Security statements update against sql injection attacks.
[fa-stable.git] / gl / includes / db / gl_db_trans.inc
index f6a8ef1eab9a6d82fea76c9b10792e00955ade5e..82dbc830ca450de5bc3de3e32e571a5e630b0f57 100644 (file)
@@ -1,5 +1,14 @@
 <?php
-
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
 //--------------------------------------------------------------------------------
 
 // Base function for adding a GL transaction
 // if $currency is not set, then defaults to no conversion
 
 function add_gl_trans($type, $trans_id, $date_, $account, $dimension, $dimension2, $memo_,
-       $amount, $currency=null, $person_type_id=null, $person_id=null, $err_msg="")
+       $amount, $currency=null, $person_type_id=null, $person_id=null, $err_msg="", $rate=0)
 {
+       global $use_audit_trail;
+
        $date = date2sql($date_);
        if ($currency != null)
-               $amount_in_home_currency = to_home_currency($amount, $currency, $date_);
+       {
+               if ($rate == 0)
+                       $amount_in_home_currency = to_home_currency($amount, $currency, $date_);
+               else
+                       $amount_in_home_currency = round2($amount * $rate,  user_price_dec());
+       }               
        else
-               $amount_in_home_currency = $amount;
+               $amount_in_home_currency = round2($amount, user_price_dec());
        if ($dimension == null || $dimension < 0)
                $dimension = 0;
        if ($dimension2 == null || $dimension2 < 0)
                $dimension2 = 0;
+       if (isset($use_audit_trail) && $use_audit_trail)
+       {
+               if ($memo_ == "" || $memo_ == null)
+                       $memo_ = $_SESSION["wa_current_user"]->username;
+               else
+                       $memo_ = $_SESSION["wa_current_user"]->username . " - " . $memo_;
+       }
        $sql = "INSERT INTO ".TB_PREF."gl_trans ( type, type_no, tran_date,
                account, dimension_id, dimension2_id, memo_, amount";
 
@@ -27,18 +50,21 @@ function add_gl_trans($type, $trans_id, $date_, $account, $dimension, $dimension
 
        $sql .= ") ";
 
-       $sql .= "VALUES ($type, $trans_id, '$date',
-               $account, $dimension, $dimension2, '$memo_', $amount_in_home_currency";
+       $sql .= "VALUES (".db_escape($type).", ".db_escape($trans_id).", '$date',
+               ".db_escape($account).", ".db_escape($dimension).", "
+               .db_escape($dimension2).", ".db_escape($memo_).", "
+               .db_escape($amount_in_home_currency);
 
        if ($person_type_id != null)
-               $sql .= ", $person_type_id, '$person_id'";
+               $sql .= ", ".db_escape($person_type_id).", ". db_escape($person_id);
 
        $sql .= ") ";
 
        if ($err_msg == "")
                $err_msg = "The GL transaction could not be inserted";
 
-       return db_query($sql, $err_msg);
+       db_query($sql, $err_msg);
+       return $amount_in_home_currency;
 }
 
 //--------------------------------------------------------------------------------
@@ -47,16 +73,27 @@ function add_gl_trans($type, $trans_id, $date_, $account, $dimension, $dimension
 // $date_ is display date (non-sql)
 // $amount is in HOME currency
 
-function add_gl_trans_std_cost($type, $trans_id, $date_, $account, $dimension, $dimension2, 
+function add_gl_trans_std_cost($type, $trans_id, $date_, $account, $dimension, $dimension2,
        $memo_, $amount, $person_type_id=null, $person_id=null, $err_msg="")
 {
        if ($amount != 0)
                return add_gl_trans($type, $trans_id, $date_, $account, $dimension, $dimension2, $memo_,
                        $amount, null, $person_type_id, $person_id, $err_msg);
        else
-               return null;
+               return 0;
 }
 
