diff --git a/Layout/default/Contract/Form.php b/Layout/default/Contract/Form.php
index 89af5da3e..9ec068aef 100644
--- a/Layout/default/Contract/Form.php
+++ b/Layout/default/Contract/Form.php
@@ -158,6 +158,13 @@
                   
                   <hr />
                   
+                  <div class="form-group row">
+                    <label class="col-lg-2 col-form-label" for="order_date">Bestelldatum</label>
+                    <div class="col-lg-10">
+                      <input type="text" class="form-control" name="order_date" id="order_date" value="<?=($contract->order_date) ? date("d.m.Y",$contract->order_date) : ""?>">
+                    </div>
+                  </div>
+                  
                   <div class="form-group row">
                     <label class="col-lg-2 col-form-label" for="finish_date">Fertigstellungsdatum</label>
                     <div class="col-lg-10">
diff --git a/Layout/default/Contractconfig/Form.php b/Layout/default/Contractconfig/Form.php
index 4f2c36e57..1204a89e0 100644
--- a/Layout/default/Contractconfig/Form.php
+++ b/Layout/default/Contractconfig/Form.php
@@ -72,11 +72,11 @@
                       <?php if($item->type == "enum"): ?>
                         <select class="form-control" name="itemvalues[<?=$item->id?>]">
                           <?php foreach($item->getTypedataArray() as $option): ?>
-                            <option value="<?=$option?>" <?=($item->getValue() == $option) ? "selected='selected'" : ""?>><?=$option?></option>
+                            <option value="<?=htmlentities($option)?>" <?=($item->getValue() == $option) ? "selected='selected'" : ""?>><?=htmlentities($option)?></option>
                           <?php endforeach; ?>
                         </select>
                       <?php else: ?>
-                        <input type="text" class="form-control <?=(is_array($error_items) && in_array($item->id, $error_items)) ? "invalid" : ""?>" name="itemvalues[<?=$item->id?>]" value="<?=(isset($request)) ? $request->itemvalues[$item->id] : $item->getValue()?>" />
+                        <input type="text" class="form-control <?=(is_array($error_items) && in_array($item->id, $error_items)) ? "invalid" : ""?>" name="itemvalues[<?=$item->id?>]" value="<?=(isset($request)) ? htmlentities($request->itemvalues[$item->id]) : htmlentities($item->getValue())?>" />
                     <?php endif; ?>
                       <small><?=$item->description?></small>
                     </td>
diff --git a/Layout/default/Contractconfiggroup/Index.php b/Layout/default/Contractconfiggroup/Index.php
index bd9525300..b7f13d131 100644
--- a/Layout/default/Contractconfiggroup/Index.php
+++ b/Layout/default/Contractconfiggroup/Index.php
@@ -187,7 +187,7 @@
                                   <div class="col-md-4">
                                     <div class="form-group">
                                       <label for="item_<?=$item->id?>_displayname">Anzeigename</label>
-                                      <input type="text" class="form-control" id="item_<?=$item->id?>_displayname" name="displayname" value="<?=$item->displayname?>" />
+                                      <input type="text" class="form-control" id="item_<?=$item->id?>_displayname" name="displayname" value="<?=htmlentities($item->displayname)?>" />
                                     </div>
                                   </div>
 
diff --git a/application/Contract/Contract.php b/application/Contract/Contract.php
index eb35dfcbf..fc4002b52 100644
--- a/application/Contract/Contract.php
+++ b/application/Contract/Contract.php
@@ -10,6 +10,7 @@ class Contract extends mfBaseModel {
   private $contractConfigGroups;
   private $contractConfigItems;
   private $configgroups;
+  private $configvalues;
   private $isCancelled;
   private $journals;
   private $links;
@@ -161,11 +162,11 @@ class Contract extends mfBaseModel {
         return $this->orderproduct;
       }
       
