestelling_satisfaction satisfaction"
+             + "     , b.bes_bestelling_satisfaction_op satisfaction_op"
             + "     , b.bes_bestelling_status status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('bes_bestelling_key', 'bestelling')
@@ -376,9 +387,7 @@ function sqlTracking(refkey, node)
             + "   AND b.fac_activiteit_key IS NULL"
             + "   AND b.bes_bestelling_key = tr.fac_tracking_refkey(+)"
             + "   AND tr.fac_srtnotificatie_key = str.fac_srtnotificatie_key(+)"
-             + (!showall
-               ? " AND (b.bes_bestelling_leverdatum BETWEEN SYSDATE - " + S("facilitiespast_bes") + " AND SYSDATE + " + S("facilitiesfuture_bes") + " OR b.bes_bestelling_leverdatum IS NULL)"
-               : "")
+             + "   AND (b.bes_bestelling_leverdatum BETWEEN SYSDATE - " + S("facilitiespast_bes") + " AND SYSDATE + " + S("facilitiesfuture_bes") + " OR b.bes_bestelling_leverdatum IS NULL)"
             + " UNION "
             + "SELECT b.prs_perslid_key_voor prs_perslid_key" // Bestelling voor jou
             + "     , TO_CHAR (bes_bestelling_key)"
@@ -399,6 +408,7 @@ function sqlTracking(refkey, node)
             + "                                         AND bi.bes_bestelling_key = b.bes_bestelling_key)) oms"
             + "     , ' ' status"
             + "     , b.bes_bestelling_satisfaction"
+             + "     , b.bes_bestelling_satisfaction_op satisfaction_op"
             + "     , b.bes_bestelling_status status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('bes_bestelling_key', 'bestelling')
@@ -412,9 +422,7 @@ function sqlTracking(refkey, node)
             + "   AND b.bes_bestelling_key = tr.fac_tracking_refkey(+)"
             + "   AND tr.fac_srtnotificatie_key = str.fac_srtnotificatie_key(+)"
             + "   AND b.prs_perslid_key_voor <> b.prs_perslid_key"  // die had ik in het vorige stuk ook al
-             + (!showall
-               ? " AND (b.bes_bestelling_leverdatum BETWEEN SYSDATE - " + S("facilitiespast_bes") + " AND SYSDATE + " + S("facilitiesfuture_bes") + " OR b.bes_bestelling_leverdatum IS NULL)"
-               : "")
+             + "   AND (b.bes_bestelling_leverdatum BETWEEN SYSDATE - " + S("facilitiespast_bes") + " AND SYSDATE + " + S("facilitiesfuture_bes") + " OR b.bes_bestelling_leverdatum IS NULL)"
             + " UNION ALL "
             + "SELECT ins_alg_ruimte_key prs_perslid_key"
             + "     , ins_deel_omschrijving"
@@ -424,6 +432,7 @@ function sqlTracking(refkey, node)
             + "     , " + lcl.xsql('sd.ins_srtdeel_omschrijving', 'sd.ins_srtdeel_key')  //tt
             + "     , ' ' status"
             + "     , to_number(null) satisfaction"
+             + "     , NULL satisfaction_op"
             + "     , NULL status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('ins_deel_key', 'deel')
@@ -441,6 +450,7 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
@@ -453,9 +463,7 @@ function sqlTracking(refkey, node)
             + "            AND str.fac_srtnotificatie_code = 'RESAFM'))"
             + "   AND rr.res_rsv_ruimte_key = tr.fac_tracking_refkey(+)"
             + "   AND tr.fac_srtnotificatie_key = str.fac_srtnotificatie_key(+)"
-             + (!showall
-               ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-               : "")
+             + "   AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION " // 2 Contact ruimtereservering
             + "SELECT rr.res_rsv_ruimte_contact_key prs_perslid_key"
             + "     , TO_CHAR (rr.res_reservering_key) || '/' || rr.res_rsv_ruimte_volgnr"
@@ -467,14 +475,13 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
             + "  FROM res_v_aanwezigrsv_ruimte rr"
             + " WHERE rr.res_status_bo_key IN (4, 3, 2, 7)"
-             + (!showall
-               ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-               : "")
+             + "   AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION ALL " // 3 Host voorzieningreservering, dirtlevel van de onderliggenden bepalen?
             + "SELECT rr.res_rsv_ruimte_host_key prs_perslid_key"
             + "     , TO_CHAR (rr.res_reservering_key) || '/' || rr.res_rsv_ruimte_volgnr"
@@ -486,15 +493,14 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel + res_rsv_deel_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
             + "  FROM res_v_aanwezigrsv_ruimte rr"
             + "     , res_v_aanwezigrsv_deel dd"
             + " WHERE rr.res_status_bo_key IS NULL AND dd.res_rsv_ruimte_key = rr.res_rsv_ruimte_key"
-             + (!showall
-               ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-               : "")
+             + " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION " // 4 Contact voorzieningreservering dirtlevel van de onderliggenden bepalen?
             + "SELECT rr.res_rsv_ruimte_contact_key prs_perslid_key"
             + "     , TO_CHAR (rr.res_reservering_key) || '/' || rr.res_rsv_ruimte_volgnr"
@@ -506,15 +512,14 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel + res_rsv_deel_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