+// Function for even out rounding problems
+function add_gl_balance($type, $trans_id, $date_, $amount, $person_type_id=null, $person_id=null)
+{
+       $amount = round2($amount, user_price_dec());
+       if ($amount != 0)
+               return add_gl_trans($type, $trans_id, $date_, get_company_pref('exchange_diff_act'), 0, 0, "",
+                       $amount, null, $person_type_id, $person_id, "The balanced GL transaction could not be inserted");
+       else
+               return 0;
+}      
+
 //--------------------------------------------------------------------------------
 
 function get_gl_transactions($from_date, $to_date, $trans_no=0,
@@ -65,24 +102,26 @@ function get_gl_transactions($from_date, $to_date, $trans_no=0,
        $from = date2sql($from_date);
        $to = date2sql($to_date);
 
-       $sql = "SELECT ".TB_PREF."gl_trans.*, ".TB_PREF."chart_master.account_name FROM ".TB_PREF."gl_trans, ".TB_PREF."chart_master
+       $sql = "SELECT ".TB_PREF."gl_trans.*, "
+               .TB_PREF."chart_master.account_name FROM ".TB_PREF."gl_trans, "
+               .TB_PREF."chart_master
                WHERE ".TB_PREF."chart_master.account_code=".TB_PREF."gl_trans.account
                AND tran_date >= '$from'
                AND tran_date <= '$to'";
        if ($trans_no > 0)
-               $sql .= " AND ".TB_PREF."gl_trans.type_no LIKE '%$trans_no'";
+               $sql .= " AND ".TB_PREF."gl_trans.type_no LIKE ".db_escape('%'.$trans_no);
 
        if ($account != null)
-               $sql .= " AND ".TB_PREF."gl_trans.account = $account";
+               $sql .= " AND ".TB_PREF."gl_trans.account = ".db_escape($account);
 
        if ($dimension > 0)
-               $sql .= " AND ".TB_PREF."gl_trans.dimension_id = $dimension";
+               $sql .= " AND ".TB_PREF."gl_trans.dimension_id = ".db_escape($dimension);
 
        if ($dimension2 > 0)
-               $sql .= " AND ".TB_PREF."gl_trans.dimension2_id = $dimension2";
+               $sql .= " AND ".TB_PREF."gl_trans.dimension2_id = ".db_escape($dimension2);
 
        if ($filter_type != null AND is_numeric($filter_type))
-               $sql .= " AND ".TB_PREF."gl_trans.type= $filter_type";
+               $sql .= " AND ".TB_PREF."gl_trans.type= ".db_escape($filter_type);
 
        $sql .= " ORDER BY tran_date";
 
@@ -94,30 +133,48 @@ function get_gl_transactions($from_date, $to_date, $trans_no=0,
 
 function get_gl_trans($type, $trans_id)
 {
-       $sql = "SELECT ".TB_PREF."gl_trans.*, ".TB_PREF."chart_master.account_name FROM ".TB_PREF."gl_trans, ".TB_PREF."chart_master
+       $sql = "SELECT ".TB_PREF."gl_trans.*, "
+               .TB_PREF."chart_master.account_name FROM "
+                       .TB_PREF."gl_trans, ".TB_PREF."chart_master
                WHERE ".TB_PREF."chart_master.account_code=".TB_PREF."gl_trans.account
-               AND ".TB_PREF."gl_trans.type=$type AND ".TB_PREF."gl_trans.type_no=$trans_id";
+               AND ".TB_PREF."gl_trans.type=".db_escape($type)
+               ." AND ".TB_PREF."gl_trans.type_no=".db_escape($trans_id);
 
        return db_query($sql, "The gl transactions could not be retrieved");
 }
 
 //--------------------------------------------------------------------------------
 