-      if($name == "contractConfigGroups") {
+      /*if($name == "contractConfigGroups") {
         $product = $this->getProperty("product");
         $this->contractConfigGroups = ContractconfigGroupModel::search(['producttech_id' => $product->producttech_id]);
         return $this->contractConfigGroups;
-      }
+      }*/
       
       if($name == "configgroups") {
         $product = $this->getProperty("product");
@@ -174,10 +175,21 @@ class Contract extends mfBaseModel {
           $ccpg->contractconfiggroup->setContractId($this->id);
           $this->configgroups[] = $ccpg->contractconfiggroup;
         }
+        
         return $this->configgroups;
       }
       
-      if($name == "contractConfigItems") {
+      if($name == "configvalues") {
+        foreach($this->getProperty("configgroups") as $group) {
+          foreach($group->items as $item) {
+            $this->configvalues[$item->name] = $item;
+          }
+        }
+        
+        return $this->configvalues;
+      }
+      
+      /*if($name == "contractConfigItems") {
         $product = $this->getProperty("product");
         
         $this->contractConfigItems = [];
@@ -187,7 +199,7 @@ class Contract extends mfBaseModel {
         }
         
         return $this->contractConfigItems;
-      }
+      }*/
       
       if($name == "journals") {
         $this->journals = array_reverse(ContractjournalModel::search(["contract_id" => $this->id]));
diff --git a/application/Contract/ContractController.php b/application/Contract/ContractController.php
index fb4c9f56d..d32a3149e 100644
--- a/application/Contract/ContractController.php
+++ b/application/Contract/ContractController.php
@@ -379,6 +379,7 @@ class ContractController extends mfBaseController {
     }
     
     $this->layout()->set("contract", $contract);
+    //var_dump($contract->owner);exit;
     
     if($this->request->f == "view") $this->layout()->set("f", "view");
     if($this->request->f != "view") $this->layout()->set("f", "index");
@@ -428,6 +429,7 @@ class ContractController extends mfBaseController {
     $contract_data['price_nbe'] = (float)$r->price_nbe;
     $contract_data['billing_period'] = (int)$r->billing_period;
     $contract_data['billing_delay'] = (int)$r->billing_delay;
+    $contract_data['order_date'] = ($r->order_date) ? $this->dateToTimestamp($r->order_date) : null;
     $contract_data['finish_date'] = ($r->finish_date) ? $this->dateToTimestamp($r->finish_date) : null;
     $contract_data['cancel_date'] = ($r->cancel_date) ? $this->dateToTimestamp($r->cancel_date) : null;
     $contract_data['note'] = $r->note;
@@ -475,12 +477,14 @@ class ContractController extends mfBaseController {
     }
     
     // create journal
-    $journal = ContractjournalModel::create([
-      'contract_id' => $contract_id,
-      'type' => "created_from",
-      'value' => "manual"
-    ]);
-    $journal->save();
+    if($mode == "add") {
+      $journal = ContractjournalModel::create([
+        'contract_id' => $contract_id,
+        'type' => "created_from",
+        'value' => "manual"
+      ]);
+      $journal->save();
+    }
     
     $this->layout()->setFlash("Vertrag erfolgreich gespeichert.", "success");
     
diff --git a/application/Contractconfig/hooks/Contractconfig_Hook.php b/application/Contractconfig/hooks/Contractconfig_Hook.php
index 2b31194b6..90addbcf1 100644
--- a/application/Contractconfig/hooks/Contractconfig_Hook.php
+++ b/application/Contractconfig/hooks/Contractconfig_Hook.php
@@ -1,30 +1,18 @@
 <?php
 
 abstract class Contractconfig_Hook {
+  protected $required_product_attributes = [];
   protected $contract;
   protected $items;
   
-  public function __construct(Contract $contract) {
-    
-    if(method_exists($this, "init")) {
-      $this->init();
-    }
-  }
+  protected $product;
+  protected $product_attributes = [];
   
-  public function isResponsible() {
-    if(!$this->contract) return false;
-    
-    // only work on contracts with our producttech attributes
-    if(!$this->testMyProductAttributes($contract)) {
-      return false;
-    }
-    
-  }
+  protected $config_prefix;
+  protected $configitems = [];
+  
+  public $errors = [];
   
