Foreign keys, bugfixes and output sanitation

CHANGELOG

@@ -0,0 +1,17 @@
+CHANGELOG
+=========
+
+0.2.1 - 2026-08-28
+------------------
+
+  * fix and improve install script
+  * fix messagebox call in ymsgui
+  * customizable main menu
+  * sanitized html input fields
+  * added foreign keys and constraints to database
+  * added manpage
+
+0.2.0 - 2026-08-18
+------------------
+
+  * initial public release

INSTALL

@@ -15,7 +15,7 @@ Yacht Management Software (YMS) Installation
 - Python GTK3
   - python3-gi
   - gir1.2-gtk-3.0
-  - gir-rsvg-2.0
+  - gir1.2-rsvg-2.0
 
 1.3 Web GUI
 - Webserver

README

@@ -1,16 +1,29 @@
-YMS - Yacht Management System
-Prototype
+YMS - Open Source Yacht Management System
+Preview Version
 
-Many features are incomplete, buggy or missing.
+Free, self-hosted software for managing your boat's equipment,
+inventory, documents, maintenance and tasks.
+
+Your boat. Your data. Your software.
+
+
+This is work in progress:
+Many features can be incomplete, buggy or missing.
 Use at your own risk!
 
+Please read installation instructions in INSTALL
+
 If inserting a new user you have also to insert a setting value
 to assign boat 0.
 
 To set your own passwords via console there is a helper script
   ymspass.py
-
 Use it to get an SQL-statement for changing passwords.
 
+For users using idesktop there is a prepared link file "yms.lnk".
+Copy it to your private .idesktop directory to create a
+desktop link.
+
 For further information go to https://computerclub.hoogi.de/yms
 (currently german only)
+

WTFPL_badge.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="Layer_2" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="151px" height="52.725px" viewBox="0 0 151 52.725" enable-background="new 0 0 151 52.725" xml:space="preserve">
+<rect x="0.5" y="0.5" fill="#FFFFFF" stroke="#000000" stroke-miterlimit="10" width="150" height="51.725"/>
+<path d="M61.714,6.535v0.277c6.063,4.344,10.033,11.473,10.033,19.55c0,7.237-3.192,13.712-8.216,18.109H150.5V6.535H61.714z"/>
+<path fill="#FFFFFF" d="M88.588,16.993c-0.197,5.428-0.342,10.861-0.549,16.287h-0.027c-0.554-3.347-1.633-6.645-2.498-9.917h-2.005c-0.795,3.289-1.729,6.586-2.332,9.917h-0.028c0-5.426-0.369-10.867-0.575-16.287h-2.36l1.016,18.856h2.992l2.225-8.911h0.027c0.646,2.994,1.447,5.946,2.223,8.911h3.156l0.935-18.856H88.588z M99.652,19.312v16.537h-2.773V19.312h-4.775v-2.319h12.299v2.319H99.652z M110.221,19.256v6.258h6.532v2.263h-6.532v8.073h-2.662V16.993h9.553v2.263H110.221z M131.33,22.608c0,4.453-3.627,6.81-7.795,6.424c0,2.271,0,4.545,0,6.816h-2.663V16.993C125.359,16.742,131.33,16.541,131.33,22.608z M128.559,22.832c0-2.192-1.271-3.687-3.515-3.687c-1.435,0-1.51-0.167-1.51,1.157c0,2.119,0,4.237,0,6.356C126.254,27.184,128.559,25.727,128.559,22.832z M135.393,35.849V16.993h2.662v16.51h6.725v2.347H135.393z"/>
+<path d="M43.725,4.708c-3.029,0-5.909,0.628-8.526,1.752c-2.617-1.124-5.497-1.752-8.527-1.752c-11.957,0-21.646,9.696-21.646,21.654s9.689,21.653,21.646,21.653c3.03,0,5.91-0.628,8.527-1.753c2.617,1.125,5.497,1.753,8.526,1.753c11.957,0,21.654-9.695,21.654-21.653S55.682,4.708,43.725,4.708z M43.745,41.475c-3.266,0-6.285-1.052-8.746-2.825c-2.46,1.773-5.486,2.825-8.751,2.825c-8.275,0-14.98-6.712-14.98-14.988c0-8.273,6.706-14.979,14.98-14.979c3.267,0,6.29,1.049,8.751,2.825c2.462-1.775,5.479-2.825,8.746-2.825c8.275,0,14.986,6.705,14.986,14.979C58.73,34.763,52.02,41.475,43.745,41.475z M41.6,17.558c2.452,5.629,2.501,13.314,0.003,13.541c-2.499,0.229-3.219-0.606-2.935-9.438l-7.099-0.034c0.532,8.717-1.084,10.232-3.269,9.274c-2.186-0.955-2.088-5.994,0.167-13.344h-7.123c-4.807,9.948-0.784,16.725,2.393,18.133c3.179,1.403,8.376,2.299,11.264-2.911c2.371,4.459,7.759,4.718,11.344,3.067c3.583-1.653,7.059-9.188,2.499-18.289L41.6,17.558L41.6,17.558z"/>
+</svg>

db/mariadb.sql

@@ -5,8 +5,10 @@
 
 /* TODO
    - check all values if unsigned can be used or not
-   - implement foreign keys where possible
+   - implement foreign keys where missing and possible
+     - add referential actions where appropriate
    - rename provisions to provision(?)
+   - review defaults
    */
 
 /* User
@@ -125,9 +127,17 @@ CREATE TABLE storage (
     angle smallint(4) NOT NULL DEFAULT 0,
     color char(6) DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
-    PRIMARY KEY (sid)
+    PRIMARY KEY (sid),
+    FOREIGN KEY fk_storage_vessel (vid)
+        REFERENCES vessel(vid)
 ) ENGINE=InnoDB;
 
+/* intentionally after storage creation */
+ALTER TABLE vessel
+    ADD CONSTRAINT fk_vessel_storage
+    FOREIGN KEY (sid_default)
+    REFERENCES storage(sid);
+
 CREATE TABLE tag (
     tagid smallint(6) UNSIGNED NOT NULL AUTO_INCREMENT,
     tagname varchar(20) NOT NULL,
@@ -141,7 +151,10 @@ CREATE TABLE tagref (
     tagid smallint(6) UNSIGNED NOT NULL,
     objid int(10) UNSIGNED NOT NULL,
     objtype enum('equip','inv','prov','doc', 'proj', 'task', 'maint') NOT NULL,
-    PRIMARY KEY (tagid, objid, objtype)
+    PRIMARY KEY (tagid, objid, objtype),
+    FOREIGN KEY fk_tagref_tag (tagid)
+        REFERENCES tag(tagid)
+        ON DELETE CASCADE
 ) ENGINE=InnoDB;
 
 /* TODO Boxes can be nested via parent
@@ -157,7 +170,9 @@ CREATE TABLE box (
     weight float(5,2) UNSIGNED DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
     PRIMARY KEY (boxid),
-    INDEX ix_label (label)
+    INDEX ix_label (label),
+    FOREIGN KEY fk_box_storage (sid)
+        REFERENCES storage(sid)
 ) ENGINE=InnoDB;
 
 CREATE TABLE equipment (
@@ -165,7 +180,7 @@ CREATE TABLE equipment (
     vid smallint(6) NOT NULL DEFAULT 1,
     ename varchar(80) NOT NULL,
     shortname varchar(20) DEFAULT NULL,
-    model varchar(40),
+    model varchar(40) DEFAULT NULL,
     ecat tinyint(3) DEFAULT NULL,
     serial varchar(30) DEFAULT NULL,
     supplier smallint(6) DEFAULT NULL,
@@ -175,25 +190,21 @@ CREATE TABLE equipment (
     weight float(5,2) UNSIGNED DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
     flags set('ordered','removed','deleted') DEFAULT NULL,
-    PRIMARY KEY(eid)
+    PRIMARY KEY(eid),
+    FOREIGN KEY fk_equipment_vessel (vid)
+        REFERENCES vessel(vid)
+        ON DELETE RESTRICT,
+    FOREIGN KEY fk_equipment_supplier (supplier)
+        REFERENCES company(compid)
+        ON DELETE RESTRICT
 ) ENGINE=InnoDB;
 
-/*
-convert to
-sid   SMALLINT UNSIGNED NULL,
-boxid SMALLINT UNSIGNED NULL,
-CHECK (
-    (sid IS NOT NULL AND boxid IS NULL)
-    OR
-    (sid IS NULL AND boxid IS NOT NULL)
-)
-*/
 CREATE TABLE inventory (
     invid int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
     invname varchar(80) NOT NULL,
     conttype enum('storage','box') NOT NULL DEFAULT 'storage',
-    sid smallint(6) UNSIGNED NOT NULL DEFAULT 1,
-    boxid smallint(6) UNSIGNED NOT NULL DEFAULT 1,
+    sid smallint(6) UNSIGNED DEFAULT NULL,
+    boxid smallint(6) UNSIGNED DEFAULT NULL,
     eid smallint(6) UNSIGNED DEFAULT NULL,
     number smallint(6) UNSIGNED NOT NULL DEFAULT 1,
     weight float(5,2) UNSIGNED DEFAULT NULL,
@@ -203,7 +214,18 @@ CREATE TABLE inventory (
     remarks varchar(150) DEFAULT NULL,
     flags set('ordered','removed','deleted') DEFAULT NULL,
     PRIMARY KEY (invid),
-    INDEX ix_invname (invname)
+    INDEX ix_invname (invname),
+    FOREIGN KEY fk_inventory_storage (sid)
+        REFERENCES storage(sid),
+    FOREIGN KEY fk_inventory_box (boxid)
+        REFERENCES box(boxid),
+    FOREIGN KEY fk_inventory_equipment (eid)
+        REFERENCES equipment(eid),
+    CHECK (
+        (sid IS NOT NULL AND boxid IS NULL)
+        OR
+        (sid IS NULL AND boxid IS NOT NULL)
+    )
 ) ENGINE=InnoDB;
 
