Security cleanup on 'where' parameter in a couple of list helpers
[fa-stable.git] / includes / ui / allocation_cart.inc
index e1f45ce1bdd20c6258e5b358694060dbe75c67f1..f67c5f15ba66c7aaca7025c9dfb69a53ea310edf 100644 (file)
@@ -22,6 +22,7 @@ class allocation
        var $type;
        var $person_id = '';
        var $person_name = '';
+       var $person_type;       // true - supplier, otherwise customer
        var $date_;
        var $amount = 0; /*Total amount of the transaction in FX */
        
@@ -37,12 +38,12 @@ class allocation
        }
 
        function add_item($type, $type_no, $date_, $due_date, $amount, $amount_allocated, 
-               $current_allocated)
+               $current_allocated, $ref)
        {
                if ($amount > 0)
                {
                        $this->allocs[count($this->allocs)] = new allocation_item($type, $type_no, 
-                               $date_, $due_date, $amount, $amount_allocated, $current_allocated);
+                               $date_, $due_date, $amount, $amount_allocated, $current_allocated, $ref);
                        return true;
                } 
                else 
@@ -52,12 +53,12 @@ class allocation
        }
        
        function update_item($index, $type, $type_no, $date_, $due_date, 
-               $amount, $amount_allocated, $current_allocated)
+               $amount, $amount_allocated, $current_allocated, $ref)
        {
                if ($amount > 0)
                {
                        $this->allocs[$index] = new allocation_item($type, $type_no, 
-                               $date_, $due_date, $amount, $amount_allocated, $current_allocated);
+                               $date_, $due_date, $amount, $amount_allocated, $current_allocated, $ref);
                        return true;
                } 
                else 
@@ -67,7 +68,7 @@ class allocation
        }       
        
        function add_or_update_item($type, $type_no, $date_, $due_date, 
-               $amount, $amount_allocated, $current_allocated)
+               $amount, $amount_allocated, $current_allocated, $ref)
        {
                for ($i = 0; $i < count($this->allocs); $i++) 
                {
@@ -75,79 +76,85 @@ class allocation
                        if (($item->type == $type) && ($item->type_no == $type_no)) 
                        {
                                return $this->update_item($i, $type, $type_no, $date_, $due_date, 
-                                       $amount, $amount_allocated, $current_allocated);
+                                       $amount, $amount_allocated, $current_allocated, $ref);
                        }  
                }
         return $this->add_item($type, $type_no, $date_, $due_date, 
-               $amount, $amount_allocated, $current_allocated);
-       }                                               
+               $amount, $amount_allocated, $current_allocated, $ref);
+       }
 
        //
        //      Read payment or credit current/available allocations to cart.
        //
+       // FIXME - read all transactions below twice seems to be suboptimal
+       //
        function read($type = null, $trans_no = 0) 
        {
                if ($type == null) {    // re-read
                        $type = $this->type;
                        $trans_no = $this->trans_no;
                }
-               
-               $sup = $type == 21 || $type == 22;
+               if ($type == ST_BANKPAYMENT || $type == ST_BANKDEPOSIT) {
+                       $bank_trans = db_fetch(get_bank_trans($type, $trans_no));
+                       $this->person_type = $bank_trans['person_type_id'] == PT_SUPPLIER;
+               } else
+                       $this->person_type = $type == ST_SUPPCREDIT || $type == ST_SUPPAYMENT;
                $this->allocs = array();
 
                if ($trans_no) {
-                       $trans = $sup ? get_supp_trans($trans_no, $type) 
+                       $trans = $this->person_type ? get_supp_trans($trans_no, $type) 
                                : get_customer_trans($trans_no, $type);
 
-                       $this->person_id = $trans[$sup ? 'supplier_id':'debtor_no'];
-                       $this->person_name = $trans[$sup ? "supplier_name":"DebtorName"];
+                       $this->person_id = $trans[$this->person_type ? 'supplier_id':'debtor_no'];
+                       $this->person_name = $trans[$this->person_type ? "supplier_name":"DebtorName"];
                        $this->amount = $trans["Total"];
                        $this->date_ = sql2date($trans["tran_date"]);
                } 
                else {
-                       $this->person_id = get_post($sup ? 'supplier_id':'customer_id');
-                       $this->date_ = get_post($sup ? 'DatePaid':'DateBanked', Today());
+                       $this->person_id = get_post($this->person_type ? 'supplier_id':'customer_id');
+                       $this->date_ = get_post($this->person_type ? 'DatePaid':'DateBanked', Today());
                }
-
+               
        /* Now populate the array of possible (and previous actual) allocations 
                for this customer/supplier. First get the transactions that have 
                outstanding balances ie Total-alloc >0 */
 
-               if ($sup)
+               if ($this->person_type)
                        $trans_items = get_allocatable_to_supp_transactions($this->person_id);
                else
                        $trans_items = get_allocatable_to_cust_transactions($this->person_id);
 
                while ($myrow = db_fetch($trans_items))
                {
+//_vd($myrow);
                        $this->add_item($myrow["type"], $myrow["trans_no"],
                                sql2date($myrow["tran_date"]),
                                sql2date($myrow["due_date"]),
                                $myrow["Total"], // trans total
                                $myrow["alloc"], // trans total allocated
-                               0); // this allocation
+                               0,
+                               $myrow["reference"]); // this allocation
                }
-
                if ($trans_no == 0) return; // this is new payment
 