+function get_gl_wo_cost_trans($trans_id, $person_id=-1)
+{
+       $sql = "SELECT ".TB_PREF."gl_trans.*, ".TB_PREF."chart_master.account_name FROM "
+               .TB_PREF."gl_trans, ".TB_PREF."chart_master
+               WHERE ".TB_PREF."chart_master.account_code=".TB_PREF."gl_trans.account
+               AND ".TB_PREF."gl_trans.type=".systypes::work_order()." AND "
+               .TB_PREF."gl_trans.type_no=".db_escape($trans_id)."
+               AND ".TB_PREF."gl_trans.person_type_id=".payment_person_types::WorkOrder();
+       if ($person_id != -1)
+               $sql .= " AND ".TB_PREF."gl_trans.person_id=".db_escape($person_id);
+       $sql .= " AND amount < 0";      
+
+       return db_query($sql, "The gl transactions could not be retrieved");
+}
+
 function get_gl_balance_from_to($from_date, $to_date, $account, $dimension=0, $dimension2=0)
 {
        $from = date2sql($from_date);
        $to = date2sql($to_date);
 
     $sql = "SELECT SUM(amount) FROM ".TB_PREF."gl_trans
-               WHERE account='" . $account . "'";
+               WHERE account='$account'";
        if ($from_date != "")
                $sql .= "  AND tran_date > '$from'";
        if ($to_date != "")
                $sql .= "  AND tran_date < '$to'";
        if ($dimension > 0)
-               $sql .= " AND dimension_id = $dimension";
+               $sql .= " AND dimension_id = ".db_escape($dimension);
        if ($dimension2 > 0)
-               $sql .= " AND dimension2_id = $dimension2";
+               $sql .= " AND dimension2_id = ".db_escape($dimension2);
 
        $result = db_query($sql, "The starting balance for account $account could not be calculated");
 
@@ -133,15 +190,15 @@ function get_gl_trans_from_to($from_date, $to_date, $account, $dimension=0, $dim
        $to = date2sql($to_date);
 
     $sql = "SELECT SUM(amount) FROM ".TB_PREF."gl_trans
-               WHERE account='" . $account . "'";
+               WHERE account='$account'";
        if ($from_date != "")
                $sql .= " AND tran_date >= '$from'";
        if ($to_date != "")
                $sql .= " AND tran_date <= '$to'";
        if ($dimension > 0)
-               $sql .= " AND dimension_id = $dimension";
+               $sql .= " AND dimension_id = ".db_escape($dimension);
        if ($dimension2 > 0)
-               $sql .= " AND dimension2_id = $dimension2";
+               $sql .= " AND dimension2_id = ".db_escape($dimension2);
 
        $result = db_query($sql, "Transactions for account $account could not be calculated");
 
@@ -149,24 +206,57 @@ function get_gl_trans_from_to($from_date, $to_date, $account, $dimension=0, $dim
        return $row[0];
 }
 
+//----------------------------------------------------------------------------------------------------
+function get_balance($account, $dimension, $dimension2, $from, $to, $from_incl=true, $to_incl=true) 
+{
+       $sql = "SELECT SUM(IF(amount >= 0, amount, 0)) as debit, 
+               SUM(IF(amount < 0, -amount, 0)) as credit, SUM(amount) as balance 
+               FROM ".TB_PREF."gl_trans,".TB_PREF."chart_master,"
+                       .TB_PREF."chart_types, ".TB_PREF."chart_class 
+               WHERE ".TB_PREF."gl_trans.account=".TB_PREF."chart_master.account_code AND "
+               .TB_PREF."chart_master.account_type=".TB_PREF."chart_types.id 
+               AND ".TB_PREF."chart_types.class_id=".TB_PREF."chart_class.cid AND";
+               
+       if ($account != null)
+               $sql .= " account=".db_escape($account)." AND";
+       if ($dimension > 0)
+               $sql .= " dimension_id=".db_escape($dimension)." AND";
+       if ($dimension2 > 0)
+               $sql .= " dimension2_id=".db_escape($dimension2)." AND";
+       $from_date = date2sql($from);
+       if ($from_incl)
+               $sql .= " tran_date >= '$from_date'  AND";
+       else
+               $sql .= " tran_date > IF(balance_sheet>0 AND balance_sheet<".CL_INCOME.", '0000-00-00', '$from_date') AND";
+       $to_date = date2sql($to);
+       if ($to_incl)
+               $sql .= " tran_date <= '$to_date' ";
+       else
+               $sql .= " tran_date < '$to_date' ";
+
+       $result = db_query($sql,"No general ledger accounts were returned");
+
+       return db_fetch($result);
+}
+
 //--------------------------------------------------------------------------------
 