 CREATE TABLE cable (
@@ -222,7 +244,13 @@ CREATE TABLE cable (
     cablecond enum('unknown','new','excellent','good','fair','bad','repairable','defect') NOT NULL default 'unknown',
     remarks varchar(150) DEFAULT NULL,
     PRIMARY KEY (cableid),
-    INDEX ix_cablename (vid, cablename)
+    INDEX ix_cablename (vid, cablename),
+    FOREIGN KEY fk_cable_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_cable_supplier (supplier)
+        REFERENCES company(compid),
+    FOREIGN KEY fk_cable_manufacturer (manufacturer)
+        REFERENCES company(compid)
 ) ENGINE=InnoDB;
 
 CREATE table fuse (
@@ -237,7 +265,13 @@ CREATE table fuse (
     description varchar(60) DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
     PRIMARY KEY (fuseid),
-    UNIQUE INDEX ix_fusenumber (vid, fnumber)
+    UNIQUE INDEX ix_fusenumber (vid, fnumber),
+    FOREIGN KEY fk_fuse_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_fuse_cable (cableid)
+        REFERENCES cable(cableid),
+    FOREIGN KEY fk_fuse_equipment (eid)
+        REFERENCES equipment(eid)
 ) ENGINE=InnoDB;
 
 -- change vals to decimal(12,4)?
@@ -245,6 +279,7 @@ CREATE TABLE measurement (
     mid smallint(6) NOT NULL AUTO_INCREMENT,
     mname varchar(80) NOT NULL,
     vid smallint(6) NOT NULL DEFAULT 1,
+    eid smallint(6) UNSIGNED DEFAULT NULL,
     nval tinyint(1) UNSIGNED NOT NULL DEFAULT 1,
     val1 int(10) NOT NULL,
     val2 int(10) DEFAULT NULL,
@@ -253,8 +288,11 @@ CREATE TABLE measurement (
     accuracy enum('unknown','precise','normal','rough','estimated') NOT NULL DEFAULT 'unknown',
     mdate date DEFAULT NULL,
     note varchar(80) DEFAULT NULL,
-    eid smallint(6) UNSIGNED DEFAULT NULL,
-    PRIMARY KEY (mid)
+    PRIMARY KEY (mid),
+    FOREIGN KEY fk_measurement_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_measurement_equipment (eid)
+        REFERENCES equipment(eid)
 ) ENGINE=InnoDB;
 
 CREATE TABLE provisions (
@@ -273,7 +311,11 @@ CREATE TABLE provisions (
     shelflife date DEFAULT NULL,
     price decimal(12,2) DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
-    PRIMARY KEY (provid)
+    PRIMARY KEY (provid),
+    FOREIGN KEY fk_provisions_storage (sid)
+        REFERENCES storage(sid),
+    FOREIGN KEY fk_provisions_box (boxid)
+        REFERENCES box(boxid)
 ) ENGINE=InnoDB;
 
 /* TODO
@@ -322,9 +364,17 @@ CREATE TABLE maintenance (
     eid smallint(6) UNSIGNED DEFAULT NULL,
     series smallint(6) DEFAULT NULL,
     activities varchar(40) NOT NULL,
+    plan_date DATE DEFAULT NULL,
+    completion_date DATE DEFAULT NULL,
+    interval_hours smallint(6) DEFAULT NULL,
+    last_hours int(10) DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
-    maintstate enum('new','planned','ongoing','done') NOT NULL DEFAULT 'new',
-    PRIMARY KEY (maintid)
+    maintstate enum('new','plan','ongoing','done') NOT NULL DEFAULT 'new',
+    PRIMARY KEY (maintid),
+    FOREIGN KEY fk_maintenance_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_maintenance_equipment (eid)
+        REFERENCES equipment(eid)
 ) ENGINE=InnoDB;
 
 /* TODO? time recording */
@@ -340,9 +390,14 @@ CREATE TABLE project (
     costs_final decimal(12,2) DEFAULT NULL,
     remarks varchar(150) DEFAULT NULL,
     projstate enum('new','plan','ongoing','paused','finished') NOT NULL DEFAULT 'new',
-    PRIMARY KEY (projid)
+    PRIMARY KEY (projid),
+    FOREIGN KEY fk_project_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_project_user (responsible)
+        REFERENCES user(userid)
 ) ENGINE=InnoDB;
 
+/* TODO  executed_by : company or user? or both? */
 CREATE TABLE task (
     taskid int(10) NOT NULL AUTO_INCREMENT,
     vid smallint(6) DEFAULT NULL,
@@ -356,13 +411,16 @@ CREATE TABLE task (
     started datetime DEFAULT NULL,
     finished datetime DEFAULT NULL,
     responsible smallint(6) NOT NULL,
-    /* TODO  executed_by : company or user? or both? */
     PRIMARY KEY (taskid),
     FOREIGN KEY fk_task_user (responsible)
-        REFERENCES user(userid)
+        REFERENCES user(userid),
+    FOREIGN KEY fk_task_vessel (vid)
+        REFERENCES vessel(vid),
+    FOREIGN KEY fk_task_project (projid)
+        REFERENCES project(projid)
 ) ENGINE=InnoDB;
 
-/* Notes can be assigned to tasks,maintenances and equipment */
+/* Notes can be assigned to tasks, maintenances and equipment */
 CREATE TABLE note (
     noteid int(10) NOT NULL AUTO_INCREMENT,
     notetype enum('task','maint','equip') NOT NULL DEFAULT 'task',
@@ -376,28 +434,38 @@ CREATE TABLE checklist (
     title varchar(30) NOT NULL,
     parent smallint(6) DEFAULT NULL,
     clstate enum('new','open','closed') NOT NULL DEFAULT 'new',
-    PRIMARY KEY (clid)
+    PRIMARY KEY (clid),
+    FOREIGN KEY fk_checklist_parent (parent)
+       REFERENCES checklist(clid)
+) ENGINE=InnoDB;
+
+CREATE TABLE checkgroup (
+    groupid smallint(6) UNSIGNED NOT NULL,
+    title varchar(30) NOT NULL,
+    PRIMARY KEY (groupid)
 ) ENGINE=InnoDB;
 
 CREATE TABLE checkitem (
     checkid int(10) NOT NULL AUTO_INCREMENT,
     checkname varchar(60) NOT NULL,
-    groupid tinyint(3) DEFAULT NULL,
+    groupid smallint(6) UNSIGNED DEFAULT NULL,
     checkresult enum('unchecked','checked','unused') NOT NULL DEFAULT 'unused',
-    PRIMARY KEY (checkid)
+    PRIMARY KEY (checkid),
+    FOREIGN KEY fk_checkitem_group (groupid)
+        REFERENCES checkgroup(groupid)
 ) ENGINE=InnoDB;
 
 CREATE TABLE checkref (
     clid smallint(6) NOT NULL,
     checkid int(10) NOT NULL,
     sort smallint(6) DEFAULT NULL,
-    PRIMARY KEY (clid, checkid)
-) ENGINE=InnoDB;
-
-CREATE TABLE checkgroup (
-    groupid int(10) NOT NULL,
-    title varchar(30) NOT NULL,
-    PRIMARY KEY (groupid)
+    PRIMARY KEY (clid, checkid),
+    FOREIGN KEY fk_checkref_checklist (clid)
+        REFERENCES checklist(clid)
+        ON DELETE CASCADE,
+    FOREIGN KEY fk_checkref_checkitem (checkid)
+        REFERENCES checkitem(checkid)
+        ON DELETE CASCADE
 ) ENGINE=InnoDB;
 
 /* Expansion for future use: signalk mapping (just an idea) */
@@ -410,5 +478,7 @@ CREATE TABLE signalk (
     skpath varchar(255) NOT NULL,
     PRIMARY KEY (skid),
     UNIQUE KEY ix_signalk
-        (vid, objtype, objid, datatype)
+        (vid, objtype, objid, datatype),
+    FOREIGN KEY fk_signalk_vessel (vid)
+        REFERENCES vessel(vid)
 ) ENGINE=InnoDB;

db/minimal.sql

@@ -53,7 +53,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 211, 'cable filter json'),
 (-1, 212, 'fuse filter json');
 
-/* Liste der Listen wird immer benötigt */
+/* List of lists is always required */
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (0, 0, 'Liste der Listen'),
 (0, 1, 'Rumpftypen'),

db/minimal_en.sql

@@ -22,6 +22,7 @@ INSERT INTO settings (userid, sno, valint) VALUES
 INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 1, 'vessel id'),
 (-1, 2, 'date format'),
+(-1, 3, 'user menu'),
 (-1, 10, 'rows in table'),
 (-1, 20, 'maximum image width'),
 (-1, 21, 'maximum image height'),
@@ -52,7 +53,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 211, 'cable filter json'),
 (-1, 212, 'fuse filter json');
 