        /* Now get trans that might have previously been allocated to by this trans
        NB existing entries where still some of the trans outstanding entered from
        above logic will be overwritten with the prev alloc detail below */
 
-               if ($sup)
+               if ($this->person_type)
                        $trans_items = get_allocatable_to_supp_transactions($this->person_id, 
                                $trans_no, $type);
                else
                        $trans_items = get_allocatable_to_cust_transactions($this->person_id, 
                                $trans_no, $type);
-       
                while ($myrow = db_fetch($trans_items))
                {
+//_vd($myrow);
                        $this->add_or_update_item ($myrow["type"], $myrow["trans_no"],
                                sql2date($myrow["tran_date"]),
                                sql2date($myrow["due_date"]),
                                $myrow["Total"],
-                               $myrow["alloc"] - $myrow["amt"], $myrow["amt"]);
+                               $myrow["alloc"] - $myrow["amt"], $myrow["amt"], $myrow["reference"]);
                }
        }
        //
@@ -155,14 +162,12 @@ class allocation
        //
        function write()
        {
-               $sup = $this->type == 21 || $this->type == 22;
-
                begin_transaction();
 
-               if ($sup)
-                       clear_supp_alloctions($this->type, $this->trans_no, $this->date_);
+               if ($this->person_type)
+                       clear_supp_alloctions($this->type, $this->trans_no);
                else
-                       clear_cust_alloctions($this->type, $this->trans_no, $this->date_);
+                       clear_cust_alloctions($this->type, $this->trans_no);
 
                // now add the new allocations
                $total_allocated = 0;
@@ -170,7 +175,7 @@ class allocation
                {
                        if ($alloc_item->current_allocated > 0)
                        {
-                               if ($sup) {
+                               if ($this->person_type) {
                                        add_supp_allocation($alloc_item->current_allocated,
                                                $this->type, $this->trans_no,
                                        $alloc_item->type, $alloc_item->type_no, $this->date_);
@@ -181,31 +186,29 @@ class allocation
                                        add_cust_allocation($alloc_item->current_allocated,
                                                $this->type, $this->trans_no,
                                        $alloc_item->type, $alloc_item->type_no, $this->date_);
-                       
+
                                        update_debtor_trans_allocation($alloc_item->type, 
                                                $alloc_item->type_no, $alloc_item->current_allocated);
                                }
                                // Exchange Variations Joe Hunt 2008-09-20 ////////////////////
-
-                               exchange_variation($this->type, $this->trans_no,
+                               if (!in_array($alloc_item->type, array(ST_SALESQUOTE, ST_SALESORDER, ST_PURCHORDER)))
+                                exchange_variation($this->type, $this->trans_no,
                                        $alloc_item->type, $alloc_item->type_no, $this->date_,
                                        $alloc_item->current_allocated,
-                                       $sup ? PT_SUPPLIER 
-                                               : PT_CUSTOMER);
-                               
+                                       $this->person_type ? PT_SUPPLIER : PT_CUSTOMER);
 
                                //////////////////////////////////////////////////////////////
                                $total_allocated += $alloc_item->current_allocated;
                        }
 
-               }  /*end of the loop through the array of allocations made */
-               if ($sup)
+               }  //end of the loop through the array of allocations made
+               if ($this->person_type)
                        update_supp_trans_allocation($this->type, $this->trans_no, 
                                $total_allocated);
                else
                        update_debtor_trans_allocation($this->type,     $this->trans_no, 
                                $total_allocated);
-       
+
                commit_transaction();
 
        }
@@ -225,16 +228,19 @@ class allocation_item
        
        var $amount_allocated;
        var $amount;
+       var $ref;
        
        var $current_allocated;
        
        function allocation_item ($type, $type_no, $date_, $due_date, $amount, 
-               $amount_allocated, $current_allocated)
+               $amount_allocated, $current_allocated, $ref)
        {
 
                $this->type = $type;
                $this->type_no = $type_no;
-               
+
+               $this->ref = $ref;
+
                $this->date_ = $date_;
                $this->due_date = $due_date;
                
@@ -248,40 +254,43 @@ class allocation_item
 
 function show_allocatable($show_totals) {
 
-       global $table_style, $systypes_array;
+       global $systypes_array;
        