             + "  FROM res_v_aanwezigrsv_ruimte rr"
             + "     , res_v_aanwezigrsv_deel dd"
             + " WHERE rr.res_status_bo_key IS NULL AND dd.res_rsv_ruimte_key = rr.res_rsv_ruimte_key"
-             + (!showall
-                ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-                : "")
+             + "   AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION ALL " // 5 Host cateringreservering dirtlevel van de onderliggenden bepalen?
             + "SELECT rr.res_rsv_ruimte_host_key prs_perslid_key"
             + "     , TO_CHAR (rr.res_reservering_key) || '/' || rr.res_rsv_ruimte_volgnr"
@@ -526,15 +531,14 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel + res_rsv_artikel_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
             + "  FROM res_v_aanwezigrsv_ruimte rr"
             + "     , res_v_aanwezigrsv_artikel dd"
             + " WHERE rr.res_status_bo_key IS NULL AND dd.res_rsv_ruimte_key = rr.res_rsv_ruimte_key "
-             + (!showall
-               ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-               : "")
+             + "   AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION " // 6 Contact cateringreservering dirtlevel van de onderliggenden bepalen?
             + "SELECT rr.res_rsv_ruimte_contact_key prs_perslid_key"
             + "     , TO_CHAR (rr.res_reservering_key) || '/' || rr.res_rsv_ruimte_volgnr"
@@ -546,15 +550,14 @@ function sqlTracking(refkey, node)
             + "                                                   WHERE   res_activiteit_key = rr.res_activiteit_key)) oms"
             + "     , ' ' status"
             + "     , res_rsv_ruimte_satisfaction satisfaction"
+             + "     , res_rsv_ruimte_satisfaction_op satisfaction_op"
             + "     , DECODE (res_rsv_ruimte_dirtlevel + res_rsv_artikel_dirtlevel, 0, rr.res_status_fo_key, -1) status_key"
             + "     , rr.res_status_bo_key bo_status_key"
             + sqlTracking("rr.res_rsv_ruimte_key","reservering")
             + "  FROM   res_v_aanwezigrsv_ruimte rr"
             + "     , res_v_aanwezigrsv_artikel dd"
             + " WHERE rr.res_status_bo_key IS NULL AND dd.res_rsv_ruimte_key = rr.res_rsv_ruimte_key"
-             + (!showall
-               ? " AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
-               : "")
+             + "   AND (rr.res_rsv_ruimte_van BETWEEN SYSDATE - " + S("facilitiespast_res") + " AND SYSDATE + " + S("facilitiesfuture_res") + " OR rr.res_rsv_ruimte_van IS NULL)"
             + " UNION ALL "
             + "SELECT a.bez_afspraak_contact_key prs_perslid_key"
             + "     , TO_CHAR (b.bez_afspraak_key)"
@@ -563,16 +566,15 @@ function sqlTracking(refkey, node)
             + "     , a.bez_afspraak_datum datum"
             + "     , b.bez_afspraak_naam || (CASE WHEN bez_afspraak_bedrijf IS NOT NULL THEN ' (' || bez_afspraak_bedrijf || ')' END) oms"
             + "     , (CASE WHEN bez_bezoekers_done IS NOT NULL THEN 'lcl_vis_inside_st' ELSE 'lcl_vis_expected_st' END) status"
-             + "     , NULL"
+             + "     , NULL satisfaction"
+             + "     , NULL satisfaction_op"
             + "     , NULL status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('b.bez_afspraak_key', 'afspraak')
             + "  FROM bez_bezoekers b"
             + "     , bez_afspraak a"
             + " WHERE b.bez_afspraak_key = a.bez_afspraak_key AND bez_bezoekers_out IS NULL"
-             + (!showall
-               ? " AND (a.bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez") + " OR a.bez_afspraak_datum IS NULL)"
-               : "")
+             + "   AND (a.bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez") + " OR a.bez_afspraak_datum IS NULL)"
             + " UNION "
             + "SELECT a.bez_afspraak_host_key prs_perslid_key"
             + "     , TO_CHAR (b.bez_afspraak_key)"
@@ -581,16 +583,15 @@ function sqlTracking(refkey, node)
             + "     , a.bez_afspraak_datum datum"
             + "     , b.bez_afspraak_naam || (CASE WHEN bez_afspraak_bedrijf IS NOT NULL THEN ' (' || bez_afspraak_bedrijf || ')' END) oms"
             + "     , (CASE WHEN bez_bezoekers_done IS NOT NULL THEN 'lcl_vis_inside_st' ELSE 'lcl_vis_expected_st' END) status"
-             + "     , NULL"
+             + "     , NULL satisfaction"
+             + "     , NULL satisfaction_op"
             + "     , NULL status_key"
             + "     , NULL bo_status_key"
             + sqlTracking('b.bez_afspraak_key', 'afspraak')
             + "  FROM bez_bezoekers b"
             + "     , bez_afspraak a"
             + " WHERE b.bez_afspraak_key = a.bez_afspraak_key AND bez_bezoekers_out IS NULL"
-             + (!showall
-               ? " AND (a.bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez") + " OR a.bez_afspraak_datum IS NULL)"
-               : "");
+             + " AND (a.bez_afspraak_datum BETWEEN SYSDATE - " + S("facilitiespast_bez") + " AND SYSDATE + " + S("facilitiesfuture_bez") + " OR a.bez_afspraak_datum IS NULL)";

