Security update merged from 2.1.
[fa-stable.git] / purchasing / includes / db / invoice_db.inc
index d2331c17174dbc4d37a385e0e7c374f5db050b72..21a43d89b5e848a2ce2d926ee599e7c161b1a59c 100644 (file)
@@ -1,13 +1,13 @@
 <?php
 /**********************************************************************
     Copyright (C) FrontAccounting, LLC.
-       Released under the terms of the GNU Affero General Public License,
-       AGPL, as published by the Free Software Foundation, either version 
-       of the License, or (at your option) any later version.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
-    See the License here <http://www.gnu.org/licenses/agpl-3.0.html>.
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 include_once($path_to_root . "/purchasing/includes/db/invoice_items_db.inc");
 
@@ -15,13 +15,14 @@ include_once($path_to_root . "/purchasing/includes/db/invoice_items_db.inc");
 
 function read_supplier_details_to_trans(&$supp_trans, $supplier_id)
 {
-       $sql = "SELECT ".TB_PREF."suppliers.supp_name, ".TB_PREF."payment_terms.terms, ".TB_PREF."payment_terms.days_before_due,
+       $sql = "SELECT ".TB_PREF."suppliers.supp_name, ".TB_PREF."payment_terms.terms, "
+               .TB_PREF."payment_terms.days_before_due,
                ".TB_PREF."payment_terms.day_in_following_month,
                ".TB_PREF."suppliers.tax_group_id, ".TB_PREF."tax_groups.name As tax_group_name
                From ".TB_PREF."suppliers, ".TB_PREF."payment_terms, ".TB_PREF."tax_groups
                WHERE ".TB_PREF."suppliers.tax_group_id = ".TB_PREF."tax_groups.id
                AND ".TB_PREF."suppliers.payment_terms=".TB_PREF."payment_terms.terms_indicator
-               AND ".TB_PREF."suppliers.supplier_id = '" . $supplier_id . "'";
+               AND ".TB_PREF."suppliers.supplier_id = ".db_escape($supplier_id);
 
        $result = db_query($sql, "The supplier record selected: " . $supplier_id . " cannot be retrieved");
 
@@ -61,7 +62,7 @@ function update_supp_received_items_for_invoice($id, $po_detail_item, $qty_invoi
        if ($chg_price != null)
        {
                $sql = "SELECT act_price, unit_price FROM ".TB_PREF."purch_order_details WHERE
-                       po_detail_item = $po_detail_item";
+                       po_detail_item = ".db_escape($po_detail_item);
                $result = db_query($sql, "The old actual price of the purchase order line could not be retrieved");
                $row = db_fetch_row($result);
                $ret = $row[0];
@@ -69,7 +70,8 @@ function update_supp_received_items_for_invoice($id, $po_detail_item, $qty_invoi
                $unit_price = $row[1]; //Added by Rasmus
 
                $sql = "SELECT delivery_date FROM ".TB_PREF."grn_batch,".TB_PREF."grn_items WHERE
-                       ".TB_PREF."grn_batch.id = ".TB_PREF."grn_items.grn_batch_id AND ".TB_PREF."grn_items.id=$id";
+                       ".TB_PREF."grn_batch.id = ".TB_PREF."grn_items.grn_batch_id AND "
+                       .TB_PREF."grn_items.id=".db_escape($id);
                $result = db_query($sql, "The old delivery date from the received record cout not be retrieved");
                $row = db_fetch_row($result);
                $date = $row[0];
@@ -81,17 +83,17 @@ function update_supp_received_items_for_invoice($id, $po_detail_item, $qty_invoi
                $unit_price = 0; // Added by Rasmus
        }
     $sql = "UPDATE ".TB_PREF."purch_order_details
-               SET qty_invoiced = qty_invoiced + $qty_invoiced ";
+               SET qty_invoiced = qty_invoiced + ".db_escape($qty_invoiced);
 
        if ($chg_price != null)
-               $sql .= " , act_price = $chg_price ";
+               $sql .= " , act_price = ".db_escape($chg_price);
 
-       $sql .= " WHERE po_detail_item = $po_detail_item";
+       $sql .= " WHERE po_detail_item = ".db_escape($po_detail_item);
     db_query($sql, "The quantity invoiced of the purchase order line could not be updated");
 
     $sql = "UPDATE ".TB_PREF."grn_items
-        SET quantity_inv = quantity_inv + $qty_invoiced
-        WHERE id = $id";
+        SET quantity_inv = quantity_inv + ".db_escape($qty_invoiced)."
+        WHERE id = ".db_escape($id);
        db_query($sql, "The quantity invoiced off the items received record could not be updated");
        return array($ret, $date, $unit_price);
 }
@@ -101,8 +103,9 @@ function get_deliveries_between($stock_id, $from, $to)
        $from = date2sql($from);
        $to = date2sql($to);
        $sql = "SELECT SUM(-qty), SUM(-qty*standard_cost) FROM ".TB_PREF."stock_moves
-               WHERE type=13 AND stock_id='$stock_id' AND
+               WHERE type=".ST_CUSTDELIVERY." AND stock_id=".db_escape($stock_id)." AND
                        tran_date>='$from' AND tran_date<='$to' GROUP BY stock_id";
+
        $result = db_query($sql, "The deliveries could not be updated");
        return db_fetch_row($result);
 }
@@ -118,6 +121,8 @@ function get_diff_in_home_currency($supplier, $old_date, $date, $amount1, $amoun
 