-/* list of lists always needed */
+/* List of lists is always required */
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (0, 0, 'list of lists'),
 (0, 1, 'hull type'),
@@ -75,4 +76,5 @@ INSERT INTO dropdown (ddid, ddval, ddtext, flags) VALUES
 
 INSERT INTO dropdown (ddid, ddval, ddtext, flags) VALUES
 (3, 0, 'Generic storage', 'fixed'),
-(3, 1, 'Tank', 'fixed');
+(3, 1, 'Tank', 'fixed'),
+(3, 2, 'External', 'fixed');

db/sample.sql

@@ -2,6 +2,9 @@
  * SPDX-License-Identifier: WTFPL
  */
 
+-- minimal vessel
+INSERT INTO vessel (vid, vesselname) VALUES (1, 'Generic vessel');
+
 INSERT INTO user (userid, login, pass, displayname, role) VALUES
 (2, 'helmsman', '$2y$10$4keuVm.WD/JeRmAqp2h4MeSxxKITsKv2q07XZrxPUuT/V80CTPbje', 'Helmsman', 'helmsman'),
 (3, 'sailor', '$2y$10$4keuVm.WD/JeRmAqp2h4MeSxxKITsKv2q07XZrxPUuT/V80CTPbje', 'Sailor', 'sailor');
@@ -16,37 +19,48 @@ INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (1, 3, 'Trimaran');
 
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
-(2, 3, 'Dienstleister'), -- Service
-(2, 4, 'Werft'), -- Shipyard
+(2, 4, 'Dienstleister'), -- Service
 (2, 5, 'Segelmacher'), -- Sailmaker
-(2, 6, 'Yachthafen'), -- Marina
+(2, 6, 'Yachthafen'); -- Marina
 
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
-(3, 2, 'Bilge'),
-(3, 3, 'Schwalbennest');
+(3, 3, 'Bilge'),
+(3, 4, 'Schwalbennest');
 
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (4, 1, 'Rumpf'),
-(4, 2, 'Decks'),
+(4, 2, 'Deck'),
 (4, 3, 'Rigg'),
 (4, 4, 'Segel'),
 (4, 5, 'Motor'),
 (4, 6, 'Elektrik'),
 (4, 7, 'Elektronik'),
 (4, 8, 'Navigation'),
-(4, 9, 'Pantry');
+(4, 9, 'Pantry'),
+(4, 10, 'Solar'),
+(4, 11, 'Sicherheit'),
+(4, 12, 'lfd. Gut');
 
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (5, 1, 'Allgemein'),
-(5, 2, 'Getränke');
+(5, 2, 'Getränke'),
+(5, 3, 'Naschkram'),
+(5, 4, 'Konserven'),
+(5, 5, 'Frischware'),
+(5, 6, 'Trockenware'),
+(5, 7, 'Gefriergetrocknet'),
+(5, 8, 'Snacks (salzig)');
 
-INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
-(6, 1, 'kg'),
-(6, 2, 'Liter'),
-(6, 3, 'Stück'),
-(6, 4, 'Packung'),
-(6, 5, 'Dose'),
-(6, 6, 'Flasche');
+INSERT INTO dropdown (ddid, ddval, ddtext, ddshort) VALUES
+(6, 1, 'kg', 'kg'),
+(6, 2, 'Liter', 'L'),
+(6, 3, 'Stück', 'St'),
+(6, 4, 'Packung', 'Pkg'),
+(6, 5, 'Dose', 'Ds'),
+(6, 6, 'Flasche', 'Fl'),
+(6, 7, 'Tüte', 'Tue'),
+(6, 8, 'Tafel', 'Ta'),
+(6, 9, 'Glas', 'Gl');
 
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (7, 1, 'ATO'),
@@ -55,11 +69,22 @@ INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
 (7, 4, 'Torpedosicherung'),
 (7, 5, 'T-Sicherung');
 
+INSERT INTO dropdown (ddid, ddval, ddshort, ddtext) VALUES
+(8, 1, 'mm', 'Millimeter'),
+(8, 2, 'cm', 'Zentimeter'),
+(8, 3, 'g', 'Gramm'),
+(8, 4, 'kg', 'Kilogramm'),
+(8, 5, 'm', 'Meter'),
+(8, 6, 'kW', 'Kilowatt'),
+(8, 7, 'A', 'Ampere'),
+(8, 8, 'l', 'Liter');
+
 INSERT INTO dropdown (ddid, ddval, ddtext) VALUES
-(8, 1, 'mm'),
-(8, 2, 'cm'),
-(8, 3, 'g'),
-(8, 4, 'kg');
+(9, 1, 'Plastikbox, klein'),
+(9, 2, 'Plastikbox, groß'),
+(9, 3, 'Sortimentskasten'),
+(9, 4, 'Werkzeugkiste');
+
 
 INSERT INTO storage (sid, vid, sname, stype, x, y, z, remarks) VALUES
 (0, 1, 'An Bord', 0, 0, 0, 0, 'Alles wo der Ort nicht spezifiziert werden kann');

install.sh

@@ -7,6 +7,7 @@ BINDIR="${PREFIX}/bin"
 DESKTOPDIR="${PREFIX}/share/applications"
 ICONDIR="${PREFIX}/share/icons/hicolor"
 DOCDIR="${PREFIX}/share/doc/yms"
+MANDIR="${PREFIX}/share/man/man1"
 LOCALEDIR="${PREFIX}/share/locale"
 
 SOURCEDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
@@ -14,11 +15,13 @@ SOURCEDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 if [ "$1" = "uninstall" ]; then
     echo "Uninstalling YMS..."
 
+    rm -f "${BINDIR}/yms"
     rm -rf "${LIBDIR}"
     rm -rf "${SHAREDIR}"
-    rm -f "${BINDIR}/yms"
+    rm -f "${SHAREDIR}/yms.lnk"
     rm -f "${DESKTOPDIR}/yms.desktop"
     rm -rf "${DOCDIR}"
+    rm -f "${MANDIR}/yms.1"
     rm -f "${LOCALEDIR}/de/LC_MESSAGES/ymsgui.mo"
 
     rm -f "${ICONDIR}/scalable/apps/yms.svg"
@@ -63,6 +66,9 @@ install -m 0644 \
 cp -a \
     "${SOURCEDIR}/shapes/." \
     "${SHAREDIR}/shapes/"
+install -m 0644 \
+    "${SOURCEDIR}/yms.lnk" \
+    "${SHAREDIR}/yms.lnk"
 
 # Documentation
 echo "Installing documentation..."
@@ -76,6 +82,10 @@ install -m 0644 \
 install -m 0644 \
     "${SOURCEDIR}/COPYING" \
     "${DOCDIR}/COPYING"
+install -d "${MANDIR}"
+install -m 0644 \
+    "${SOURCEDIR}/yms.1" \
+    "${MANDIR}/yms.1"
 
 echo "Installing translations..."
 make translation

webgui/box.php

@@ -184,7 +184,7 @@ echo '<tr><th>', _('Weight'), '</th><td>', format_float($box->weight, 2, 'kg'),
 echo '<tr><th>', _('Storage'),"</th><td>", $box->sname, '&nbsp;';
 echo '<a title="', _('View'), '" href="storage.php?f=view&id=', $box->sid, '"><i class="bi-eye"></i></a>';
 echo "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", $box->remarks, "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($box->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -293,12 +293,12 @@ echo '<h2>', _('Edit Box'), "</h2>\n";
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="label" class="form-label"><?=_('Label')?></label>
-  <input type="text" class="form-control" id="label" name="label" value="<?=$box->label ?>">
+  <input type="text" class="form-control" id="label" name="label" value="<?=h($box->label)?>">
 </div>
 <?php form_create_select('boxtype', _('Box type'), $opt_none + $opt_boxtype, $box->boxtype); ?>
 <div class="mb-3">
   <label for="content" class="form-label"><?=_('Content')?></label>
-  <input type="text" class="form-control" id="content" name="content" value="<?=$box->content ?>">
+  <input type="text" class="form-control" id="content" name="content" value="<?=h($box->content)?>">
 </div>
 <div class="mb-3">
   <label for="color"><?=_('Color')?></label>
@@ -311,7 +311,7 @@ echo '<h2>', _('Edit Box'), "</h2>\n";
 <?php form_create_select('sid', _('Storage'), $opt_storage, $box->sid); ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$box->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($box->remarks, br:true)?></textarea>
 </div>
 <?php
 

webgui/cable.php

@@ -211,7 +211,7 @@ echo '<tr><th>', _('Cross section'),"</th><td>", format_float($cable->xsection,
 echo '<tr><th>', _('Weight'),"</th><td>", format_float($cable->weight, 2, 'kg/m'), "</td></tr>\n";
 echo '<tr><th>', _('Color'),"</th><td>", format_color($cable->color), "</td></tr>\n";
 echo '<tr><th>', _('Condition'),"</th><td>", $opt_cablecond[$cable->cablecond], "</td></tr>\n";
-echo "<tr><th>", _('Remarks'), "</th><td>", nl2br($cable->remarks), "</td></tr>\n";
+echo "<tr><th>", _('Remarks'), "</th><td>", h($cable->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -233,7 +233,7 @@ echo '<h2>', _('Edit cable'), "</h2>\n";
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="mname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="cablename" name="cablename" value="<?=$cable->cablename;?>">
+  <input type="text" class="form-control" id="cablename" name="cablename" value="<?=h($cable->cablename)?>">
 </div>
 <?php
 form_create_select('cabletype', _('Type'), $g_opt_none + $opt_cabletype, $cable->cabletype);
@@ -267,7 +267,7 @@ form_create_select('cablecond', _('Condition'), $opt_cablecond, $cable->cablecon
 ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$cable->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($cable->remarks, br:true)?></textarea>
 </div>
 <?php
 