    sqln = "SELECT prs_perslid_key"
         + "     , item"
@@ -600,6 +601,7 @@ function sqlTracking(refkey, node)
         + "     , detail"
         + "     , status"
         + "     , satisfaction"
+         + "     , satisfaction_op"
         + "     , status_key"
         + "     , recentdatum"
         + "     , bo_status_key"
@@ -639,43 +641,63 @@ function sqlTracking(refkey, node)
    var cnt = rst.processResultset();

    // Overzicht externe ruimtes
-    autfunction = "WEB_RESUSE";
-    var sql = res.getremotes_sql(autfunction);
-
-    var oRs = Oracle.Execute(sql);
-    // Als je hier weet dat er intern niks was zou je deze externe opties initieel opengeklapt willen?
-    while( !oRs.eof )
+    var mayberemote = Session("has_no_remote_res") != 1;
+    if (mayberemote)
    {
-        var url = oRs("res_disc_params_remoteurl").Value + "&API=RESINFO";
-        var disc_key = oRs("ins_discipline_key").Value;
-        var xparams = { request: "user_lopend_info",
-                        prs_externId: customerId + "_" + String(user_key)
-                      }
+        var cnt_remote = 0;
+        autfunction = "WEB_RESUSE";
+        var sql = res.getremotes_sql(autfunction);

-        var user_lopend_info = HTTP.getJSON(url, xparams).user_lopend_info;
-        if (user_lopend_info.length)
+        var oRs = Oracle.Execute(sql);
+        // Als je hier weet dat er intern niks was zou je deze externe opties initieel opengeklapt willen?
+        while( !oRs.eof )
        {
-    %>
-              <div class="resexternlist">
-                   <span class="resexterntitle">
-                     <%= L("lcl_res_extern_prefix") + Server.HTMLencode(oRs("ins_discipline_omschrijving").Value)%>
-                   </span>
-                <div class="resexterndiv">
-    <%
-            rst.buttons = [];
-            rst.sql = null;
-            rst.ID = "factable2";
-            rst.dataset = user_lopend_info;
-            var cnt = rst.processResultset({ disc_key: disc_key });
-        %>
-              </div>
-          </div>
-        <%
-        }
-        oRs.MoveNext();
-    }
-    oRs.close();
+            var url = oRs("res_disc_params_remoteurl").Value + "&API=RESINFO";
+            var disc_key = oRs("ins_discipline_key").Value;
+            var xparams = { request: "user_lopend_info",
+                            prs_externId: customerId + "_" + String(user_key)
+                          }

