[0000313] Fixed multiply vulnerabilities.
[fa-stable.git] / sales / includes / sales_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 include_once($path_to_root . "/includes/banking.inc");
13 include_once($path_to_root . "/includes/db/inventory_db.inc");
14 include_once($path_to_root . "/sales/includes/db/sales_order_db.inc");
15 include_once($path_to_root . "/sales/includes/db/sales_credit_db.inc");
16 include_once($path_to_root . "/sales/includes/db/sales_invoice_db.inc");
17 include_once($path_to_root . "/sales/includes/db/sales_delivery_db.inc");
18 include_once($path_to_root . "/sales/includes/db/sales_types_db.inc");
19 include_once($path_to_root . "/sales/includes/db/sales_points_db.inc");
20 include_once($path_to_root . "/sales/includes/db/sales_groups_db.inc");
21 include_once($path_to_root . "/sales/includes/db/recurrent_invoices_db.inc");
22 include_once($path_to_root . "/sales/includes/db/custalloc_db.inc");
23 include_once($path_to_root . "/sales/includes/db/cust_trans_db.inc");
24 include_once($path_to_root . "/sales/includes/db/cust_trans_details_db.inc");
25 include_once($path_to_root . "/sales/includes/db/payment_db.inc");
26 include_once($path_to_root . "/sales/includes/db/branches_db.inc");
27 include_once($path_to_root . "/sales/includes/db/customers_db.inc");
28
29 //----------------------------------------------------------------------------------------
30 // $price in customer's currency
31 // $quantity is used as is (if it's neg it's neg, if it's pos it's pos)
32 // $std_cost is in home currency
33 // $show_or_hide 1 show this item in invoice/credit views, 0 to hide it (used for write-off items)
34 // $type is 10 (invoice) or 11 (credit)
35
36 function add_stock_move_customer($type, $stock_id, $trans_id, $location, $date_, $reference,
37         $quantity, $std_cost, $show_or_hide=1, $price=0, $discount_percent=0)
38 {
39         return add_stock_move($type, $stock_id, $trans_id, $location, $date_, $reference,
40                 $quantity, $std_cost, 0, $show_or_hide, $price, $discount_percent,
41                 "The customer stock movement record cannot be inserted");
42 }
43
44 //----------------------------------------------------------------------------------------
45 // add a debtor-related gl transaction
46 // $date_ is display date (non-sql)
47 // $amount is in CUSTOMER'S currency
48
49 function add_gl_trans_customer($type, $type_no, $date_, $account, $dimension, $dimension2,
50         $amount, $customer_id, $err_msg="", $rate=0)
51 {
52         if ($err_msg == "")
53                 $err_msg = "The customer GL transaction could not be inserted";
54
55         return add_gl_trans($type, $type_no, $date_, $account, $dimension, $dimension2, "", $amount,
56                 get_customer_currency($customer_id),
57                 PT_CUSTOMER, $customer_id, $err_msg, $rate);
58 }
59
60 //----------------------------------------------------------------------------------------
61
62 function get_calculated_price($stock_id, $add_pct)
63 {
64         $avg = get_standard_cost($stock_id);
65         if ($avg == 0)
66                 return 0;
67         return round2($avg * (1 + $add_pct / 100), user_price_dec());
68 }
69
70 function round_to_nearest($price, $round_to)
71 {
72         if ($price == 0)
73                 return 0;
74         $pow = pow(10, user_price_dec());
75         if ($pow >= $round_to)
76                 $mod = ($pow % $round_to);
77         else
78                 $mod = ($round_to % $pow);
79         if ($mod != 0)
80                 $price = ceil($price) - ($pow - $round_to) / $pow;
81         else    
82         $price = ceil($price * ($pow / $round_to)) / ($pow / $round_to);
83     return $price;
84
85 }
86
87 function get_price ($stock_id, $currency, $sales_type_id, $factor=null, $date=null)
88 {
89         if ($date == null)
90             $date = new_doc_date();
91
92         if ($factor === null) 
93         {
94                 $myrow = get_sales_type($sales_type_id);
95                 $factor = $myrow['factor'];
96         }
97
98         $add_pct = get_company_pref('add_pct');
99         $base_id = get_base_sales_type();
100     $home_curr = get_company_currency();
101         //      AND (sales_type_id = $sales_type_id     OR sales_type_id = $base_id)