webgui/company.php

@@ -271,28 +271,28 @@ $company = $sth->fetch(PDO::FETCH_OBJ);
 echo "<h2>", $company->compname, "</h2>\n";
 
 echo '<table class="table">', "\n";
-echo '<tr><th scope="row" style="width:20%">', _('Name'),"</th><td>", $company->compname, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Short name'),"</th><td>", $company->shortname, "</td></tr>\n";
+echo '<tr><th scope="row" style="width:20%">', _('Name'),"</th><td>", h($company->compname), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Short name'),"</th><td>", h($company->shortname), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Type'),"</th><td>", $opt_comptype[$company->comptype], "</td></tr>\n";
 echo '<tr><th scope="row">', _('Secondary type'),"</th><td>", $company->comptype2 ? $opt_comptype[$company->comptype2] : '-', "</td></tr>\n";
-echo '<tr><th scope="row">', _('Street'),"</th><td>", $company->street, "</td></tr>\n";
+echo '<tr><th scope="row">', _('Street'),"</th><td>", h($company->street), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Zip, City'),"</th><td>", $company->zip, ' ', $company->city, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Country'),"</th><td>", $company->country, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Contact'),"</th><td>", $company->contact, "</td></tr>\n";
+echo '<tr><th scope="row">', _('Country'),"</th><td>", h($company->country), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Contact'),"</th><td>", h($company->contact), "</td></tr>\n";
 
 echo '<tr><th scope="row">', _('Phone'),"</th><td>";
-echo make_phonelink($company->phone),' ', $company->phone, "</td></tr>\n";
+echo make_phonelink($company->phone),' ', h($company->phone), "</td></tr>\n";
 
 echo '<tr><th scope="row">', _('Email'),"</th><td>";
-echo make_maillink($company->email),' ', $company->email, "</td></tr>\n";
+echo make_maillink($company->email),' ', h($company->email), "</td></tr>\n";
 
 echo '<tr><th scope="row">', _('Web'),"</th><td>";
 // echo '<a title="', _('Go to website'), '" href="', 
-echo make_weblink($company->web), ' ', $company->web, "</td></tr>\n";
+echo make_weblink($company->web), ' ', h($company->web), "</td></tr>\n";
 
-echo '<tr><th scope="row">', _('Customer no.'),"</th><td>", $company->customerno, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Contract no.'),"</th><td>", $company->contractno, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Remarks'),"</th><td>", $company->remarks, "</td></tr>\n";
+echo '<tr><th scope="row">', _('Customer no.'),"</th><td>", h($company->customerno), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Contract no.'),"</th><td>", h($company->contractno), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Remarks'),"</th><td>", h($company->remarks, br:true), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Flags'),"</th><td>", $company->flags, "</td></tr>\n";
 echo "</table>\n";
 
@@ -303,7 +303,7 @@ $sql = "SELECT eid, ename FROM equipment WHERE supplier=:id OR manufacturer=:id"
 $sth = $pdo->prepare($sql);
 $sth->execute([':id' => $id]);
 if ($sth->rowCount() > 0) {
-    echo "<p>Referenced in equipment:</p>\n";
+    echo '<p>', _('Referenced in equipment'), ":</p>\n";
     echo "<ul>\n";
     foreach ($sth->fetchAll() as $row) {
         echo "<li>", $row['ename'], ' ';
@@ -353,11 +353,11 @@ $company = $sth->fetch(PDO::FETCH_OBJ);
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="compname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="compname" name="compname" value="<?=$company->compname ?>">
+  <input type="text" class="form-control" id="compname" name="compname" value="<?=h($company->compname)?>">
 </div>
 <div class="mb-3">
   <label for="shortname" class="form-label"><?=_('Short name')?></label>
-  <input type="text" class="form-control" id="shortname" name="shortname" value="<?=$company->shortname ?>">
+  <input type="text" class="form-control" id="shortname" name="shortname" value="<?=h($company->shortname)?>">
 </div>
 <div class="mb-3">
   <label for="comptype" class="form-label"><?=_('Company type')?></label>
@@ -378,47 +378,47 @@ form_create_select('comptype2', _('Secondary company type'), $g_opt_none + $opt_
 ?>
 <div class="mb-3">
   <label for="street" class="form-label"><?=_('Street')?></label>
-  <input type="text" class="form-control" id="street" name="street" value="<?=$company->street ?>">
+  <input type="text" class="form-control" id="street" name="street" value="<?=h($company->street)?>">
 </div>
 <div class="mb-3">
   <label for="zip" class="form-label"><?=_('Zip')?></label>
-  <input type="text" class="form-control" id="zip" name="zip" value="<?=$company->zip ?>">
+  <input type="text" class="form-control" id="zip" name="zip" value="<?=h($company->zip)?>">
 </div>
 <div class="mb-3">
   <label for="city" class="form-label"><?=_('City')?></label>
-  <input type="text" class="form-control" id="city" name="city" value="<?=$company->city ?>">
+  <input type="text" class="form-control" id="city" name="city" value="<?=h($company->city)?>">
 </div>
 <div class="mb-3">
   <label for="country" class="form-label"><?=_('Country')?></label>
-  <input type="text" class="form-control" id="country" name="country" value="<?=$company->country ?>">
+  <input type="text" class="form-control" id="country" name="country" value="<?=h($company->country)?>">
 </div>
 <div class="mb-3">
   <label for="contact" class="form-label"><?=_('Contact')?></label>
-  <input type="text" class="form-control" id="contact" name="contact" value="<?=$company->contact ?>">
+  <input type="text" class="form-control" id="contact" name="contact" value="<?=h($company->contact)?>">
 </div>
 <div class="mb-3">
   <label for="phone" class="form-label"><?=_('Phone')?></label>
-  <input type="text" class="form-control" id="phone" name="phone" value="<?=$company->phone ?>">
+  <input type="text" class="form-control" id="phone" name="phone" value="<?=h($company->phone)?>">
 </div>
 <div class="mb-3">
   <label for="email" class="form-label"><?=_('Email')?></label>
-  <input type="text" class="form-control" id="email" name="email" value="<?=$company->email ?>">
+  <input type="text" class="form-control" id="email" name="email" value="<?=h($company->email)?>">
 </div>
 <div class="mb-3">
   <label for="web" class="form-label"><?=_('Web')?></label>
-  <input type="text" class="form-control" id="web" name="web" value="<?=$company->web ?>">
+  <input type="text" class="form-control" id="web" name="web" value="<?=h($company->web)?>">
 </div>
 <div class="mb-3">
   <label for="customerno" class="form-label"><?=_('Customer no.')?></label>
-  <input type="text" class="form-control" id="customerno" name="customerno" value="<?=$company->customerno ?>">
+  <input type="text" class="form-control" id="customerno" name="customerno" value="<?=h($company->customerno)?>">
 </div>
 <div class="mb-3">
   <label for="contractno" class="form-label"><?=_('Contract no.')?></label>
-  <input type="text" class="form-control" id="contractno" name="contractno" value="<?=$company->contractno ?>">
+  <input type="text" class="form-control" id="contractno" name="contractno" value="<?=h($company->contractno)?>">
 </div>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$company->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($company->remarks, br:true)?></textarea>
 </div>
 <?php
 $opt_flags = db_load_enum('company', 'flags', true, true, false);
@@ -439,8 +439,8 @@ $company = $sth->fetch(PDO::FETCH_OBJ);
 
 echo '<h2>', _('Delete Company'), "</h2>\n";
 echo '<p>', sprintf(_('Record no. %d'), $id), "</p>\n";
-echo '<p>Name: ', $company->compname, "</p>";
-echo '<p>Remarks: ', $company->remarks, "</p>";
+echo '<p>Name: ', h($company->compname), "</p>";
+echo '<p>Remarks: ', h($company->remarks, br:true), "</p>";
 
