Security update merged from 2.1.

[fa-stable.git] / admin / shipping_companies.php

diff --git a/admin/shipping_companies.php b/admin/shipping_companies.php
index e01ad9eff7312f849c72c0999ad9cd00fe6b4691..cb08f69bc088c5fa63fcf454f9cc1ae55320f1cc 100644 (file)
--- a/admin/shipping_companies.php
+++ b/admin/shipping_companies.php
@@ -1,7 +1,15 @@
 <?php
-
-
-$page_security = 14;
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_SHIPPING';
 $path_to_root="..";
 include($path_to_root . "/includes/session.inc");
 page(_("Shipping Company"));
@@ -25,10 +33,11 @@ function can_process()
 if ($Mode=='ADD_ITEM' && can_process()) 
 {
 
-       $sql = "INSERT INTO ".TB_PREF."shippers (shipper_name, contact, phone, address)
+       $sql = "INSERT INTO ".TB_PREF."shippers (shipper_name, contact, phone, phone2, address)
                VALUES (" . db_escape($_POST['shipper_name']) . ", " .
                db_escape($_POST['contact']). ", " .
                db_escape($_POST['phone']). ", " .
+               db_escape($_POST['phone2']). ", " .
                db_escape($_POST['address']) . ")";
 
        db_query($sql,"The Shipping Company could not be added");
@@ -44,8 +53,9 @@ if ($Mode=='UPDATE_ITEM' && can_process())
        $sql = "UPDATE ".TB_PREF."shippers SET shipper_name=" . db_escape($_POST['shipper_name']). " ,
                contact =" . db_escape($_POST['contact']). " ,
                phone =" . db_escape($_POST['phone']). " ,
+               phone2 =" . db_escape($_POST['phone2']). " ,
                address =" . db_escape($_POST['address']). "
-               WHERE shipper_id = $selected_id";
+               WHERE shipper_id = ".db_escape($selected_id);
 
        db_query($sql,"The shipping company could not be updated");
        display_notification(_('Selected shipping company has been updated'));
@@ -58,7 +68,7 @@ if ($Mode == 'Delete')
 {
 // PREVENT DELETES IF DEPENDENT RECORDS IN 'sales_orders'
 
-       $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE ship_via='$selected_id'";
+       $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE ship_via=".db_escape($selected_id);
        $result = db_query($sql,"check failed");
        $myrow = db_fetch_row($result);
        if ($myrow[0] > 0) 
@@ -70,7 +80,7 @@ if ($Mode == 'Delete')
        {
                // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
 
-               $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE ship_via='$selected_id'";
+               $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE ship_via=".db_escape($selected_id);
                $result = db_query($sql,"check failed");
                $myrow = db_fetch_row($result);
                if ($myrow[0] > 0) 
@@ -80,27 +90,32 @@ if ($Mode == 'Delete')
                } 
                else 
                {
-                       $sql="DELETE FROM ".TB_PREF."shippers WHERE shipper_id=$selected_id";
+                       $sql="DELETE FROM ".TB_PREF."shippers WHERE shipper_id=".db_escape($selected_id);
                        db_query($sql,"could not delete shipper");
                        display_notification(_('Selected shipping company has been deleted'));
-                       $Mode = 'RESET';
                }
        }
+       $Mode = 'RESET';
 }
 
 if ($Mode == 'RESET')
 {
        $selected_id = -1;
+       $sav = get_post('show_inactive');
        unset($_POST);
+       $_POST['show_inactive'] = $sav;
 }
 //----------------------------------------------------------------------------------------------
 
-$sql = "SELECT * FROM ".TB_PREF."shippers ORDER BY shipper_id";
+$sql = "SELECT * FROM ".TB_PREF."shippers";
+if (!check_value('show_inactive')) $sql .= " WHERE !inactive";
+$sql .= " ORDER BY shipper_id";
 $result = db_query($sql,"could not get shippers");
 
 start_form();
 start_table($table_style);
-$th = array(_("Name"), _("Contact Person"), _("Phone Number"), _("Address"), "", "");
+$th = array(_("Name"), _("Contact Person"), _("Phone Number"), _("Secondary Phone"), _("Address"), "", "");
+inactive_control_column($th);
 table_header($th);
 
 $k = 0; //row colour counter
@@ -111,20 +126,19 @@ while ($myrow = db_fetch($result))
        label_cell($myrow["shipper_name"]);
        label_cell($myrow["contact"]);
        label_cell($myrow["phone"]);
+       label_cell($myrow["phone2"]);
        label_cell($myrow["address"]);
-       edit_button_cell("Edit".$myrow[0], _("Edit"));
-       edit_button_cell("Delete".$myrow[0], _("Delete"));
+       inactive_control_cell($myrow["shipper_id"], $myrow["inactive"], 'shippers', 'shipper_id');
+       edit_button_cell("Edit".$myrow["shipper_id"], _("Edit"));
+       delete_button_cell("Delete".$myrow["shipper_id"], _("Delete"));
        end_row();
 }
 
-end_table();
-end_form();
-echo '<br>';
+inactive_control_row($th);
+end_table(1);
 
 //----------------------------------------------------------------------------------------------
 
-start_form();
-
 start_table($table_style2);
 
 if ($selected_id != -1) 
@@ -132,7 +146,7 @@ if ($selected_id != -1)
        if ($Mode == 'Edit') {
                //editing an existing Shipper
 
-               $sql = "SELECT * FROM ".TB_PREF."shippers WHERE shipper_id=$selected_id";
+               $sql = "SELECT * FROM ".TB_PREF."shippers WHERE shipper_id=".db_escape($selected_id);
 
                $result = db_query($sql, "could not get shipper");
                $myrow = db_fetch($result);
@@ -140,6 +154,7 @@ if ($selected_id != -1)
                $_POST['shipper_name']  = $myrow["shipper_name"];
                $_POST['contact']       = $myrow["contact"];
                $_POST['phone'] = $myrow["phone"];
+               $_POST['phone2']        = $myrow["phone2"];
                $_POST['address'] = $myrow["address"];
        }
        hidden('selected_id', $selected_id);
@@ -149,13 +164,15 @@ text_row_ex(_("Name:"), 'shipper_name', 40);
 
 text_row_ex(_("Contact Person:"), 'contact', 30);
 
-text_row_ex(_("Phone Number:"), 'phone', 20);
+text_row_ex(_("Phone Number:"), 'phone', 32, 30);
+
+text_row_ex(_("Secondary Phone Number:"), 'phone2', 32, 30);
 
 text_row_ex(_("Address:"), 'address', 50);
 
 end_table(1);
 
-submit_add_or_update_center($selected_id == -1, '', true);
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();
 end_page();