-function get_budget_trans_from_to($from_date, $to_date, $account, $dimension=0, $dimension2=0) 
+function get_budget_trans_from_to($from_date, $to_date, $account, $dimension=0, $dimension2=0)
 {
 
        $from = date2sql($from_date);
        $to = date2sql($to_date);
-       
+
        $sql = "SELECT SUM(amount) FROM ".TB_PREF."budget_trans
-               WHERE account=$account ";
-       if ($from_date != "")   
+               WHERE account=".db_escape($account);
+       if ($from_date != "")
                $sql .= " AND tran_date >= '$from' ";
-       if ($to_date != "")     
+       if ($to_date != "")
                $sql .= " AND tran_date <= '$to' ";
        if ($dimension > 0)
-               $sql .= " AND dimension_id = $dimension";
+               $sql .= " AND dimension_id = ".db_escape($dimension);
        if ($dimension2 > 0)
-               $sql .= " AND dimension2_id = $dimension2";
+               $sql .= " AND dimension2_id = ".db_escape($dimension2);
        $result = db_query($sql,"No budget accounts were returned");
 
        $row = db_fetch_row($result);
@@ -174,7 +264,106 @@ function get_budget_trans_from_to($from_date, $to_date, $account, $dimension=0,
 }
 
 //--------------------------------------------------------------------------------
+//     Stores journal/bank transaction tax details if applicable
+//
+function add_gl_tax_details($gl_code, $trans_type, $trans_no, $amount, $ex_rate, $date, $memo)
+{
+       $tax_type = is_tax_account($gl_code);
+       if(!$tax_type) return;  // $gl_code is not tax account
+       
+       $tax = get_tax_type($tax_type);
+       //if ($gl_code == $tax['sales_gl_code']) 
+       //      $amount = -$amount;
+       // we have to restore net amount as we cannot know the base amount
+       if ($tax['rate'] == 0) {
+//             display_warning(_("You should not post gl transactions  
+//                     to tax account with     zero tax rate."));
+               $net_amount = 0;
+       } else { 
+               // calculate net amount
+               $net_amount = $amount/$tax['rate']*100; 
+       }
+               
+       add_trans_tax_details($trans_type, $trans_no, $tax['id'], $tax['rate'], 0, 
+               $amount, $net_amount, $ex_rate, $date, $memo);
+                       
+}
+
+//--------------------------------------------------------------------------------
+//
+//     Store transaction tax details for fiscal purposes with 'freezed' 
+//     actual tax type rate.
+//
+function add_trans_tax_details($trans_type, $trans_no, $tax_id, $rate, $included,
+       $amount, $net_amount, $ex_rate, $tran_date, $memo)
+{
+
+       $sql = "INSERT INTO ".TB_PREF."trans_tax_details 
+               (trans_type, trans_no, tran_date, tax_type_id, rate, ex_rate,
+                       included_in_price, net_amount, amount, memo)
+               VALUES (".db_escape($trans_type)."," . db_escape($trans_no).",'"
+                               .date2sql($tran_date)."',".db_escape($tax_id).","
+                               .db_escape($rate).",".db_escape($ex_rate).",".($included ? 1:0).","
+                               .db_escape($net_amount).","
+                               .db_escape($amount).",".db_escape($memo).")";
+
+       db_query($sql, "Cannot save trans tax details");
+
+}
+//----------------------------------------------------------------------------------------
+
+function get_trans_tax_details($trans_type, $trans_no)
+{
+       $sql = "SELECT ".TB_PREF."trans_tax_details.*, "
+               .TB_PREF."tax_types.name AS tax_type_name
+               FROM ".TB_PREF."trans_tax_details,".TB_PREF."tax_types
+               WHERE trans_type = ".db_escape($trans_type)."
+               AND trans_no = ".db_escape($trans_no)."
+               AND (net_amount != 0 OR amount != 0)
+               AND ".TB_PREF."tax_types.id = ".TB_PREF."trans_tax_details.tax_type_id";
+
+       return db_query($sql, "The transaction tax details could not be retrieved");
+}
 