 // Still used as a supplier or manufacturer for equipment?
 $sql = "SELECT COUNT(*) FROM equipment WHERE supplier=:id OR manufacturer=:id";

webgui/documents.php

@@ -488,7 +488,7 @@ if ($document->doctype == 'picture') {
     echo '<div class="image-gallery">';
     echo '<a href="#" data-bs-toggle="modal" data-bs-target="#imageModal">';
 //    echo '<img width="', $g_thumb_size, '" src="dl.php?id=', $document->docid, '&t=s" alt="', $document->title, '">';
-    echo '<img width="', $g_thumb_size, '" src="dl.php?id=', $document->docid, '" alt="', $document->title, '">';
+    echo '<img width="', $g_thumb_size, '" src="dl.php?id=', $document->docid, '" alt="', h($document->title), '">';
     echo '</a>';
     echo '</div>'; // gallery
 ?>
@@ -535,11 +535,11 @@ if ($document->docsize == 0) {
 }
 
 echo '<tr><th scope="row">', _('Mimetype'),"</th><td>", $document->mimetype, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Filename'),"</th><td>", $document->filename, "</td></tr>\n";
+echo '<tr><th scope="row">', _('Filename'),"</th><td>", h($document->filename), "</td></tr>\n";
 echo '<tr><th scope="row">', _('File size'),"</th><td>", format_filesize($document->docsize), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Upload date'),"</th><td>", $document->doctime, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Title'),"</th><td>", $document->title, "</td></tr>\n";
-echo '<tr><th scope="row">', _('Remarks'),"</th><td>", $document->remarks, "</td></tr>\n";
+echo '<tr><th scope="row">', _('Title'),"</th><td>", h($document->title), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Remarks'),"</th><td>", h($document->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 echo "</div>\n", '<div class="col text-center">', "\n"; // column break
@@ -780,7 +780,7 @@ if ($document->mimetype == 'application/pdf') {
 ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$document->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($document->remarks, br:true)?></textarea>
 </div>
 <button type="submit" name="submit[update]" class="btn btn-primary"><?=_('Save')?></button>
 <a href="<?=$g_scriptname?>?f=view&id=<?=$id?>" class="btn btn-secondary"><?=_('Back')?></a>

webgui/equipment.php

@@ -455,18 +455,18 @@ echo '<div class="row">';
 echo '<div class="col">';
 
 echo '<table class="table">', "\n";
-echo '<tr><th>', _('Short name'),"</th><td>", $equipment->shortname, "</td></tr>\n";
+echo '<tr><th>', _('Short name'),"</th><td>", h($equipment->shortname), "</td></tr>\n";
 echo '<tr><th>', _('Manufacturer'),"</th><td>", $opt_manufacturer[$equipment->manufacturer];
 echo '&nbsp;<a title="', _('View'), '" href="company.php?f=view&id=', $equipment->manufacturer, '"><i class="bi-eye"></i></a>';
 echo "</td></tr>\n";
-echo '<tr><th>', _('Model'),"</th><td>", $equipment->model, "</td></tr>\n";
-echo '<tr><th>', _('Serial'),"</th><td>", $equipment->serial, "</td></tr>\n";
+echo '<tr><th>', _('Model'),"</th><td>", h($equipment->model), "</td></tr>\n";
+echo '<tr><th>', _('Serial'),"</th><td>", h($equipment->serial), "</td></tr>\n";
 echo '<tr><th>', _('Weight'),"</th><td>", format_float($equipment->weight, 2, 'kg'), "</td></tr>\n";
 echo '<tr><th>', _('Price'),"</th><td>", format_currency($equipment->price), "</td></tr>\n";
 echo '<tr><th>', _('Purchase date'),"</th><td>", $equipment->purchdate, "</td></tr>\n";
 echo '<tr><th>', _('Supplier'),"</th><td>", $equipment->supplier ? $opt_supplier[$equipment->supplier] : 'n/a', "</td></tr>\n";
 echo '<tr><th>', _('Category'),"</th><td>", $opt_ecat[$equipment->ecat], "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", nl2br($equipment->remarks), "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($equipment->remarks, br:true), "</td></tr>\n";
 echo '<tr><th>', _('Flags'),"</th><td>", $equipment->flags, "</td></tr>\n";
 echo "</table>\n";
 
@@ -545,6 +545,30 @@ echo '</div>'; // container
 // Buttons at bottom of data area
 form_view_buttons($g_scriptname, $id);
 
+// Annotations
+echo '<h3>', _('Annotations'), "</h3>\n";
+
+$sql = "SELECT noteid, annotation "
+     . "FROM note "
+     . "WHERE notetype='equip' AND refid=?";
+$sth = $pdo->prepare($sql);
+$sth->execute([$id]);
+if ($sth->rowCount() > 0) {
+    $n = 0;
+    foreach ($sth->fetchAll() as $row) {
+        $n += 1;
+        echo "<p>($n) {$row['annotation']}";
+        echo ' <a title="', _('Edit'), '" href="note.php?f=edit&id=', $row['noteid'], '"><i class="bi-pencil"></i></a>';
+        echo "</p>\n";
+    }
+} else {
+    echo '<p>', _('No annotations for this equipment'), "</p>\n";
+}
+echo '<div class="container-fluid px-0 my-3">', "\n";
+echo '<a href="note.php?f=add&t=equip&id=', $id, '" class="btn btn-primary" role="button">';
+echo _('Add note'), "</a>\n";
+echo "</div>\n";
+
 // Maintenance records
 echo '<h3>', _('Maintenances'), "</h3>";
 
@@ -649,20 +673,20 @@ $equipment = $sth->fetch(PDO::FETCH_OBJ);
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="ename" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="ename" name="ename" value="<?=$equipment->ename ?>">
+  <input type="text" class="form-control" id="ename" name="ename" value="<?=h($equipment->ename)?>">
 </div>
 <div class="mb-3">
   <label for="shortname" class="form-label"><?=_('Short name')?></label>
-  <input type="text" class="form-control" id="shortname" name="shortname" value="<?=$equipment->shortname ?>">
+  <input type="text" class="form-control" id="shortname" name="shortname" value="<?=h($equipment->shortname)?>">
 </div>
 <?php form_create_select('manufacturer', _('Manufacturer'), $opt_manufacturer, $equipment->manufacturer); ?>
 <div class="mb-3">
   <label for="model" class="form-label"><?=_('Model')?></label>
-  <input type="text" class="form-control" id="model" name="model" value="<?=$equipment->model ?>">
+  <input type="text" class="form-control" id="model" name="model" value="<?=h($equipment->model)?>">
 </div>
 <div class="mb-3">
   <label for="serial" class="form-label"><?=_('Serial')?></label>
-  <input type="text" class="form-control" id="serial" name="serial" value="<?=$equipment->serial ?>">
+  <input type="text" class="form-control" id="serial" name="serial" value="<?=h($equipment->serial)?>">
 </div>
 <div class="mb-3">
   <label for="weight" class="form-label"><?=_('Weight, kg')?></label>
@@ -682,7 +706,7 @@ form_create_select('category', _('Category'), $g_opt_unknown + $opt_ecat, $equip
 ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$equipment->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($equipment->remarks, br:true)?></textarea>
 </div>
 <?php
 $opt_flags = db_load_enum('equipment', 'flags', true, true, false);
@@ -705,8 +729,8 @@ $equipment = $sth->fetch(PDO::FETCH_OBJ);
 echo '<h2>', _('Delete equipment'),"</h2>\n";
 
 echo '<p>', sprintf(_('Record no. %d'), $id), "</p>\n";
-echo '<p>Name: ', $equipment->ename, "</p>";
-echo '<p>Remarks: ', $equipment->remarks, "</p>";
+echo '<p>Name: ', h($equipment->ename), "</p>";
+echo '<p>Remarks: ', h($equipment->remarks, br:true), "</p>";
 
 echo '<p>', _('Deleting an equipment item is final. There is no way back. Only delete if you are absolute sure.'), "</p>\n";
 

webgui/fuse.php

@@ -173,7 +173,7 @@ foreach ($res as $row) {
     echo "<td>", $row['description'], "</td>\n";
     // Edit current record button
     echo "<td>";
-    echo '<a title="', _('Edit'), '" href="', $g_scriptname, '?f=edit&id=', $row['fusevid'], '"><i class="bi bi-pencil"></i></a>', "\n";
+    echo '<a title="', _('Edit'), '" href="', $g_scriptname, '?f=edit&id=', $row['fuseid'], '"><i class="bi bi-pencil"></i></a>', "\n";
     echo "</td>\n";
     echo "</tr>\n";
 }
@@ -234,7 +234,7 @@ echo '<tr><th>', _('Current'),"</th><td>", $fuse->current, "A</td></tr>\n";
 echo '<tr><th>', _('Location'),"</th><td>", $opt_location[$fuse->location], "</td></tr>\n";
 echo '<tr><th>', _('Cable'),"</th><td>", $fuse->cableid, "</td></tr>\n";
 echo '<tr><th>', _('Equipment'),"</th><td>", $fuse->eid, "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", nl2br($fuse->remarks), "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($fuse->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -259,7 +259,7 @@ echo '<h2>', _('Edit fuse'), "</h2>\n";
 </div>
 <div class="mb-3">
   <label for="note" class="form-label"><?=_('Description')?></label>
-  <input type="text" class="form-control" id="description" name="description" value="<?=$fuse->description ?>">
+  <input type="text" class="form-control" id="description" name="description" value="<?=h($fuse->description)?>">
 </div>
 <?php
 

webgui/globals.inc

@@ -12,7 +12,8 @@
  *   #     Date         Changes                                        by
  * ------ ------------ ---------------------------------------------- -----
  *  0.1.0  2024-03-12   Started development                            tho
- '  0.2.0  2026-08-18   First public release                           tho
+ *  0.2.0  2026-08-18   First public release                           tho
+ *  0.2.1  2026-08-28   Foreign keys, bugfixes and output sanitation   tho
  *
  */
 
@@ -48,7 +49,7 @@ define('ROLE_SAILOR',   'sailor');
 // ========== PAGE START CODE =================================================
 
 // global version string
-$g_version = 'v0.2.0';
+$g_version = 'v0.2.1';
 
 $g_scriptname = basename($_SERVER['SCRIPT_NAME']);
 
