Security update merged from 2.1.
[fa-stable.git] / admin / payment_terms.php
index 33ddf1189cc0bcc5fd911632224dfd62544dde50..5855b989dd78373afe723105712554bafc31f369 100644 (file)
@@ -1,6 +1,15 @@
 <?php
-
-$page_security = 10;
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_PAYTERMS';
 $path_to_root="..";
 include($path_to_root . "/includes/session.inc");
 
@@ -8,21 +17,10 @@ page(_("Payment Terms"));
 
 include($path_to_root . "/includes/ui.inc");
 
-
-//-------------------------------------------------------------------------------------------
-
-if (isset($_GET['selected_id']))
-{
-       $selected_id = $_GET['selected_id'];
-} 
-elseif (isset($_POST['selected_id']))
-{
-       $selected_id = $_POST['selected_id'];
-}
-
+simple_page_mode(true);
 //-------------------------------------------------------------------------------------------
 
-if (isset($_POST['ADD_ITEM']) OR isset($_POST['UPDATE_ITEM'])
+if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM'
 {
 
        $inpug_error = 0;
@@ -57,7 +55,7 @@ if (isset($_POST['ADD_ITEM']) OR isset($_POST['UPDATE_ITEM']))
 
        if ($inpug_error != 1)
        {
-       if (isset($selected_id)
+       if ($selected_id != -1
        {
                if (check_value('DaysOrFoll')) 
                {
@@ -73,7 +71,7 @@ if (isset($_POST['ADD_ITEM']) OR isset($_POST['UPDATE_ITEM']))
                                        days_before_due=0
                                        WHERE terms_indicator = " .db_escape( $selected_id );
                }
-
+                       $note = _('Selected payment terms have been updated');
        } 
        else 
        {
@@ -92,20 +90,20 @@ if (isset($_POST['ADD_ITEM']) OR isset($_POST['UPDATE_ITEM']))
                                        VALUES (" . db_escape($_POST['terms']) . ",
                                        0, " . db_escape($_POST['DayNumber']) . ")";
                }
-
+                       $note = _('New payment terms have been added');
        }
        //run the sql from either of the above possibilites
        db_query($sql,"The payment term could not be added or updated");
-
-               meta_forward($_SERVER['PHP_SELF']);
+               display_notification($note);
+               $Mode = 'RESET';
        }
 }
 
-if (isset($_GET['delete'])) 
+if ($Mode == 'Delete')
 {
        // PREVENT DELETES IF DEPENDENT RECORDS IN debtors_master
 
-       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtors_master WHERE payment_terms = '$selected_id'";
+       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtors_master WHERE payment_terms = ".db_escape($selected_id);
        $result = db_query($sql,"check failed");
        $myrow = db_fetch_row($result);
        if ($myrow[0] > 0) 
@@ -114,7 +112,7 @@ if (isset($_GET['delete']))
        } 
        else 
        {
-               $sql= "SELECT COUNT(*) FROM ".TB_PREF."suppliers WHERE payment_terms = '$selected_id'";
+               $sql= "SELECT COUNT(*) FROM ".TB_PREF."suppliers WHERE payment_terms = ".db_escape($selected_id);
                $result = db_query($sql,"check failed");
                $myrow = db_fetch_row($result);
                if ($myrow[0] > 0) 
@@ -125,22 +123,32 @@ if (isset($_GET['delete']))
                {
                        //only delete if used in neither customer or supplier accounts
 
-                       $sql="DELETE FROM ".TB_PREF."payment_terms WHERE terms_indicator='$selected_id'";
+                       $sql="DELETE FROM ".TB_PREF."payment_terms WHERE terms_indicator=".db_escape($selected_id);
                        db_query($sql,"could not delete a payment terms");
-
-                       meta_forward($_SERVER['PHP_SELF']);
+                       display_notification(_('Selected payment terms have been deleted'));
                }
        }
        //end if payment terms used in customer or supplier accounts
+       $Mode = 'RESET';
 }
 
+if ($Mode == 'RESET')
+{
+       $selected_id = -1;
+       $sav = get_post('show_inactive');
+       unset($_POST);
+       $_POST['show_inactive'] = $sav;
+}
 //-------------------------------------------------------------------------------------------------
 
 $sql = "SELECT * FROM ".TB_PREF."payment_terms";
+if (!check_value('show_inactive')) $sql .= " WHERE !inactive";
 $result = db_query($sql,"could not get payment terms");
 
+start_form();
 start_table($table_style);
 $th = array(_("Description"), _("Following Month On"), _("Due After (Days)"), "", "");
+inactive_control_column($th);
 table_header($th);
 
 $k = 0; //row colour counter
@@ -169,37 +177,37 @@ while ($myrow = db_fetch($result))
     label_cell($myrow["terms"]);
     label_cell($full_text);
     label_cell($after_text);
-    edit_link_cell("selected_id=".$myrow["terms_indicator"]);
-    delete_link_cell("selected_id=".$myrow["terms_indicator"]."&delete=1");
+       inactive_control_cell($myrow["terms_indicator"], $myrow["inactive"], 'payment_terms', "terms_indicator");
+       edit_button_cell("Edit".$myrow["terms_indicator"], _("Edit"));
+       delete_button_cell("Delete".$myrow["terms_indicator"], _("Delete"));
     end_row();
 
 
 } //END WHILE LIST LOOP
 
-end_table();
-
-hyperlink_no_params($_SERVER['PHP_SELF'], _("New Payment Term"));
+inactive_control_row($th);
+end_table(1);
 
 //-------------------------------------------------------------------------------------------------
 
-start_form();
-
 start_table($table_style2);
 
 $day_in_following_month = $days_before_due = 0;
-if (isset($selected_id)
+if ($selected_id != -1
 {
-       //editing an existing payment terms
-       $sql = "SELECT * FROM ".TB_PREF."payment_terms
-               WHERE terms_indicator='$selected_id'";
-
-       $result = db_query($sql,"could not get payment term");
-       $myrow = db_fetch($result);
-
-       $_POST['terms']  = $myrow["terms"];
-       $days_before_due  = $myrow["days_before_due"];
-       $day_in_following_month  = $myrow["day_in_following_month"];
-
+       if ($Mode == 'Edit') {
+               //editing an existing payment terms
+               $sql = "SELECT * FROM ".TB_PREF."payment_terms
+                       WHERE terms_indicator=".db_escape($selected_id);
+
+               $result = db_query($sql,"could not get payment term");
+               $myrow = db_fetch($result);
+
+               $_POST['terms']  = $myrow["terms"];
+               $days_before_due  = $myrow["days_before_due"];
+               $day_in_following_month  = $myrow["day_in_following_month"];
+               unset($_POST['DayNumber']);
+       }
        hidden('selected_id', $selected_id);
 }
 text_row(_("Terms Description:"), 'terms', null, 40, 40);
@@ -218,7 +226,7 @@ text_row_ex(_("Days (Or Day In Following Month):"), 'DayNumber', 3);
 
 end_table(1);
 
-submit_add_or_update_center(!isset($selected_id));
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();