102         $sql = "SELECT price, curr_abrev, sales_type_id
103                 FROM ".TB_PREF."prices
104                 WHERE stock_id = ".db_escape($stock_id)."
105                         AND (curr_abrev = ".db_escape($currency)." OR curr_abrev = ".db_escape($home_curr).")";
106
107         $result = db_query($sql, "There was a problem retrieving the pricing information for the part $stock_id for customer");
108         $num_rows = db_num_rows($result);
109         $rate = round2(get_exchange_rate_from_home_currency($currency, $date),
110             user_exrate_dec());
111         $round_to = get_company_pref('round_to');
112         $prices = array();
113         while($myrow = db_fetch($result)) 
114         {
115             $prices[$myrow['sales_type_id']][$myrow['curr_abrev']] = $myrow['price'];
116         }
117         $price = false;
118         if (isset($prices[$sales_type_id][$currency])) 
119         {
120             $price = $prices[$sales_type_id][$currency];
121         }
122         elseif (isset($prices[$base_id][$currency])) 
123         {
124             $price = $prices[$base_id][$currency] * $factor;
125         }
126         elseif (isset($prices[$sales_type_id][$home_curr])) 
127         {
128             $price = $prices[$sales_type_id][$home_curr] / $rate;
129         }
130         elseif (isset($prices[$base_id][$home_curr])) 
131         {
132             $price = $prices[$base_id][$home_curr] * $factor / $rate;
133         }
134 /*
135         if (isset($prices[$sales_type_id][$home_curr])) 
136         {
137             $price = $prices[$sales_type_id][$home_curr] / $rate;
138         }
139         elseif (isset($prices[$base_id][$currency])) 
140         {
141             $price = $prices[$base_id][$currency] * $factor;
142         }
143         elseif (isset($prices[$base_id][$home_curr])) 
144         {
145             $price = $prices[$base_id][$home_curr] * $factor / $rate;
146         }
147 */      
148         elseif ($num_rows == 0 && $add_pct != -1)
149         {
150                 $price = get_calculated_price($stock_id, $add_pct);
151                 if ($currency != $home_curr)
152                         $price /= $rate;
153                 if ($factor != 0)
154                         $price *= $factor;
155         }       
156         if ($price === false)
157                 return 0;
158         elseif ($round_to != 1) 
159                 return round_to_nearest($price, $round_to);
160         else
161                 return round2($price, user_price_dec());
162 }
163 //----------------------------------------------------------------------------------------
164 //
165 //      Get price for given item or kit.
166 //  When $std==true price is calculated as a sum of all included stock items,
167 //      otherwise all prices set for kits and items are accepted.
168 //
169 function get_kit_price($item_code, $currency, $sales_type_id, $factor=null, 
170         $date=null, $std = false)
171 {
172         $kit_price = 0.00;
173         if (!$std) {
174                 $kit_price = get_price( $item_code, $currency, $sales_type_id, 
175                         $factor, $date);
176
177                 if ($kit_price !== 0) {
178                         return $kit_price;
179                 }
180         }       
181         // no price for kit found, get total value of all items
182         $kit = get_item_kit($item_code);
183         
184         while($item = db_fetch($kit)) {
185                 if ($item['item_code'] != $item['stock_id']) {
186                         // foreign/kit code
187                         $kit_price += $item['quantity'] * get_kit_price( $item['stock_id'], 
188                                 $currency, $sales_type_id, $factor, $date, $std);
189
190                 } else {
191                         // stock item
192                         $kit_price += $item['quantity'] * get_price( $item['stock_id'], 
193                                 $currency, $sales_type_id, $factor, $date);
194                 }
195         }
196         return $kit_price;
197 }
198
199 //--------------------------------------------------------------------------------------------------
200 function update_parent_line($doc_type, $line_id, $qty_dispatched, $auto=false)
201 {
202         $doc_type = get_parent_type($doc_type);
203
204         $qty_dispatched = (float)$qty_dispatched;
205
206 //      echo "update line: $line_id, $doc_type, $qty_dispatched";
207         if ($doc_type==0)
208                 return false;
209         else {
210                 if ($doc_type==ST_SALESORDER)
211                 {
212                         $sql = "UPDATE ".TB_PREF."sales_order_details
213                                 SET qty_sent = qty_sent + $qty_dispatched";
214                         if ($auto)
215                                 $sql .= ", quantity = quantity + $qty_dispatched";
216                         $sql .= " WHERE id=".db_escape($line_id);
217                 }               
218                 else
219                         $sql = "UPDATE ".TB_PREF."debtor_trans_details
220                                 SET qty_done = qty_done + $qty_dispatched
221                                 WHERE id=".db_escape($line_id);
222         }
223         db_query($sql, "The parent document detail record could not be updated");
224         return true;
225 }
226
227 //--------------------------------------------------------------------------------------------------
228 // find inventory location for given transaction
229 //
230 function get_location(&$cart)
231 {
232         $sql = "SELECT ".TB_PREF."locations.* FROM ".TB_PREF."stock_moves,"
233                 .TB_PREF."locations".