@@ -557,7 +558,7 @@ function get_enum($enum) {
         'paused' => _('Paused'),
         'pending' => _('Pending'),
         'picture' => _('Picture'),
-        'planned' => _('Planned'),
+        'plan' => _('Planned'),
         'precise' => _('Precise'),
         'project' => _('Project'),
         'removed' => _('Removed'),
@@ -783,7 +784,7 @@ function db_get_options($ddid, $orderby = '', $short = False, $default = NULL) {
     $sth = $pdo->prepare($sql);
     $sth->execute([$ddid]);
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $rec) {
-        $list[$rec[0]] = $rec[1];
+        $list[$rec[0]] = h($rec[1]);
     }
     return $list;
 }
@@ -793,7 +794,7 @@ function db_get_opt_vessel() {
     $list = array();
     $sth = $pdo->query("SELECT vid, vesselname, model FROM vessel ORDER BY vid");
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $row) {
-         $list[$rec[0]] = $rec[1];
+         $list[$row[0]] = h($row[1]);
     }
     return $list;
 }
@@ -811,7 +812,7 @@ function db_get_opt_storage($vid) {
         $g_error->Add($e->getMessage());
     }
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $rec) {
-        $list[$rec[0]] = $rec[1];
+        $list[$rec[0]] = h($rec[1]);
     }
     return $list;
 }
@@ -832,7 +833,7 @@ function db_get_opt_box($vid, $exclude=[]) {
     }
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $rec) {
         if (! in_array($rec[0], $exclude)) {
-            $list[$rec[0]] = $rec[1] . ($rec[2] ? ' - '. $rec[2] : '');
+            $list[$rec[0]] = h($rec[1]) . ($rec[2] ? ' - '. h($rec[2]) : '');
         }
     }
     return $list;
@@ -855,7 +856,7 @@ function db_get_opt_equip($vid, $default=NULL, $exclude=[]) {
     }
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $rec) {
         if (! in_array($rec[0], $exclude)) {
-            $list[$rec[0]] = $rec[1];
+            $list[$rec[0]] = h($rec[1]);
         }
     }
     return $list;
@@ -871,7 +872,7 @@ function db_get_opt_manuf($default=NULL) {
     $sql = "SELECT compid, compname FROM company WHERE comptype=2 ORDER BY compname";
     $sth = $pdo->query($sql);
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $row) {
-        $list[$row[0]] = $row[1];
+        $list[$row[0]] = h($row[1]);
     }
     return $list;
 }
@@ -886,7 +887,7 @@ function db_get_opt_supp($default=NULL) {
     $sql = "SELECT compid, compname FROM company WHERE comptype=1 ORDER BY compname";
     $sth = $pdo->query($sql);
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $row) {
-        $list[$row[0]] = $row[1];
+        $list[$row[0]] = h($row[1]);
     }
     return $list;
 }
@@ -901,7 +902,7 @@ function db_get_opt_user($userid, $default=NULL) {
     $sql = "SELECT userid, displayname FROM user WHERE userid>0 ORDER BY displayname";
     $sth = $pdo->query($sql);
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $row) {
-        $list[$row[0]] = $row[1];
+        $list[$row[0]] = h($row[1]);
     }
     return $list;
 }
@@ -931,7 +932,22 @@ function db_get_opt_proj($vid, $exclude=[], $default=NULL) {
         $g_error->Add($e->getMessage());
     }
     foreach ($sth->fetchAll(PDO::FETCH_NUM) as $rec) {
-        $list[$rec[0]] = $rec[1];
+        $list[$rec[0]] = h($rec[1]);
+    }
+    return $list;
+}
+
+function db_get_opt_cable($vid, $default=NULL) {
+    global $pdo;
+    if (isset($default)) {
+        $list = $default;
+    } else {
+        $list = array();
+    }
+    $sql = "SELECT cableid, cablename FROM cable WHERE vid=? ORDER BY cablename";
+    $sth = $pdo->query($sql);
+    foreach ($sth->fetchAll(PDO::FETCH_NUM) as $row) {
+        $list[$row[0]] = h($row[1]);
     }
     return $list;
 }
@@ -1233,6 +1249,18 @@ function format_currency($val) {
     }
 }
 
+function format_date($date) {
+    global $user;
+    // $user->datefmt;
+   /*'Y-m-d' => _('YYYY-MM-DD'). $curdate->format(' - Y-m-d'),
+   'Y/m/d' => _('YYYY/MM/DD'). $curdate->format(' - Y/m/d'),
+   'd.m.Y' => _('DD.MM.YYYY'). $curdate->format(' - d.m.Y'),
+   'd/m/Y' => _('DD/MM/YYYY'). $curdate->format(' - d/m/Y'),
+   'm-d-Y' => _('MM/DD/YYYY'). $curdate->format(' - m-d-Y') */
+    
+    return '';
+}
+
 function format_color($color) {
     $colstr = '<span style="';
     $style = "padding:2px 4px;border-radius:4px;background-color:#".$color;
@@ -1296,6 +1324,13 @@ function format_measurement($n, $unit, $v1, $v2, $v3) {
 
 // ========== COMMON FUNCTIONS ================================================
 
+function h($value, $br=false) {
+    // escape value coming from db for safe html output
+    // optional convert line breaks to <br> tags
+    $value = htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+    return $br ? nl2br($value) : $value;
+}
+
 function header_location($location, $message=NULL) {
     if (is_array($message)) {
         $valid_keys = array('succ', 'info', 'warn', 'err');

webgui/index.php

@@ -171,7 +171,7 @@ if ($vessel->shipyard && $vessel->shipyard > 0) {
     }
 }
 if (strlen($vessel->remarks) > 0) {
-    echo nl2br($vessel->remarks);
+    echo h($vessel->remarks, br:true);
 }
 echo "</div>\n";
 echo "</div>\n"; // row 2

webgui/inventory.php

@@ -48,8 +48,13 @@ switch ($submit = form_get_action()) {
         $p[':invname'] = gpc_get_string($_POST, 'invname');
         $p[':number'] = gpc_get_int($_POST, 'number');
         $p[':conttype'] = gpc_get_string($_POST, 'conttype');
+        if ($p[':conttype'] == 'storage') {
             $p[':sid'] = gpc_get_uint($_POST, 'sid', 0);
+            $p[':boxid'] = NULL;
+        } else {
             $p[':boxid'] = gpc_get_uint($_POST, 'boxid', 0);
+            $p[':sid'] = NULL;
+        }
         if ($p[':sid'] == NULL && $p[':boxid'] == NULL) {
             $p[':conttype'] = 'storage';
             $sid = db_get_default_storage($user->vid);
@@ -69,8 +74,13 @@ switch ($submit = form_get_action()) {
         $p[':invname'] = gpc_get_string($_POST, 'invname');
         $p[':number'] = gpc_get_int($_POST, 'number');
         $p[':conttype'] = gpc_get_string($_POST, 'conttype');
-        $p[':sid'] = gpc_get_uint($_POST, 'sid', 0);
-        $p[':boxid'] = gpc_get_uint($_POST, 'boxid', 0);
+        if ($p[':conttype'] == 'storage') {
+            $p[':sid'] = gpc_get_uint($_POST, 'sid', NULL);
+            $p[':boxid'] = NULL;
+        } else {
+            $p[':boxid'] = gpc_get_uint($_POST, 'boxid', NULL);
+            $p[':sid'] = NULL;
+        }
         if ($p[':sid'] == NULL && $p[':boxid'] == NULL) {
             $p[':conttype'] = 'storage';
             $sid = db_get_default_storage($user->vid);
@@ -86,6 +96,7 @@ switch ($submit = form_get_action()) {
         $p[':invcond'] = gpc_get_string($_POST, 'invcond');
         $p[':remarks'] = gpc_get_string($_POST, 'remarks', 150);
         $p[':eid'] = gpc_get_int($_POST, 'eid');
+        if ($p[':eid'] <= 0) $p[':eid'] = NULL;
         db_exec_update('inventory', $p, 'invid');
         $action = ACT_VIEW;
         break;
@@ -226,7 +237,7 @@ $opt_special = array(
   -2 => _('&horbar; all &horbar;'),
 );
 foreach ($opt_special + $opt_invcond as $k => $v) {
-    echo '<option value="', $k,'"';
+    echo '<option value="', h($k), '"';
     if ($k == $flt->cond) {
         echo ' selected';
     }
@@ -237,7 +248,7 @@ foreach ($opt_special + $opt_invcond as $k => $v) {
         </div>
         <div class="d-flex flex-nowrap gap-2">
             <label for="flt_txt">Text</label>
-            <input type="text" class="form-control" name="flt_txt" size="15" maxlength="30" value="<?=$flt->txt ?>">
+            <input type="text" class="form-control" name="flt_txt" size="15" maxlength="30" value="<?=h($flt->txt)?>">
         </div>
     </div>
     <div class="card-footer">
@@ -385,7 +396,7 @@ echo "<tr><th>", _('Weight'), "</th><td>", format_float($inventory->weight, 2, '
 echo "<tr><th>", _('Price'), "</th><td>", format_currency($inventory->price), "</td></tr>\n";
 echo "<tr><th>", _('Purchase date'), "</th><td>", $inventory->purchdate, "</td></tr>\n";
 echo "<tr><th>", _('Condition'), "</th><td>", $opt_invcond[$inventory->invcond], "</td></tr>\n";
-echo "<tr><th>", _('Remarks'), "</th><td>", nl2br($inventory->remarks), "</td></tr>\n";
+echo "<tr><th>", _('Remarks'), "</th><td>", h($inventory->remarks, br:true), "</td></tr>\n";
 