+            var json = HTTP.getJSON(url, xparams);
+            if (!json)
+            {
+                __DoLog("user_lopend_info is onverwacht geen Array bij opvragen van:", "#FF0000");
+                __DoLogj(xparams);
+            }
+            else
+            {
+                if (json.user_lopend_info.length)
+                {
+                    cnt_remote += json.user_lopend_info.length;
+            %>
+                      <div class="resexternlist">
+                           <span class="resexterntitle">
+                             <%= L("lcl_res_extern_prefix") + safe.html(oRs("ins_discipline_omschrijving").Value)%>
+                           </span>
+                        <div class="resexterndiv">
+            <%
+                    rst.buttons = [];
+                    rst.sql = null;
+                    rst.ID = "factable2";
+                    rst.dataset = json.user_lopend_info;
+                    var cnt = rst.processResultset({ disc_key: disc_key });
+                %>
+                      </div>
+                  </div>
+                <%
+                }
+            }
+            oRs.MoveNext();
+        }
+        oRs.close();
+        if (!cnt_remote)
+        {
+            __Log("No remotes found. Setting Session('has_no_remote_res')");
+            Session("has_no_remote_res") = 1; // Wordt eventueel in res_goto_extern.asp gereset
+        }
+    }
+    else
+        __Log("Session('has_no_remote_res') is set. Skipping remotes check.");
 %>
  </body>
 </html>
--- a/APPL/FAC/fac_locale_data.asp
+++ b/APPL/FAC/fac_locale_data.asp
@@ -61,14 +61,14 @@ var maxlen = oRs(0).Value;
                if (tekst == "")
                {
                    var sql = "DELETE FROM FAC_LOCALE"
-                            + " WHERE fac_locale_lang = '" + i + "'"
+                            + " WHERE fac_locale_lang = " + safe.quoted_sql(i)
                            + "   AND fac_locale_kolomnaam = " + safe.quoted_sql_upper(kolomnaam)
                            + "   AND fac_locale_kolomkeyval = " + kolomkeyval
                }
                else
                {
                    var sql = "SELECT 1 FROM FAC_LOCALE"
-                            + " WHERE fac_locale_lang = '" + i + "'"
+                            + " WHERE fac_locale_lang = " + safe.quoted_sql(i)
                            + "   AND fac_locale_kolomnaam = " + safe.quoted_sql_upper(kolomnaam)
                            + "   AND fac_locale_kolomkeyval = " + kolomkeyval;
                    oRs = Oracle.Execute(sql)
@@ -81,7 +81,7 @@ var maxlen = oRs(0).Value;
                    else
                    {
                        var sql = "UPDATE FAC_LOCALE SET fac_locale_tekst = " + safe.quoted_sql(tekst, maxlen)
-                                + " WHERE fac_locale_lang = '" + i + "'"
+                                + " WHERE fac_locale_lang = " + safe.quoted_sql(i)
                                + "   AND fac_locale_kolomnaam = " + safe.quoted_sql_upper(kolomnaam)
                                + "   AND fac_locale_kolomkeyval = " + kolomkeyval;
                    }
@@ -116,7 +116,7 @@ var maxlen = oRs(0).Value;
        for (i in lcl.languages)
        {
            if (i != db_lang)
-                talen_arr.push("SELECT '" + i + "' fac_locale_lang FROM DUAL");
+                talen_arr.push("SELECT " + safe.quoted_sql(i) + " fac_locale_lang FROM DUAL");
        }

        var talen = talen_arr.join(" UNION ");
--- a/APPL/FAC/fac_locale_edit_std.asp
+++ b/APPL/FAC/fac_locale_edit_std.asp
@@ -59,9 +59,9 @@ maxlen = 2000; // fac_locale_xsl_cust

  </head>
  <body class="modal" id="localebody">
-      <form id="lclform" name="lclform" action="fac_locale_edit_std.asp?submit=1&lcl_label=<%=lcl_label%>" method="post">
+      <form id="lclform" name="lclform" action="fac_locale_edit_std.asp?submit=1&lcl_label=<%=safe.htmlattr(lcl_label)%>" method="post">
 <%
-        BLOCK_START("lcl_locale_std", L("lcl_lcl_xsl_label") + ": " + lcl_label);
+        BLOCK_START("lcl_locale_std", L("lcl_lcl_xsl_label") + ": " + safe.html(lcl_label));

        //kolomkeydata
        var talen_arr = [];
--- a/Show More
+++ b/Show More