Security update merged from 2.1.
[fa-stable.git] / inventory / manage / items.php
index e4db890c757934b51754bca59e21bcb6bbc9ef7e..9356e0b11fcc729fb06bed9e1a864f58861b95f7 100644 (file)
@@ -9,11 +9,11 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security = 11;
-$path_to_root="../..";
+$page_security = 'SA_ITEM';
+$path_to_root = "../..";
 include($path_to_root . "/includes/session.inc");
 
-page(_("Items"));
+page(_("Items"), @$_REQUEST['popup']);
 
 include_once($path_to_root . "/includes/date_functions.inc");
 include_once($path_to_root . "/includes/ui.inc");
@@ -22,7 +22,7 @@ include_once($path_to_root . "/includes/data_checks.inc");
 include_once($path_to_root . "/inventory/includes/inventory_db.inc");
 
 $user_comp = user_company();
-$new_item = get_post('stock_id')=='' || get_post('cancel'); 
+$new_item = get_post('stock_id')=='' || get_post('cancel') || get_post('clone')
 //------------------------------------------------------------------------------------
 
 if (isset($_GET['stock_id']))
@@ -97,7 +97,6 @@ if (isset($_FILES['pic']) && $_FILES['pic']['name'] != '')
  /* EOF Add Image upload for New Item  - by Ori */
 }
 
-
 check_db_has_stock_categories(_("There are no item categories defined in the system. At least one item category is required to add a item."));
 
 check_db_has_item_tax_types(_("There are no item tax types defined in the system. At least one item tax type is required to add a item."));
@@ -113,6 +112,7 @@ function clear_data()
        unset($_POST['NewStockID']);
        unset($_POST['dimension_id']);
        unset($_POST['dimension2_id']);
+       unset($_POST['no_sale']);
 }
 
 //------------------------------------------------------------------------------------
@@ -192,28 +192,36 @@ if (isset($_POST['addupdate']))
                        display_notification(_("A new item has been added."));
                        $_POST['stock_id'] = $_POST['NewStockID'] = 
                        $_POST['description'] = $_POST['long_description'] = '';
+                       $_POST['no_sale'] = 0;
                        set_focus('NewStockID');
                }
                $Ajax->activate('_page_body');
        }
 }
 
+if (get_post('clone')) {
+       unset($_POST['stock_id']);
+       unset($_POST['inactive']);
+       set_focus('NewStockID');
+       $Ajax->activate('_page_body');
+}
+
 //------------------------------------------------------------------------------------
 
 function check_usage($stock_id, $dispmsg=true)
 {
        $sqls=  array(
        "SELECT COUNT(*) FROM "
-               .TB_PREF."stock_moves WHERE stock_id='$stock_id'" =>
+               .TB_PREF."stock_moves WHERE stock_id=".db_escape($stock_id) =>
         _('Cannot delete this item because there are stock movements that refer to this item.'),
        "SELECT COUNT(*) FROM "
-               .TB_PREF."bom WHERE component='$stock_id'"=>
+               .TB_PREF."bom WHERE component=".db_escape($stock_id)=>
         _('Cannot delete this item record because there are bills of material that require this part as a component.'),
        "SELECT COUNT(*) FROM "
-               .TB_PREF."sales_order_details WHERE stk_code='$stock_id'" =>
+               .TB_PREF."sales_order_details WHERE stk_code=".db_escape($stock_id) =>
         _('Cannot delete this item because there are existing purchase order items for it.'),
        "SELECT COUNT(*) FROM "
-               .TB_PREF."purch_order_details WHERE item_code='$stock_id'"=>
+               .TB_PREF."purch_order_details WHERE item_code=".db_escape($stock_id)=>
         _('Cannot delete this item because there are existing purchase order items for it.')
        );
 
@@ -275,14 +283,6 @@ if (isset($_POST['delete']) && strlen($_POST['delete']) > 1)
 }
 //-------------------------------------------------------------------------------------------- 
 
-if (isset($_POST['select']))
-{
-       context_return(array('stock_id' => $_POST['stock_id']));
-}
-
-
-//------------------------------------------------------------------------------------
-
 start_form(true);
 
 if (db_has_stock_items()) 
@@ -291,7 +291,7 @@ if (db_has_stock_items())
        start_row();
     stock_items_list_cells(_("Select an item:"), 'stock_id', null,
          _('New item'), true, check_value('show_inactive'));
-       $new_item = get_post('stock_id')==''; 
+       $new_item = get_post('stock_id')=='';
        check_cells(_("Show inactive:"), 'show_inactive', null, true);
        end_row();
        end_table();
@@ -310,10 +310,10 @@ table_section(1);
 table_section_title(_("Item"));
 
 //------------------------------------------------------------------------------------
-
 if ($new_item) 
 {
        text_row(_("Item Code:"), 'NewStockID', null, 21, 20);
+
        $_POST['inactive'] = 0;
 } 
 else 
@@ -395,15 +395,15 @@ table_section_title(_("GL Accounts"));
 
 gl_all_accounts_list_row(_("Sales Account:"), 'sales_account', $_POST['sales_account']);
 
-gl_all_accounts_list_row(_("Inventory Account:"), 'inventory_account', $_POST['inventory_account']);
-
 if (!is_service($_POST['mb_flag'])) 
 {
+       gl_all_accounts_list_row(_("Inventory Account:"), 'inventory_account', $_POST['inventory_account']);
        gl_all_accounts_list_row(_("C.O.G.S. Account:"), 'cogs_account', $_POST['cogs_account']);
        gl_all_accounts_list_row(_("Inventory Adjustments Account:"), 'adjustment_account', $_POST['adjustment_account']);
 }
 else 
 {
+       gl_all_accounts_list_row(_("C.O.G.S. Account:"), 'inventory_account', $_POST['inventory_account']);
        hidden('cogs_account', $_POST['cogs_account']);
        hidden('adjustment_account', $_POST['adjustment_account']);
 }
@@ -437,9 +437,9 @@ else
 
 label_row("&nbsp;", $stock_img_link);
 if ($check_remove_image)
-       check_row(_("Delete Image:"), 'del_image', $_POST['del_image']);
+       check_row(_("Delete Image:"), 'del_image');
        
-check_row(_("Exclude from sales:"), 'no_sale', $_POST['no_sale']);
+check_row(_("Exclude from sales:"), 'no_sale');
 
 record_status_list_row(_("Item status:"), 'inactive');
 end_outer_table(1);
@@ -452,13 +452,16 @@ if (!isset($_POST['NewStockID']) || $new_item)
 else 
 {
        submit_center_first('addupdate', _("Update Item"), '', 
-       count($_SESSION['Context']) ? true : 'default');
-       submit_return('select', _("Return"), _("Select this items and return to document entry."), 'default');
+               @$_REQUEST['popup'] ? true : 'default');
+       submit_return('select', get_post('stock_id'), 
+               _("Select this items and return to document entry."), 'default');
+       submit('clone', _("Clone This Item"), true, '', true);
        submit('delete', _("Delete This Item"), true, '', true);
        submit_center_last('cancel', _("Cancel"), _("Cancel Edition"), 'cancel');
 }
 
 div_end();
+hidden('popup', @$_REQUEST['popup']);
 end_form();
 
 //------------------------------------------------------------------------------------