 $tags = db_load_taglist('inv', $id);
 form_tag_assignment($g_scriptname, $id, $tags);
@@ -411,7 +422,7 @@ $inventory = $sth->fetch(PDO::FETCH_OBJ);
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="invname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="invname" name="invname" value="<?=$inventory->invname ?>">
+  <input type="text" class="form-control" id="invname" name="invname" value="<?=h($inventory->invname)?>">
 </div>
 <div class="mb-3">
   <label for="number" class="form-label"><?=_('Number')?></label>
@@ -453,7 +464,7 @@ foreach ($cond as $k => $v) {
 <?php form_create_select('eid', _('Equipment'), $opt_equipment, $inventory->eid); ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$inventory->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($inventory->remarks, br:true)?></textarea>
 </div>
 
 <?php

webgui/maintenance.php

@@ -13,7 +13,7 @@ $pagetitle = _('Maintenance');
 
 $id = gpc_get_int($_REQUEST, 'id', 0);
 
-$opt_equipment = db_get_opt_equip($user->vid, [0 => _('*** unassigned ***')]);
+$opt_equipment = db_get_opt_equip($user->vid);
 $opt_state = db_load_enum('maintenance', 'maintstate', true, true);
 
 // ========== ACTIONS START ===================================================
@@ -245,14 +245,15 @@ elseif ($action == ACT_VIEW):
 
 echo '<h2>', _('View Maintenance'), "</h2>\n";
 
+// load maintenance record
 $sql = "SELECT m.activities, m.eid, m.remarks, m.series, m.maintstate, e.ename "
      . "FROM maintenance AS m LEFT OUTER JOIN equipment AS e USING (eid) "
      . "WHERE m.maintid=?";
 $sth = $pdo->prepare($sql);
 $sth->execute([$id]);
 $maint = $sth->fetch(PDO::FETCH_OBJ);
-
-if (isset($maint->eid)) {
+if ($maint !== false && isset($maint->eid)) {
+    // if available load document references
     $sql = "SELECT r.docid, d.filename, d.title, d.hash, d.extension "
          . "FROM docref AS r INNER JOIN document AS d USING (docid) " 
          . "WHERE r.reftype='equipment' AND r.refid=?";
@@ -260,6 +261,7 @@ if (isset($maint->eid)) {
     $sth->execute([$maint->eid]);
     $docs = $sth->fetchAll();
 } else {
+    $maint = new stdClass();
     $maint->ename = _('n/a');
     unset($docs);
 }
@@ -271,13 +273,13 @@ echo '<div class="col">';
 
 echo '<table class="table">', "\n";
 echo '<tr><th>', _('Activities'),"</th><td>", $maint->activities, "</td></tr>\n";
-echo '<tr><th>', _('Equipment'),"</th><td>", $maint->ename;
+echo '<tr><th>', _('Equipment'),"</th><td>", h($maint->ename);
 if (isset($maint->eid) and $maint->eid>0) {
     // Link to equipment
     echo ' <a href="equipment.php?f=view&id=', $maint->eid, '"><i class="bi-eye"></i></a>';
 }
 echo "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", $maint->remarks, "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($maint->remarks), "</td></tr>\n";
 echo '<tr><th>', _('Series'),"</th><td>", $maint->series, "</td></tr>\n";
 echo '<tr><th scope="row">', _('State'),"</th><td>", get_enum($maint->maintstate), "</td></tr>\n";
 echo "</table>\n";
@@ -343,12 +345,12 @@ echo '<h2>', _('Edit Maintenance'), "</h2>\n";
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="activities" class="form-label"><?=_('Activities')?></label>
-  <input type="text" class="form-control" id="activities" name="activities" value="<?=$maint->activities ?>">
+  <input type="text" class="form-control" id="activities" name="activities" value="<?=h($maint->activities)?>">
 </div>
 <?php form_create_select('eid', _('Equipment'), $opt_equipment, $maint->eid); ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$maint->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($maint->remarks, br:true)?></textarea>
 </div>
 <div class="mb-3">
   <label for="series" class="form-label"><?=_('Series')?></label>

webgui/measurement.php

@@ -300,15 +300,15 @@ $measurement = $sth->fetch(PDO::FETCH_OBJ);
 echo '<h2>', _('Measurement'), "</h2>\n";
 
 echo '<table class="table">', "\n";
-echo '<tr><th style="width:20%">', _('Name'),"</th><td>", $measurement->mname, "</td></tr>\n";
-echo '<tr><th>', _('Unit'),"</th><td>", $opt_unit[$measurement->unit], "</td></tr>\n";
-echo '<tr><th>', _('Values'),"</th><td>$measurement->nval</td></tr>\n";
-echo '<tr><th>', _('Value 1'),"</th><td>$measurement->val1</td></tr>\n";
-echo '<tr><th>', _('Value 2'),"</th><td>$measurement->val2</td></tr>\n";
-echo '<tr><th>', _('Value 3'),"</th><td>$measurement->val3</td></tr>\n";
-echo '<tr><th>', _('Accuracy'),"</th><td>$measurement->accuracy</td></tr>\n";
-echo '<tr><th>', _('Date'),"</th><td>$measurement->mdate</td></tr>\n";
-echo '<tr><th>', _('Note'),"</th><td>$measurement->note</td></tr>\n";
+echo '<tr><th style="width:20%">', _('Name'),"</th><td>", h($measurement->mname), "</td></tr>\n";
+echo '<tr><th>', _('Unit'), '</th><td>', $opt_unit[$measurement->unit], "</td></tr>\n";
+echo '<tr><th>', _('Values'), '</th><td>', $measurement->nval, "</td></tr>\n";
+echo '<tr><th>', _('Value 1'), '</th><td>', $measurement->val1, "</td></tr>\n";
+echo '<tr><th>', _('Value 2'), '</th><td>', $measurement->val2, "</td></tr>\n";
+echo '<tr><th>', _('Value 3'), '</th><td>', $measurement->val3, "</td></tr>\n";
+echo '<tr><th>', _('Accuracy'), '</th><td>', get_enum($measurement->accuracy), "</td></tr>\n";
+echo '<tr><th>', _('Date'), '</th><td>', $measurement->mdate, "</td></tr>\n";
+echo '<tr><th>', _('Note'), '</th><td>', h($measurement->note), "</td></tr>\n";
 echo '<tr><th>', _('Equipment'), '</th><td>', $opt_equipment[$measurement->eid], "</td></tr>\n";
 echo "</table>\n";
 

webgui/note.php

@@ -130,7 +130,7 @@ echo '<h2>', _('Add Note'), "</h2>\n";
 
 $notetype = gpc_get_enum($_REQUEST, 't', $opt_notetype);
 
-// get task info for reference
+// get object info for reference
 if ($notetype == 'task') {
     $sql = "SELECT taskname FROM task WHERE taskid=?";
     $sth = $pdo->prepare($sql);
@@ -143,6 +143,12 @@ if ($notetype == 'task') {
     $sth->execute([$id]);
     $activities = $sth->fetchColumn();
     echo '<h3>', sprintf(_('Maintenance: %s'), $activities), "</h3>\n";
+} elseif ($notetype == 'equip') {
+    $sql = "SELECT ename FROM equipment WHERE eid=?";
+    $sth = $pdo->prepare($sql);
+    $sth->execute([$id]);
+    $ename = $sth->fetchColumn();
+    echo '<h3>', sprintf(_('Equipment: %s'), $ename), "</h3>\n";
 }
 
 ?>

webgui/projects.php

@@ -307,14 +307,14 @@ $sth->execute([$id]);
 $project = $sth->fetch(PDO::FETCH_OBJ);
 echo "<h2>", $project->projname, "</h2>\n";
 echo '<table class="table">', "\n";
-echo '<tr><th scope="row" style="width:20%">', _('Name'),"</th><td>", $project->projname, "</td></tr>\n";
+echo '<tr><th scope="row" style="width:20%">', _('Name'),"</th><td>", h($project->projname), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Responsible'),"</th><td>", $opt_user[$project->responsible], "</td></tr>\n";
 echo '<tr><th scope="row">', _('Start date'),"</th><td>", $project->startdate, "</td></tr>\n";
 echo '<tr><th scope="row">', _('Duration'),"</th><td>", $project->duration, "</td></tr>\n";
 echo '<tr><th scope="row">', _('Costs plan'),"</th><td>", format_currency($project->costs_plan), "</td></tr>\n";
 echo '<tr><th scope="row">', _('Costs final'),"</th><td>", format_currency($project->costs_final), "</td></tr>\n";
 echo '<tr><th scope="row">', _('State'),"</th><td>", get_enum($project->projstate), "</td></tr>\n";
-echo '<tr><th scope="row">', _('Remarks'),"</th><td>", nl2br($project->remarks), "</td></tr>\n";
+echo '<tr><th scope="row">', _('Remarks'),"</th><td>", h($project->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -401,7 +401,7 @@ form_create_select('projstate', _('Status'), $opt_state, $project->projstate);
 ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$project->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($project->remarks, br:true)?></textarea>
 </div>
 <button type="submit" name="submit[update]" class="btn btn-primary"><?=_('Save')?></button>
 <a href="<?=$g_scriptname?>?f=view&id=<?=$id?>" class="btn btn-secondary"><?=_('Back')?></a>