-  private function testMyProductAttributes(Contract $contract) {
-    $product = $contract->product;
-    
-  }
   
   abstract public function beforeSave();
   abstract public function afterSave();
@@ -32,4 +20,76 @@ abstract class Contractconfig_Hook {
   abstract public function beforeDelete();
   abstract public function afterDelete();
   
+  
+  public function __construct(Contract $contract) {
+    $this->contract = $contract;
+    
+    if($contract->product) {
+      $this->product = $contract->product;
+      if(is_array($this->product->attributes) && count($this->product->attributes)) {
+        $this->product_attributes = $this->product->attributes;
+      }
+    }
+    
+    $this->loadConfigItems();
+    
+    if(method_exists($this, "init")) {
+      $this->init();
+    }
+  }
+  
+  private function loadConfigItems() {
+    $m = [];
+    if(preg_match('/^Contractconfig_Hook_(.+)$/', get_class($this), $m)) {
+      if($m[1]) {
+        $this->config_prefix = strtolower($m[1]);
+      }
+    } else {
+      return false;
+    }
+    
+    foreach($this->contract->configgroups as $configgroup) {
+      foreach($configgroup->items as $item) {
+        if(strpos($item->name, $this->config_prefix) === 0) {
+          $short_name = substr($item->name, strlen($this->config_prefix)+1);
+          //var_dump($short_name);
+          $this->configitems[$short_name] = $item;
+        }
+      }
+    }
+    
+    return true;
+  }
+  
+  public function isResponsible() {
+    if(!$this->contract) return false;
+    if(!$this->product) return false;
+    if(!$this->product_attributes) return false;
+    
+    // only work on contracts with our producttech attributes
+    if(!$this->testMyProductAttributes()) {
+      return false;
+    }
+    
+    return true;
+  }
+  
+  private function testMyProductAttributes() {
+    if(!$this->product_attributes) return false;
+    
+    //var_dump($this->product_attributes);exit;
+    //var_dump($this->required_product_attributes);exit;
+    foreach($this->required_product_attributes as $needed_attribute) {
+      // every needed attribute must exist in product
+      if(!array_key_exists($needed_attribute, $this->product_attributes)) {
+        return false;
+      }
+    }
+    
+    return true;
+    
+  }
+  
+  
+  
 }
\ No newline at end of file
diff --git a/application/Contractconfig/hooks/Voicenumberblock.php b/application/Contractconfig/hooks/Voicenumberblock.php
new file mode 100644
index 000000000..cb6745210
--- /dev/null
+++ b/application/Contractconfig/hooks/Voicenumberblock.php
@@ -0,0 +1,124 @@
+<?php
+
+class Contractconfig_Hook_Voicenumberblock extends Contractconfig_Hook {
+  protected $required_product_attributes = ["needs_number"];
+  private $voip_routing;
+  
+  
+  /*
+   * Checks to determine if class needs to work on contract.
+   */
+  public function isResponsible() {
+    
+    /*
+     * Test for standard checks
+     * (Only Producttech attributes for now)
+     */
+    if(!parent::isResponsible()) {
+      return false;
+    }
+    
+    // do additional checks
+    //$contract = $this->contract;
+    return true;
+  }
+  
+  public function init() {
+    // get voip routing for number
+    if(is_array($this->contract->configvalues)) {
+      // look in contract config
+      if(array_key_exists("voip_routing",$this->contract->configvalues) && $this->contract->configvalues['voip_routing']->value->string) {
+        $this->voip_routing = $this->contract->configvalues['voip_routing']->value->string;
+      } else {
+        // else take first value (default)
+        $typedata = $this->voip_routing = $this->contract->configvalues['voip_routing']->getTypedataArray();
+        $this->voip_routing = $typedata[0];
+      }
+    }
+    
+  }
+  
+  public function beforeSave() {
+    
+  }
+  
+  public function afterSave() {
+    // check if number was saved
+    if(!array_key_exists("voicenumber", $this->configitems)) {
+      echo "configitem voicenumber does not exists\n";
+      return true;
+    }
+    echo "configitem voicenumber exists\n";