+//----------------------------------------------------------------------------------------
+
+function void_trans_tax_details($type, $type_no)
+{
+       $sql = "UPDATE ".TB_PREF."trans_tax_details SET amount=0, net_amount=0
+               WHERE trans_no=".db_escape($type_no)
+               ." AND trans_type=".db_escape($type);
+
+       db_query($sql, "The transaction tax details could not be voided");
+}
+
+function get_tax_summary($from, $to)
+{
+       $fromdate = date2sql($from);
+       $todate = date2sql($to);
+
+       $sql = "SELECT 
+                               SUM(IF(trans_type=11 || trans_type=20,-1,1)*
+                               IF(trans_type=2 || trans_type=10 || trans_type=11, net_amount*ex_rate,0)) net_output,
+                               SUM(IF(trans_type=11 || trans_type=20,-1,1)*
+                               IF(trans_type=2 || trans_type=10 || trans_type=11, amount*ex_rate,0)) payable,
+                               SUM(IF(trans_type=11 || trans_type=20,-1,1)*
+                               IF(trans_type=2 || trans_type=10 || trans_type=11, 0, net_amount*ex_rate)) net_input,
+                               SUM(IF(trans_type=11 || trans_type=20,-1,1)*
+                               IF(trans_type=2 || trans_type=10 || trans_type=11, 0, amount*ex_rate)) collectible,
+                               taxrec.rate,
+                               ttype.id,
+                               ttype.name
+               FROM ".TB_PREF."tax_types ttype,
+                        ".TB_PREF."trans_tax_details taxrec
+               WHERE taxrec.tax_type_id=ttype.id
+                       AND taxrec.trans_type != 13
+                       AND taxrec.tran_date >= '$fromdate'
+                       AND taxrec.tran_date <= '$todate'
+               GROUP BY ttype.id";
+//display_error($sql);
+    return db_query($sql,"Cannot retrieve tax summary");
+}
+//--------------------------------------------------------------------------------
 function add_journal_entries($items, $date_, $ref, $reverse, $memo_=null)
 {
        begin_transaction();
@@ -182,48 +371,56 @@ function add_journal_entries($items, $date_, $ref, $reverse, $memo_=null)
        $trans_type = systypes::journal_entry();
        $trans_id = get_next_trans_no($trans_type);
 
-       foreach ($items as $journal_item) 
+       foreach ($items as $journal_item)
        {
+               // post to first found bank account using given gl acount code.
                $is_bank_to = is_bank_account($journal_item->code_id);
 
-               add_gl_trans($trans_type, $trans_id, $date_, $journal_item->code_id, 
-                       $journal_item->dimension_id, $journal_item->dimension2_id, 
+               add_gl_trans($trans_type, $trans_id, $date_, $journal_item->code_id,
+                       $journal_item->dimension_id, $journal_item->dimension2_id,
                        $journal_item->reference, $journal_item->amount);
-       if ($is_bank_to) 
+       if ($is_bank_to)
        {
-               add_bank_trans($trans_type, $trans_id, $journal_item->code_id, $ref, 
-                       $date_, 3, $journal_item->amount,
-                       0, "", get_company_currency(), 
-                       "Cannot insert a destination bank transaction");                                                                
-       }               
+               add_bank_trans($trans_type, $trans_id, $is_bank_to, $ref,
+                       $date_, $journal_item->amount,
+                       0, "", get_company_currency(),
+                       "Cannot insert a destination bank transaction");
+       }
+               // store tax details if the gl account is a tax account
+               add_gl_tax_details($journal_item->code_id, 
+                       ($journal_item->amount < 0.0 ? 2 : 1), $trans_id, -$journal_item->amount, 1, $date_, $memo_);
        }
-
+       
        add_comments($trans_type, $trans_id, $date_, $memo_);
 
        references::save($trans_type, $trans_id, $ref);
 