webgui/provisions.php

@@ -292,7 +292,7 @@ echo '<tr><th>', _('Storedate'),"</th><td>", $prov->storedate, "</td></tr>\n";
 echo '<tr><th>', _('Shelflife'),"</th><td>", $prov->shelflife, "</td></tr>\n";
 echo '<tr><th>', _('Price'), "</th><td>", format_currency($prov->price), "</td></tr>\n";
 echo '<tr><th>', _('Storage'),"</th><td>", ($opt_storage[$prov->sid] ?? ''), "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", nl2br($prov->remarks), "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($prov->remarks, br:true), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -359,7 +359,7 @@ form_create_select('sid', _('Storage'), $g_opt_none + $opt_storage, $prov->sid);
 ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3" maxlength="150"><?=$prov->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3" maxlength="150"><?=h($prov->remarks, br:true)?></textarea>
 </div>
 <?php
 form_edit_buttons($g_scriptname, $id);

webgui/storage.php

@@ -231,7 +231,7 @@ echo '<tr><th>', _('Location (x, y, z)'),"</th><td>(", $storage->x, ', ', $stora
 echo '<tr><th>', _('Width (wx, wy, wz)'),"</th><td>(", $storage->wx, ', ', $storage->wy, ', ', $storage->wz, ")</td></tr>\n";
 echo '<tr><th>', _('Angle'),"</th><td>", $storage->angle, "°</td></tr>\n";
 echo '<tr><th>', _('Color'),"</th><td>", $storage->color, "</td></tr>\n";
-echo '<tr><th>', _('Remarks'),"</th><td>", $storage->remarks, "</td></tr>\n";
+echo '<tr><th>', _('Remarks'),"</th><td>", h($storage->remarks), "</td></tr>\n";
 echo "</table>\n";
 
 form_view_buttons($g_scriptname, $id);
@@ -314,7 +314,7 @@ $storage = $sth->fetch(PDO::FETCH_OBJ);
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="sname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="sname" name="sname" value="<?=$storage->sname ?>">
+  <input type="text" class="form-control" id="sname" name="sname" value="<?=h($storage->sname)?>">
 </div>
 <?php
 form_create_select('stype', _('Type'), $opt_stype, $storage->stype);
@@ -358,7 +358,7 @@ form_create_select('stype', _('Type'), $opt_stype, $storage->stype);
 <?php form_create_select('capaunit', _('Capacity Unit'), $opt_capaunit, $storage->capaunit); ?>
 <div class="mb-3">
   <label for="remarks" class="form-label"><?=_('Remarks')?></label>
-  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=$storage->remarks ?></textarea>
+  <textarea class="form-control" id="remarks" name="remarks" rows="3"><?=h($storage->remarks, br:true)?></textarea>
 </div>
 <button type="submit" name="submit[update]" class="btn btn-primary"><?=_('Save')?></button>
 <a href="<?=$g_scriptname?>?f=view&id=<?=$id?>" class="btn btn-secondary"><?=_('Back')?></a>
@@ -377,8 +377,8 @@ $storage = $sth->fetch(PDO::FETCH_OBJ);
 echo '<h2>', _('Delete Storage'), "</h2>\n";
 
 echo '<p>', sprintf(_('Record no. %d'), $id), "</p>\n";
-echo '<p>Name: ', $storage->sname, "</p>";
-echo '<p>Remarks: ', $storage->remarks, "</p>";
+echo '<p>Name: ', h($storage->sname), "</p>";
+echo '<p>Remarks: ', h($storage->remarks, br:true), "</p>";
 
 echo '<p>', _('Deleting a storage is final. There is no way back. Only delete if you are absolute sure.'), "</p>\n";
 

webgui/task.php

@@ -127,7 +127,6 @@ page_caption_search($pagetitle);
 
 // load filter from db
 $flt = db_get_filter($user->id, 206, ['txt', 'prio', 'stat', 'proj']);
-
 $w = array('(t.vid=:vid OR t.vid IS NULL)');
 $p = array(':vid' => $user->vid);
 if (strlen($flt->txt) > 1) {
@@ -215,7 +214,7 @@ filter_create_select('flt_prio', _('Priority'), $g_opt_all + $g_opt_none + $opt_
 </div>
 <?php
 $opt_status = db_load_enum('task', 'taskstate', true, true, false);
-filter_create_checks('flt_stat', _('Status'), $opt_status, $flt->stat);
+filter_create_checks('flt_stat', _('Status'), $opt_status, $flt->stat ?? []);
 ?>
 </div>
 <div class="card-footer">
@@ -367,7 +366,7 @@ echo '<h2>', _('Edit Task'), "</h2>\n";
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="taskname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="taskname" name="taskname" value="<?=$task->taskname ?>">
+  <input type="text" class="form-control" id="taskname" name="taskname" value="<?=h($task->taskname)?>">
 </div>
 <?php
 $opt_none = [-1 => '&horbar; none &horbar;'];

yms.1

@@ -0,0 +1,103 @@
+.TH YMS 1 "August 2026" "YMS 0.2" "User Commands"
+.SH NAME
+yms - Yacht Management Software
+.SH SYNOPSIS
+.B yms
+.SH DESCRIPTION
+.B YMS
+(Yacht Management Software) is free and open-source software for
+managing yachts, sailboats and their equipment.
+
+YMS is designed for managing yachts and sailboats, including
+equipment, inventory, storage locations, documents, maintenance,
+tasks, projects, provisions and technical data.
+
+The application uses MariaDB for structured application data.
+User-managed photos and documents are stored in the local filesystem.
+.SH FEATURES
+YMS provides the following functionality:
+.TP
+.B Equipment and inventory management
+Manage equipment and inventory belonging to the yacht.
+.TP
+.B Storage locations
+Organize equipment and inventory by physical storage location.
+.TP
+.B Documents and manuals
+Manage documents and manuals associated with the yacht and its
+equipment.
+.TP
+.B Maintenance and service history
+Record maintenance activities and service history.
+.TP
+.B Tasks and projects
+Manage tasks and projects related to the yacht.
+.TP
+.B Provisions and consumables
+Manage provisions, supplies and consumable items.
+.TP
+.B Technical data and measurements
+Store technical information, measurements and other data associated
+with the yacht.
+.SH DATABASE
+YMS uses MariaDB to store its structured application data.
+
+The MariaDB server must be available to the YMS application when
+the application is running.
+.SH FILES
+.TP
+.I ~/.config/ymsgui.conf
+Per-user configuration file for the YMS graphical user interface.
+
+.TP
+.I /var/local/yms/
+Persistent storage for files managed by YMS.
+
+The directory contains photos, documents and other media associated
+with the managed yacht. Supported file formats include JPEG, PNG,
+SVG and PDF.
+.SH BACKUP
+YMS stores application data in two separate locations.
+
+The directory
+.I /var/local/yms/
+contains user-managed photos and documents and should be included
+in regular backups.
+
+The structured application data is stored in MariaDB and must be
+backed up using an appropriate MariaDB backup procedure.
+
+.SH REQUIREMENTS
+YMS requires a graphical desktop environment with GTK3 support.
+
+The application requires Python and the GTK3 Python bindings.
+A MariaDB server is required for database access.
+
+.SH OPEN SOURCE
+YMS is free and open-source software.
+
+The source code is available from the YMS Git repository:
+.UR https://git.hoogi.de/thooge/YMS
+.UE
+.SH VERSION
+This manual describes YMS version 0.2.
+.SH PROJECT
+The YMS project homepage is available at:
+.UR https://yms.hoogi.de/
+.UE
+
+A live demonstration is available at:
+.UR https://www.hoogi.de/ymsdemo
+.UE
+
+German-language documentation is available at:
+.UR https://computerclub.hoogi.de/yms
+.UE
+.SH BUGS
+Please report bugs and contribute improvements through thread in Segeln-Forum or
+by submitting a mail
+.SH AUTHOR
+YMS is developed by Thomas Hooge / thomas@hoogi.de.
+.SH COPYRIGHT
+YMS is free and open-source software. See the project repository for
+license and copyright information.

yms.lnk

@@ -0,0 +1,9 @@
+table Icon
+  Caption: Yacht Management
+  Command: /usr/local/bin/yms
+  Icon: /usr/local/share/icons/hicolor/48x48/apps/yms.png
+  Width: 48
+  Height: 48
+  X: 168
+  Y: 16
+end

yms/ui/main.ui

@@ -2644,7 +2644,7 @@ thread in "Segeln Forum"
               <object class="GtkLabel">
                 <property name="visible">True</property>
                 <property name="can-focus">False</property>
-                <property name="label" translatable="yes">YMS-GUI version 0.2.0</property>
+                <property name="label" translatable="yes">YMS-GUI version 0.2.1</property>
               </object>
               <packing>
                 <property name="expand">False</property>

ymsgui.py

@@ -273,9 +273,10 @@ if __name__ == "__main__":
             db.disconnect()
         else:
             errno, errtxt = db.last_error()
-            messagebox(_("Database connection cannot be established.\n\n"
+            gtkutils.messagebox(
+                _("Database connection cannot be established.\n\n"
                   "Server: %s\nDatabase: %s\n"
-                         "Error: %s (%d)"
-                         ) % (cfg['host'], cfg['db'], errtxt, errno), title="YMS")
+                  "Error: %s (%d)") % (cfg['host'], cfg['db'], errtxt, errno),
+                title="YMS")
 
 # Another fine product of the sirius cybernetics corporation