+    $item = $this->configitems['voicenumber'];
+    $number = $item->value->string;
+    if(!$number) {
+      echo "Keine nummer gespeichert\n";
+      return true;
+    }
+    echo "Nummer: $number\n";
+    
+    // check if Voicenumber exists
+    $voicenumberblock = Voicenumberblock::findBlock($number);
+    if(!$voicenumberblock) {
+      $this->errors[] = "Ungültige Rufnummer: Kein aktiver Rufnummernblock gefunden";
+      echo "Voicenumberblock für $number nicht gefunden\n";
+    }
+    
+    if(!$voicenumberblock->isNumberInBlock($number)) {
+      $this->errors[] = "Ungültige Rufnummer: Bitte Rufnummernlänge kontrollieren! Block erlaubt ".$voicenumberblock->first ." bis ".$voicenumberblock->last;
+      echo "Voicenumber $number not in Block ".$voicenumberblock->prefix."\n";
+      return false;
+    }
+    
+    $voicenumber = VoicenumberModel::getFirst(['number' => $number]);
+    if($voicenumber) {
+      // check if number belongs to another contract
+      if($voicenumber->contract_id) {
+        if($voicenumber->contract_id == $this->contract->id) {
+          // belongs to our contract already => no changes needed
+          return true;
+        }
+        $this->errors[] = "Ungültige Rufnummer: Rufnummer gehört zu bestehendem contract ".$voicenumber->contract_id;
+        return false;
+      }
+      // check if number is locked
+      if($voicenumber->disabled) {
+        $this->errors[] = "Ungültige Rufnummer: Rufnummer ist gesperrt ".$voicenumber->contract_id;
+        return false;
+      }
+      // check if number was ported out
+      if($voicenumber->ported_out) {
+        $this->errors[] = "Ungültige Rufnummer: Rufnummer wurde rausportiert ".$voicenumber->contract_id;
+        return false;
+      }
+    } else {
+      echo "creating voicenumber $number in block ".$voicenumberblock->prefix."\n";
+      $voicenumber = VoicenumberModel::create([
+        'voicenumberblock_id' => $voicenumberblock->id,
+        "contract_id" => $this->contract->id,
+        'active' => 1,
+        'activated_date' => date('U'),
+        'routing' => $this->voip_routing,
+        'number' => $number,
+        'disabled' => 0
+      ]);
+      if(!$voicenumber->save()) {
+        echo "Error saving new number\n";
+      }
+      
+      return true;
+    }
+    
+    
+    
+    
+  }
+  
+  public function beforeDelete() {
+    
+  }
+  
+  public function afterDelete() {
+    
+  }
+}
\ No newline at end of file
diff --git a/application/Contractconfig/hooks/Voip.php b/application/Contractconfig/hooks/Voip.php
deleted file mode 100644
index 06ba1d585..000000000
--- a/application/Contractconfig/hooks/Voip.php
+++ /dev/null
@@ -1,42 +0,0 @@
-<?php
-
-class Contractconfig_Hook_Voip extends Contractconfig_Hook {
-  private $my_product_attributes = ["needs_number"];
-  
-  /*
-   * Checks to determine if class needs to work on contract.
-   */
-  public function isResponsible(Contract $contract) {
-    
-    /*
-     * Test for standard checks
-     * (Only Producttech attributes for now)
-     */
-    if(!parent::isResponsible()) {
-      return false;
-    }
-    
-    // do additional checks
-    
-  }
-  
-  public function init() {
-    
-  }
-  
-  public function beforeSave() {
-    
-  }
-  
-  public function afterSave() {
-    
-  }
-  
-  public function beforeDelete() {
-    
-  }
-  
-  public function afterDelete() {
-    
-  }
-}
\ No newline at end of file
diff --git a/application/Voicenumber/Voicenumber.php b/application/Voicenumber/Voicenumber.php
index a48cd976a..7f7947edc 100644
--- a/application/Voicenumber/Voicenumber.php
+++ b/application/Voicenumber/Voicenumber.php
@@ -25,9 +25,11 @@ class Voicenumber extends mfBaseModel {
     } else {
       $this->ported_out = 0;
     }
-    
-    if($this->active == 1 && !$this->_old_data->active) {
-      $this->activated_date = date("U");
+    //var_dump($this);exit;
+    if(is_array($this->_old_data) && count($this->_old_data)) {
+      if($this->active == 1 && !$this->_old_data->active) {
+        $this->activated_date = date("U");
+      }
     }
   }
   