-       if ($reverse) 
+       if ($reverse)
        {
 
-       $reversingDate = date(user_date_display(),
-               Mktime(0,0,0,get_month($date_)+1,1,get_year($date_)));
+       //$reversingDate = date(user_date_display(),
+       //      Mktime(0,0,0,get_month($date_)+1,1,get_year($date_)));
+       $reversingDate = begin_month(add_months($date_, 1));
 
        $trans_id_reverse = get_next_trans_no($trans_type);
 
-       foreach ($items as $journal_item) 
+       foreach ($items as $journal_item)
        {
                        $is_bank_to = is_bank_account($journal_item->code_id);
 
                add_gl_trans($trans_type, $trans_id_reverse, $reversingDate,
-                       $journal_item->code_id, $journal_item->dimension_id, $journal_item->dimension2_id, 
+                       $journal_item->code_id, $journal_item->dimension_id, $journal_item->dimension2_id,
                        $journal_item->reference, -$journal_item->amount);
-               if ($is_bank_to) 
+               if ($is_bank_to)
                {
-                       add_bank_trans($trans_type, $trans_id_reverse, $journal_item->code_id, $ref, 
-                               $reversingDate, 3, $journal_item->amount,
-                               0, "", get_company_currency(), 
-                               "Cannot insert a destination bank transaction");                                                                
-               }               
+                       add_bank_trans($trans_type, $trans_id_reverse, $is_bank_to, $ref,
+                               $reversingDate, -$journal_item->amount,
+                               0, "", get_company_currency(),
+                               "Cannot insert a destination bank transaction");
+               }
+                       // store tax details if the gl account is a tax account
+                       add_gl_tax_details($journal_item->code_id, 
+                               ($journal_item->amount < 0.0 ? 2 : 1), $trans_id, $journal_item->amount, 1, $date, $memo_);
        }
 
        add_comments($trans_type, $trans_id_reverse, $reversingDate, $memo_);
@@ -240,7 +437,8 @@ function add_journal_entries($items, $date_, $ref, $reverse, $memo_=null)
 
 function exists_gl_trans($type, $trans_id)
 {
-       $sql = "SELECT type_no FROM ".TB_PREF."gl_trans WHERE type=$type AND type_no=$trans_id";
+       $sql = "SELECT type_no FROM ".TB_PREF."gl_trans WHERE type=".db_escape($type)
+               ." AND type_no=".db_escape($trans_id);
        $result = db_query($sql, "Cannot retreive a gl transaction");
 
     return (db_num_rows($result) > 0);
@@ -253,7 +451,8 @@ function void_gl_trans($type, $trans_id, $nested=false)
        if (!$nested)
                begin_transaction();
 
-       $sql = "UPDATE ".TB_PREF."gl_trans SET amount=0 WHERE type=$type AND type_no=$trans_id";
+       $sql = "UPDATE ".TB_PREF."gl_trans SET amount=0 WHERE type=".db_escape($type)
+       ." AND type_no=".db_escape($trans_id);
 
        db_query($sql, "could not void gl transactions for type=$type and trans_no=$trans_id");
 
@@ -261,6 +460,17 @@ function void_gl_trans($type, $trans_id, $nested=false)
                commit_transaction();
 }
 
-//--------------------------------------------------------------------------------------------------
+//----------------------------------------------------------------------------------------
+
+function void_journal_trans($type, $type_no)
+{
+       begin_transaction();
+
+       void_gl_trans($type, $type_no, true);
+       void_bank_trans($type, $type_no,true);
+       void_trans_tax_details($type, $type_no);
+
+       commit_transaction();
+}
 
 ?>
\ No newline at end of file