234                 " WHERE type=".db_escape($cart->trans_type).
235                 " AND trans_no=".key($cart->trans_no).
236                 " AND qty!=0 ".
237                 " AND ".TB_PREF."locations.loc_code=".TB_PREF."stock_moves.loc_code";
238         $result = db_query($sql, 'Retreiving inventory location');
239
240
241         if (db_num_rows($result)) {
242                 return db_fetch($result);
243         }
244         return null;
245 }
246 //--------------------------------------------------------------------------------------------------
247 // Generic read debtor transaction into cart
248 //
249 //      $trans_no - array of trans nums; special case trans_no==0 - new doc
250 //
251 function read_sales_trans($doc_type, $trans_no, &$cart)
252 {
253         if (!is_array($trans_no) && $trans_no)
254                         $trans_no = array($trans_no);
255
256         $cart->trans_type = $doc_type;
257         if (!$trans_no) { // new document
258                 $cart->trans_no = $trans_no;
259         } else {
260                 // read header data from first document
261                 $myrow = get_customer_trans($trans_no[0],$doc_type);
262                 if (count($trans_no)>1)
263                         $cart->trans_no = get_customer_trans_version($doc_type, $trans_no);
264                 else
265                         $cart->trans_no = array($trans_no[0]=>$myrow["version"]);
266
267                 $cart->set_sales_type($myrow["tpe"], $myrow["sales_type"], $myrow["tax_included"],0);
268
269                 $cart->set_customer($myrow["debtor_no"], $myrow["DebtorName"],
270                         $myrow["curr_code"], $myrow["discount"], $myrow["payment_terms"]);
271
272                 $cart->set_branch($myrow["branch_code"], $myrow["tax_group_id"],
273                         $myrow["tax_group_name"]);
274
275                 $cart->reference = $myrow["reference"];
276                 $cart->order_no = $myrow["order_"];
277                 $cart->due_date = sql2date($myrow["due_date"]);
278                 $cart->document_date = sql2date($myrow["tran_date"]);
279                 $cart->dimension_id = $myrow['dimension_id']; // added 2.1 Joe Hunt 2008-11-12
280                 $cart->dimension2_id = $myrow['dimension2_id'];
281                 $cart->Comments = '';
282                 foreach ( $trans_no as $trans ) {
283                         $cart->Comments .= get_comments_string($doc_type,$trans);
284                 }
285
286                 // FIX this should be calculated sum() for multiply parents
287
288                 $cart->set_delivery($myrow["ship_via"], $myrow["br_name"],
289                 $myrow["br_address"], $myrow["ov_freight"]);
290
291                 $location = 0;
292                 $myrow = get_location($cart); // find location from movement
293
294                 if($myrow!=null) {
295                         $cart->set_location($myrow['loc_code'], $myrow['location_name']);
296                 }
297
298                 $result = get_customer_trans_details($doc_type,$trans_no);
299                 if (db_num_rows($result) > 0) {
300                         for($line_no=0; $myrow = db_fetch($result); $line_no++) {
301                                 $cart->line_items[$line_no] = new line_details(
302                                         $myrow["stock_id"],$myrow["quantity"],
303                                         $myrow["unit_price"], $myrow["discount_percent"],
304                                         $myrow["qty_done"], $myrow["standard_cost"],
305                                         $myrow["StockDescription"],$myrow["id"], $myrow["debtor_trans_no"],
306                                         @$myrow["src_id"]);
307                         }
308                 }
309         } // !newdoc
310
311         return true;
312 }
