--- a/MPIWGRoot.py	Fri Jun 14 15:49:53 2013 +0200
+++ b/MPIWGRoot.py	Fri Jun 14 17:36:09 2013 +0200
@@ -355,8 +355,9 @@
         
         return result,msg
  
-    def updatePersonEntry(self,data,ignoreEntries=None):
-        """update an person entry from data. but ignore all fields in ignore Entries"""
+    def updatePersonEntry(self,newdata,ignoreEntries=None):
+        """update an person entry from newdata. but ignore all fields in ignore Entries"""
+        data = newdata.copy()
         if ignoreEntries is None:
             ignoreEntries = []
             
@@ -364,43 +365,42 @@
         logging.debug("updatePersonEntry: data=%s ignoreEntries=%s"%(repr(data),repr(ignoreEntries)))
         
         if data['date_to']=="": # wenn date_to leer
-            data['date_to']="date_none"
+            data['date_to']=None
         
         if data['date_from']=="": # wenn date_fromleer
-            data['date_from']="date_none"
-        msg=""
-   
-        
+            data['date_from']=None
+           
         #eintragen
          
         columns=data.keys()
         for x in ignoreEntries:
             logging.debug("updatePersonEntry: ignoring %s"%x)
-            try: #falls in ignore entries felder sind, die nicht in columns sind, fange den fehler ab
-                columns.remove(x)
-            except:
-                pass
+            if x in data:
+                del data[x]
 
+        member = self.getStaffFolder().getMember(key = data['key'])
+        if member is None:
+            logging.error("updatePersonEntry: member (key=%s) not found!"%repr(data['key']))
+            return
+        
+        # TODO: change date handling
+        self.getStaffFolder().executeZSQL("SET DATESTYLE TO 'German'")
+        member.changeData(data)
         
-        insert=[]
-        for key in columns:
-            if data[key]=="date_none": # date_none eintrag wird zu null uebersetzt
-                insert.append('%s=null'%key)
-            else:
-                insert.append(""" "%s"=%s"""%(key,self.ZSQLQuote(data[key])))
-            
-        insertStr=",".join(insert)
-        queryStr="update personal_www SET %s where key='%s'"%(insertStr,data['key'])
-        self.ZSQLQuery("SET DATESTYLE TO 'German'")
-        self.ZSQLQuery(queryStr)
-       
-        #currentwork
-        #if not (txt==""):
-        #    queryStr="INSERT INTO current_work (id_main,current,publish) VALUES ('%s','%s','%s')"%(id,txt,txt_p)
-        #
-        #    self.ZSQLQuery(queryStr)
-        
-        return True,msg
+#        msg=""
+#         insert=[]
+#         for key in columns:
+#             if data[key]=="date_none": # date_none eintrag wird zu null uebersetzt
+#                 insert.append('%s=null'%key)
+#             else:
+#                 insert.append(""" "%s"=%s"""%(key,self.ZSQLQuote(data[key])))
+#             
+#         insertStr=",".join(insert)
+#         queryStr="update personal_www SET %s where key='%s'"%(insertStr,data['key'])
+#         self.ZSQLQuery("SET DATESTYLE TO 'German'")
+#         self.ZSQLQuery(queryStr)
+#        
+#         return True,msg
 
 
     def updatePersonalwww_doIt(self):
@@ -415,7 +415,7 @@
         # generate the new entry
       
         if news and (len(news)>0):
-            ret+="<h2>Hinzugef&uuml;gt</h2>"
+            ret+="<h2>Added</h2>"
             ret+="<ul>"
             
         for new in news:
@@ -428,14 +428,14 @@
                     ret+="<li>OK: %s"%(new.encode('utf-8'))
                     
         if news and (len(news)>0):
-            ret+="<p>Neueintr&auml;ge erscheinen erst auf der Homepage, wenn ihnen eine e-mail Adresse zugeordnet wurde.</p>"
-            ret+="</ul>"     
+            ret+="<p>New entries will be visible on the webpage when an email address has been assigned.</p>"
+            ret+="</ul>"
         
         # update
 
         if len(conflicts.keys())>0:
-            ret+="<h2>&Auml;nderung des Benutzers &uuml;bernehmen</h2>"
-            ret+="<p>Wenn n&ouml;tig in Filemaker-db &auml;ndern:</p>"
+            ret+="<h2>Accepted changes to user entries</h2>"
+            ret+="<p>Change Filemaker-db when necessary.</p>"
             