     $k = $counter = $total_allocated = 0;
 
        if (count($_SESSION['alloc']->allocs)) 
        {
-               start_table("$table_style width=60%");
-               $th = array(_("Transaction Type"), _("#"), _("Date"), _("Due Date"), _("Amount"),
+               start_table(TABLESTYLE, "width=60%");
+               $th = array(_("Transaction Type"), _("#"), _("Ref"), _("Date"), _("Due Date"), _("Amount"),
                        _("Other Allocations"), _("This Allocation"), _("Left to Allocate"),'','');
                table_header($th);
 
                foreach ($_SESSION['alloc']->allocs as $alloc_item)
-           {
-                       alt_table_row_color($k);
-               label_cell($systypes_array[$alloc_item->type]);
-                       label_cell(get_trans_view_str($alloc_item->type, $alloc_item->type_no));
-               label_cell($alloc_item->date_, "align=right");
-               label_cell($alloc_item->due_date, "align=right");
-               amount_cell($alloc_item->amount);
-                       amount_cell($alloc_item->amount_allocated);
-
-               $_POST['amount' . $counter] = price_format($alloc_item->current_allocated);
-               amount_cells(null, "amount" . $counter, price_format('amount' . $counter));
-
-               $un_allocated = round($alloc_item->amount - $alloc_item->amount_allocated, 6);
-               amount_cell($un_allocated);
-                       label_cell("<a href='#' name=Alloc$counter onclick='allocate_all(this.name.substr(5));return true;'>"
-                                . _("All") . "</a>");
-                       label_cell("<a href='#' name=DeAll$counter onclick='allocate_none(this.name.substr(5));return true;'>"
-                                . _("None") . "</a>".hidden("un_allocated" . $counter, 
-                                price_format($un_allocated), false));
-                       end_row();
-
-               $total_allocated += input_num('amount' . $counter);
+               {
+                   if ($alloc_item->amount > $alloc_item->amount_allocated) {
+                               alt_table_row_color($k);
+                       label_cell($systypes_array[$alloc_item->type]);
+                               label_cell(get_trans_view_str($alloc_item->type, $alloc_item->type_no));
+                               label_cell($alloc_item->ref);
+                       label_cell($alloc_item->date_, "align=right");
+                       label_cell($alloc_item->due_date, "align=right");
+                       amount_cell($alloc_item->amount);
+                               amount_cell($alloc_item->amount_allocated);
+
+                       $_POST['amount' . $counter] = price_format($alloc_item->current_allocated);
+                       amount_cells(null, "amount" . $counter, price_format('amount' . $counter));
+
+                       $un_allocated = round($alloc_item->amount - $alloc_item->amount_allocated, 6);
+                       amount_cell($un_allocated, false,'', 'maxval'.$counter);
+                               label_cell("<a href='#' name=Alloc$counter onclick='allocate_all(this.name.substr(5));return true;'>"
+                                        . _("All") . "</a>");
+                               label_cell("<a href='#' name=DeAll$counter onclick='allocate_none(this.name.substr(5));return true;'>"
+                                        . _("None") . "</a>".hidden("un_allocated" . $counter, 
+                                        price_format($un_allocated), false));
+                               end_row();
+
+                       $total_allocated += input_num('amount' . $counter);
+                       }
                    $counter++;
                }
                if ($show_totals) {
@@ -289,7 +298,9 @@ function show_allocatable($show_totals) {
                        "colspan=6 align=right", "align=right id='total_allocated'", 3);
                        $amount = $_SESSION['alloc']->amount;
 
-                       if ($_SESSION['alloc']->type == 21 || $_SESSION['alloc']->type == 22) 
+                       if ($_SESSION['alloc']->type == ST_SUPPCREDIT
+                               || $_SESSION['alloc']->type == ST_SUPPAYMENT
+                               ||  $_SESSION['alloc']->type == ST_BANKPAYMENT)
                                $amount = -$amount;
                        
                        if ($amount - $total_allocated < 0)
@@ -317,7 +328,7 @@ function check_allocations()
        $total_allocated = 0;
 
        for ($counter = 0; $counter < $_POST["TotalNumberOfAllocs"]; $counter++)
-       {
+       if (isset($_POST['amount' . $counter])) {
                if (!check_num('amount' . $counter, 0))
                {
                        display_error(_("The entry for one or more amounts is invalid or negative."));
@@ -327,9 +338,11 @@ function check_allocations()
 
                  /*Now check to see that the AllocAmt is no greater than the
                 amount left to be allocated against the transaction under review */
-                if (input_num('amount' . $counter) > get_post('un_allocated' . $counter))
+                if (input_num('amount' . $counter) > input_num('un_allocated' . $counter))
                 {
-                    //$_POST['amount' . $counter] = $_POST['un_allocated' . $counter];
+                       display_error(_("At least one transaction is overallocated."));
+                       set_focus('amount'.$counter);
+                       return false;
                 }
 
                 $_SESSION['alloc']->allocs[$counter]->current_allocated = input_num('amount' . $counter);
@@ -338,7 +351,9 @@ function check_allocations()
        }
 
        $amount = $_SESSION['alloc']->amount;
-       if ($_SESSION['alloc']->type == 21 || $_SESSION['alloc']->type == 22) 
+       
+
+       if (in_array($_SESSION['alloc']->type, array(ST_BANKPAYMENT, ST_SUPPCREDIT, ST_SUPPAYMENT)))
                $amount = -$amount;
 
        if ($total_allocated - ($amount + input_num('discount'))  > $SysPrefs->allocation_settled_allowance())