313 //----------------------------------------------------------------------------------------
314
315 function get_sales_child_lines($trans_type, $trans_no, $lines=true)
316 {
317         if (!($ctype = get_child_type($trans_type)))
318                 return false;
319         if (!is_array($trans_no)) {
320                 $trans_no = array($trans_no);
321         }
322
323         $par_tbl = $trans_type == ST_SALESORDER ? "sales_order_details" : "debtor_trans_details";
324         $par_no = $trans_type == ST_SALESORDER ? "trans.order_no" : "trans.debtor_trans_no";
325
326         foreach($trans_no as $n => $trans) {
327                 $trans_no[$n] = db_escape($trans);
328         }
329         $sql = "SELECT child.*
330                         FROM
331                                 ".TB_PREF."debtor_trans_details child
332                         LEFT JOIN ".TB_PREF."$par_tbl trans 
333                                 ON child.src_id=trans.id AND child.debtor_trans_type=$ctype
334                         WHERE $par_no IN(". implode(',', array_values($trans_no)).")";
335
336         if (!$lines)
337                 $sql .= " GROUP BY child.debtor_trans_no";
338
339         $sql .= " ORDER BY child.debtor_trans_no";
340
341         return db_query($sql, "can't retrieve child trans");
342 }
343
344 function get_sales_child_numbers($trans_type, $trans_no)
345 {
346         $trans = array();
347         $res = get_sales_child_lines($trans_type, $trans_no, false);
348         while ($line = db_fetch($res)) {
349                 $trans[] = $line['debtor_trans_no'];
350         }
351         return $trans;
352 }
353
354 function get_sales_parent_lines($trans_type, $trans_no, $lines=true)
355 {
356         $partype = get_parent_type($trans_type);
357
358         if (!$partype)
359                 return false;
360
361         $par_tbl = $partype == ST_SALESORDER ? "sales_order_details" : "debtor_trans_details";
362         $par_no = $partype == ST_SALESORDER ? "parent.order_no" : "parent.debtor_trans_no";
363         $sql = "SELECT parent.*
364                         FROM
365                                 ".TB_PREF."$par_tbl parent
366                         LEFT JOIN ".TB_PREF."debtor_trans_details trans 
367                                 ON trans.src_id=parent.id
368                         WHERE
369                                 trans.debtor_trans_type=".db_escape($trans_type)
370                                 ." AND trans.debtor_trans_no=".db_escape($trans_no);
371         if (!$lines)
372                 $sql .= " GROUP BY $par_no";
373         
374         $sql .= " ORDER BY $par_no";
375         
376         return db_query($sql, "can't retrieve child trans");
377
378 }
379
380 function get_sales_parent_numbers($trans_type, $trans_no)
381 {
382         $trans = array();
383         $res = get_sales_parent_lines($trans_type, $trans_no, false);
384         while ($line = db_fetch($res))
385                 $trans[] = $line[$trans_type==ST_CUSTDELIVERY ? 'order_no' : 'debtor_trans_no'];
386         return $trans;
387 }
388
389 //----------------------------------------------------------------------------------------
390
391 function get_sales_child_documents($trans_type, $trans_no)
392 {
393         // FIXME -  credit notes retrieved here should be those linked to invoices containing 
394         // at least one line from related invoice
395
396         if (!count($trans_no))
397                 return false;
398         $childs = get_sales_child_numbers($trans_type, $trans_no, false);
399         if (!count($childs))
400                 return false;
401                 
402         $sql = "SELECT * FROM ".TB_PREF."debtor_trans
403                 WHERE type=".get_child_type($trans_type)." AND trans_no IN(". implode(',', array_values($childs)).")";
404
405         return db_query($sql,"The related credit notes could not be retreived");
406 }
407
408
409 ?>