         # konflicte   
         for conflict in conflicts.keys():
@@ -458,9 +458,19 @@
         # rest
         cl=list(conflicts.keys())
         
+        if len(resultSet.keys()) > 0:
+            ret += "<h2>Updating user entries</h2>"
+            ret += "<ul>"
+            
         for key in resultSet.keys():
             if key not in cl:
                 self.updatePersonEntry(resultSet[key])
+                ret+="<li>%s</li>"%(key.encode('utf-8'))
+                
+        if len(resultSet.keys()) > 0:
+            ret += "</ul>"
+
+        ret += "<p>Done.</p>"
         return ret+"</body></html>"
                      
 
@@ -479,10 +489,7 @@
         resultSet=updatePersonalWWW.importFMPXML(uploadfile)
         news,conflicts=updatePersonalWWW.checkImport(dsn, resultSet)
 
-        self.REQUEST.SESSION['personal_www']={}
-        self.REQUEST.SESSION['personal_www']['resultSet']=resultSet
-        self.REQUEST.SESSION['personal_www']['news']=news
-        self.REQUEST.SESSION['personal_www']['conflicts']=conflicts
+        self.REQUEST.SESSION['personal_www'] = {'resultSet': resultSet, 'news': news, 'conflicts': conflicts}
         
         pt=PageTemplateFile(os.path.join(package_home(globals()),'zpt','updatePersonalwww_check.zpt')).__of__(self)
         return pt()

--- a/MPIWGStaff.py	Fri Jun 14 15:49:53 2013 +0200
+++ b/MPIWGStaff.py	Fri Jun 14 17:36:09 2013 +0200
@@ -20,7 +20,7 @@
 
 from Products.ZDBInterface.ZDBInterfaceFolder import ZDBInterfaceFolder
 
-from SrvTxtUtils import getInt, unicodify, utf8ify
+from SrvTxtUtils import getInt, unicodify, utf8ify, sqlName
 import MPIWGHelper
 
 #
@@ -587,14 +587,25 @@
         #REQUEST.response.redirect(self.REQUEST['HTTP_REFERER'])
     
 
-    def changeData(self,changeSet):
+    security.declareProtected('View management screens','changeData')
+    def changeData(self, changeSet):
         """changes the data in the database, changeset expects field --> value."""
+        fields = []
+        values = []
         for field in changeSet.keys():
             if hasattr(self.content, field):
                 logging.debug("Changing: %s"%field)
-                results = self.folder.executeZSQL("update personal_www set "+field+" = %s where key = %s", [changeSet.get(field),self.getKey().encode('utf-8')]);
-                logging.debug(results)
-   
+                fields.append('"'+sqlName(field)+'" = %s')
+                values.append(changeSet.get(field))
+                
+        if len(fields) == 0:
+            return
+        
+        query = "update personal_www set " + ', '.join(fields) + " where key = %s"
+        values.append(self.getKey().encode('utf-8'))
+        results = self.folder.executeZSQL(query, values)
+        logging.debug(results)
+                
         self.refresh_content()
    
    

--- a/SrvTxtUtils.py	Fri Jun 14 15:49:53 2013 +0200
+++ b/SrvTxtUtils.py	Fri Jun 14 17:36:09 2013 +0200
@@ -10,10 +10,11 @@
 import urllib2
 import logging
 import time
+import re
 
 import xml.etree.ElementTree as ET
 
-srvTxtUtilsVersion = "1.9.2"
+srvTxtUtilsVersion = "1.10.0"
 
 map_months = {'en': [u"",
                u"January",
@@ -215,3 +216,23 @@
     l1 = int((l - len(ellipsis)) / 2)
     return "%s%s%s"%(s[:l1],ellipsis,s[-l1:])
 
+
+def sqlName(s, lc=True, more=''):
+    """returns restricted ASCII-only version of string"""
+    if s is None:
+        return ""
+    
+    if not isinstance(s, basestring):
+        # make string object
+        s = str(s)
+        
+    # remove '
+    s = s.replace("'","")
+    # all else -> "_"
+    s = re.sub('[^A-Za-z0-9_'+more+']','_',s)
+    if lc:
+        return s.lower()
+    
+    return s
+
+