Security update merged from 2.1.

[fa-stable.git] / manufacturing / search_work_orders.php

diff --git a/manufacturing/search_work_orders.php b/manufacturing/search_work_orders.php
index 94100133d0521844a53f6102310ebdc7872ea2cb..cf93441cfaa7332ef74cc7f5e020667a52e9e1a7 100644 (file)
--- a/manufacturing/search_work_orders.php
+++ b/manufacturing/search_work_orders.php
@@ -1,16 +1,16 @@
 <?php
 /**********************************************************************
     Copyright (C) FrontAccounting, LLC.
-       Released under the terms of the GNU Affero General Public License,
-       AGPL, as published by the Free Software Foundation, either version 
-       3 of the License, or (at your option) any later version.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
-    See the License here <http://www.gnu.org/licenses/agpl-3.0.html>.
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security = 2;
-$path_to_root="..";
+$page_security = 'SA_MANUFTRANSVIEW';
+$path_to_root = "..";
 include($path_to_root . "/includes/db_pager.inc");
 include_once($path_to_root . "/includes/session.inc");
 
@@ -60,7 +60,7 @@ if (isset($_GET["stock_id"]))
 
 //--------------------------------------------------------------------------------------
 
-start_form(false, false, $_SERVER['PHP_SELF'] ."?outstanding_only=" . $outstanding_only .SID);
+start_form(false, false, $_SERVER['PHP_SELF'] ."?outstanding_only=$outstanding_only");
 
 start_table("class='tablestyle_noborder'");
 start_row();
@@ -75,7 +75,7 @@ if ($outstanding_only==0)
 
 stock_manufactured_items_list_cells(_("for item:"), 'SelectedStockItem', null, true);
 
-submit_cells('SearchOrders', _("Search"),'',_('Select documents'), true);
+submit_cells('SearchOrders', _("Search"),'',_('Select documents'),  'default');
 end_row();
 end_table();
 
@@ -85,12 +85,12 @@ end_form();
 function check_overdue($row)
 {
        return (!$row["closed"] 
-               && date_diff(Today(), sql2date($row["required_by"]), "d") > 0);
+               && date_diff2(Today(), sql2date($row["required_by"]), "d") > 0);
 }
 
 function view_link($dummy, $order_no)
 {
-       return get_trans_view_str(systypes::work_order(), $order_no);
+       return get_trans_view_str(ST_WORKORDER, $order_no);
 }
 
 function view_stock($row)
@@ -100,7 +100,9 @@ function view_stock($row)
 
 function wo_type_name($dummy, $type)
 {
-       return wo_types::name($type);
+       global $wo_types_array;
+       
+       return $wo_types_array[$type];
 }
 
 function edit_link($row)
@@ -130,10 +132,22 @@ function produce_link($row)
 
 function costs_link($row)
 {
+/*
        return $row["closed"] || !$row["released"] ? '' :
                pager_link(_('Costs'),
                        "/gl/gl_bank.php?NewPayment=1&PayType=" 
-                       .payment_person_types::WorkOrder(). "&PayPerson=" .$row["id"]);
+                       .PT_WORKORDER. "&PayPerson=" .$row["id"]);
+*/                     
+       return $row["closed"] || !$row["released"] ? '' :
+               pager_link(_('Costs'),
+                       "/manufacturing/work_order_costs.php?trans_no=" .$row["id"]);
+}
+
+function view_gl_link($row)
+{
+       if ($row['closed'] == 0)
+               return '';
+       return get_gl_view_str(ST_WORKORDER, $row['id']);
 }
 
 function dec_amount($row, $amount)
@@ -171,17 +185,17 @@ if (check_value('OpenOnly') || $outstanding_only != 0)
 
 if (isset($_POST['StockLocation']) && $_POST['StockLocation'] != $all_items)
 {
-       $sql .= " AND workorder.loc_code='" . $_POST['StockLocation'] . "' ";
+       $sql .= " AND workorder.loc_code=".db_escape($_POST['StockLocation']);
 }
 
 if (isset($_POST['OrderNumber']) && $_POST['OrderNumber'] != "")
 {
-       $sql .= " AND workorder.wo_ref LIKE '%". $_POST['OrderNumber'] . "%'";
+       $sql .= " AND workorder.wo_ref LIKE ".db_escape('%'.$_POST['OrderNumber'].'%');
 }
 
 if (isset($_POST['SelectedStockItem']) && $_POST['SelectedStockItem'] != $all_items)
 {
-       $sql .= " AND workorder.stock_id='". $_POST['SelectedStockItem'] . "'";
+       $sql .= " AND workorder.stock_id=".db_escape($_POST['SelectedStockItem']);
 }
 
 if (check_value('OverdueOnly'))
@@ -204,16 +218,14 @@ $cols = array(
        array('insert'=>true, 'fun'=> 'edit_link'),
        array('insert'=>true, 'fun'=> 'release_link'),
        array('insert'=>true, 'fun'=> 'produce_link'),
-       array('insert'=>true, 'fun'=> 'costs_link')
+       array('insert'=>true, 'fun'=> 'costs_link'),
+       array('insert'=>true, 'fun'=> 'view_gl_link')
 );
 
 $table =& new_db_pager('orders_tbl', $sql, $cols);
 $table->set_marker('check_overdue', _("Marked orders are overdue."));
 
-if (get_post('SearchOrders')) {
-       $table->set_sql($sql);
-       $table->set_columns($cols);
-}
+$table->width = "90%";
 start_form();
 
 display_db_pager($table);