diff --git a/application/Voicenumber/VoicenumberController.php b/application/Voicenumber/VoicenumberController.php
index db0e93eaa..ac3cd4e4c 100644
--- a/application/Voicenumber/VoicenumberController.php
+++ b/application/Voicenumber/VoicenumberController.php
@@ -47,7 +47,6 @@ class VoicenumberController extends mfBaseController {
       $number->number = $num;
       $mode = "add";
     }
-    //var_dump($number);exit;
     
     $this->layout()->setTemplate("Voicenumber/Form");
     $this->layout()->set("number", $number);
@@ -57,7 +56,7 @@ class VoicenumberController extends mfBaseController {
   
   protected function saveAction() {
     $r = $this->request;
-    var_dump($r);exit;
+    //var_dump($r);exit;
     $block_id = $r->block_id;
     if(!is_numeric($block_id) || !$block_id) {
       $this->layout()->setFlash("Rufnummer nicht gefunden1", "error");
@@ -96,7 +95,7 @@ class VoicenumberController extends mfBaseController {
     
     
     $number_data = [];
-    $number_data['contract_id'] = $r->contract_id;
+    $number_data['contract_id'] = ($r->contract_id) ? $r->contract_id : null;
     if($r->active === "1") {
       $number_data['active'] = 1;
     } else {
@@ -141,10 +140,15 @@ class VoicenumberController extends mfBaseController {
           $number_data['disabled_reason'] = "reserved";
       }
       
+    } else {
+      $number_data['disabled'] = 0;
+      $number_data['disabled_reason'] = null;
     }
     
     if($r->enable_on_date) {
       $number_data['enable_on_date'] = self::dateToTimestamp($r->enable_on_date);
+    } else {
+      $number_data['enable_on_date'] = null;
     }
     $number_data['comment'] = $r->comment;
     $number_data['edit_by'] = $this->me->id;
diff --git a/application/Voicenumber/VoicenumberModel.php b/application/Voicenumber/VoicenumberModel.php
index 008e3d3d0..5f47118c1 100644
--- a/application/Voicenumber/VoicenumberModel.php
+++ b/application/Voicenumber/VoicenumberModel.php
@@ -1,12 +1,23 @@
 <?php
 
 class VoicenumberModel {
-  public $name;
+  public $voicenumberblock_id;
+  public $orderproduct_id;
+  public $contract_id;
+  public $active;
+  public $activated_date;
+  public $routing;
+  public $number;
   public $countrycode;
-  public $areacode;
-  public $first;
-  public $last;
-  public $number_prepend_zero;
+  public $ported_from;
+  public $ported_to;
+  public $port_in_date;
+  public $port_out_date;
+  public $ported_in;
+  public $ported_out;
+  public $disabled;
+  public $disabled_reason;
+  public $enable_on_date;
   public $comment;
   
   public $create_by;
@@ -56,7 +67,7 @@ class VoicenumberModel {
     $db = FronkDB::singleton();
     
     $where = self::getSqlFilter($filter);
-    //mfLoghandler::singleton()->debug($where);
+    mfLoghandler::singleton()->debug($where);
     $res = $db->select("Voicenumber", "*", "$where ORDER BY voicenumberblock_id, number");
     if($db->num_rows($res)) {
       $data = $db->fetch_object($res);
@@ -146,9 +157,9 @@ class VoicenumberModel {
     }
     
     if(array_key_exists("number", $filter)) {
-      $number = $filter['number'];
-      if(is_numeric($number)) {
-        $where .= " AND number = $number";
+      $number = $db->escape($filter['number']);
+      if($number) {
+        $where .= " AND number = '$number'";
       }
     }
     
diff --git a/application/Voicenumberblock/Voicenumberblock.php b/application/Voicenumberblock/Voicenumberblock.php
index 74ed8e503..3053e1795 100644
--- a/application/Voicenumberblock/Voicenumberblock.php
+++ b/application/Voicenumberblock/Voicenumberblock.php
@@ -15,6 +15,26 @@ class Voicenumberblock extends mfBaseModel {
     return ($number >= $this->first && $number <= $this->last);
   }
   
+  public static function findBlock($number) {
+    // resolve number from right to left to find fitting block
+    $minLength = 4;
+    
+    $try = $number;
+    while(strlen($try) >= $minLength) {
+      $block = VoicenumberblockModel::getFirst(['prefix' => $try]);
+      if($block) {
+        break;
+      }
+      $try = substr($try, 0, strlen($try)-1);
+    }
+    
+    if(!$block) {
+      return false;
+    }
+    
+    return $block;
+  }
+  
   public function getProperty($name) {
     if($this->$name == null) {
       
diff --git a/application/Voicenumberblock/VoicenumberblockModel.php b/application/Voicenumberblock/VoicenumberblockModel.php
index ff2d7d3da..eb4a4389d 100644
--- a/application/Voicenumberblock/VoicenumberblockModel.php
+++ b/application/Voicenumberblock/VoicenumberblockModel.php
@@ -52,7 +52,7 @@ class VoicenumberblockModel {
     
   }
   
-  public static function getFirst() {
+  public static function getFirst($filter = false) {
     $db = FronkDB::singleton();
     
     $where = self::getSqlFilter($filter);
@@ -137,6 +137,13 @@ class VoicenumberblockModel {
       }
     }
     
+    if(array_key_exists("prefix", $filter)) {
+      $prefix = $filter['prefix'];
+      if(is_numeric($prefix)) {
+        $where .= " AND prefix = '$prefix'";
+      }
+    }
+    
     if(array_key_exists("first", $filter)) {
       $first = $filter['first'];
       if(is_numeric($first)) {
diff --git a/scripts/test.php b/scripts/test.php
new file mode 100644
index 000000000..3da336a9b
--- /dev/null
+++ b/scripts/test.php
@@ -0,0 +1,37 @@
+#!/usr/bin/php
+<?php
+
+//require 'vendor/autoload.php';
+require("../config/config.php");
+
+define('FRONKDB_SQLDEBUG',false);
+error_reporting(E_ALL & ~(E_NOTICE | E_STRICT | E_DEPRECATED));
+
+require_once(LIBDIR."/mvcfronk/mfRouter/mfRouter.php");
+require_once(LIBDIR."/mvcfronk/mfBase/mfBaseModel.php");
+require_once(LIBDIR."/mvcfronk/mfBase/mfBaseController.php");
+
+$me = new User(1);
+define("INTERNAL_USER_ID", $me->id);
+define("INTERNAL_USER_USERNAME", $me->username);
+
+$contract = new Contract(22);
+require_once(APPDIR."Contractconfig/hooks/Contractconfig_Hook.php");
+require_once(APPDIR."Contractconfig/hooks/Voicenumberblock.php");
+
+$hook = new Contractconfig_Hook_Voicenumberblock($contract);
+
+if(!$hook->isResponsible()) {
+  echo "is responsible: no\n";
+  exit;
+} else {
+  $hook->afterSave();
+}
+if($hook->errors) {
+  echo "Fehler beim speichern: \n";
+  foreach($hook->errors as $error) {
+    echo $error."\n";
+  }
+  exit;
+}
+echo "All done.\n";
\ No newline at end of file