 function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref because we change locally
 {
+       global $Refs;
+
        //$company_currency = get_company_currency();
        /*Start an sql transaction */
        begin_transaction();
@@ -127,16 +132,17 @@ function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref b
 
     foreach ($taxes as $taxitem)
     {
+               $taxitem['Value'] =  round2($taxitem['Value'], user_price_dec());
        $tax_total += $taxitem['Value'];
     }
 
     $invoice_items_total = $supp_trans->get_total_charged($supp_trans->tax_group_id);
 
        if ($supp_trans->is_invoice)
-               $trans_type = 20;
+               $trans_type = ST_SUPPINVOICE;
        else
        {
-               $trans_type = 21;
+               $trans_type = ST_SUPPCREDIT;
                // let's negate everything because it's a credit note
                $invoice_items_total = -$invoice_items_total;
                $tax_total = -$tax_total;
@@ -181,12 +187,14 @@ function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref b
 
                $memo_ = $entered_gl_code->memo_;
                $total += add_gl_trans_supplier($trans_type, $invoice_id, $date_, $entered_gl_code->gl_code,
-                       $entered_gl_code->gl_dim, $entered_gl_code->gl_dim2, $entered_gl_code->amount, $supp_trans->supplier_id);
+                       $entered_gl_code->gl_dim, $entered_gl_code->gl_dim2, $entered_gl_code->amount, $supp_trans->supplier_id, "", 0, $memo_);
 
                add_supp_invoice_gl_item($trans_type, $invoice_id, $entered_gl_code->gl_code,
                        $entered_gl_code->amount, $memo_);
 
                // store tax details if the gl account is a tax account
+               if (!$supp_trans->is_invoice)
+                       $entered_gl_code->amount = -$entered_gl_code->amount;
                add_gl_tax_details($entered_gl_code->gl_code, 
                        $trans_type, $invoice_id, $entered_gl_code->amount,
                        $ex_rate, $date_, $supp_trans->supp_reference);
@@ -249,9 +257,9 @@ function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref b
                                                0, 0, _("Cost diff."), -$amt, null, null, null,
                                                "The general ledger transaction could not be added for the price variance of the inventory item");
                                }               
-                               update_stock_move_pid(13, $entered_grn->item_code, $old_date, $date_, 0, $mat_cost);
+                               update_stock_move_pid(ST_CUSTDELIVERY, $entered_grn->item_code, $old_date, $date_, 0, $mat_cost);
                        }
-                       update_stock_move_pid(25, $entered_grn->item_code, $old_date, $old_date, $supp_trans->supplier_id, $mat_cost);
+                       update_stock_move_pid(ST_SUPPRECEIVE, $entered_grn->item_code, $old_date, $old_date, $supp_trans->supplier_id, $mat_cost);
                //}
                }
        // ----------------------------------------------------------------------
@@ -261,18 +269,24 @@ function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref b
                        $entered_grn->this_quantity_inv, $entered_grn->id, $entered_grn->po_detail_item, "");
     } /* end of GRN postings */
     /* Now the TAX account */
+    $taxes = $supp_trans->get_taxes($supp_trans->tax_group_id, 0, false); // 2009.08-18 Joe Hunt. We have already got the gl lines
     foreach ($taxes as $taxitem)
     {
        if ($taxitem['Net'] != 0)
        {
 
                if (!$supp_trans->is_invoice)
+               {
+                       $taxitem['Net'] = -$taxitem['Net'];
                        $taxitem['Value'] = -$taxitem['Value'];
+               }       
                // here we suppose that tax is never included in price (we are company customer).
                        add_trans_tax_details($trans_type, $invoice_id, 
                                $taxitem['tax_type_id'], $taxitem['rate'], 0, $taxitem['Value'],
                                $taxitem['Net'], $ex_rate, $date_, $supp_trans->supp_reference);
 
+               if (!$supp_trans->is_invoice)
+                       $taxitem['Value'] = -$taxitem['Value'];
                $total += add_gl_trans_supplier($trans_type, $invoice_id, $date_,
                        $taxitem['purchasing_gl_code'], 0, 0, $taxitem['Value'],
                        $supp_trans->supplier_id,
@@ -281,33 +295,33 @@ function add_supp_invoice($supp_trans, $invoice_no=0) // do not receive as ref b
     }
        
        /*Post a balance post if $total != 0 */
-       add_gl_balance($trans_type, $invoice_id, $date_, -$total, payment_person_types::supplier(), $supp_trans->supplier_id);  
+       add_gl_balance($trans_type, $invoice_id, $date_, -$total, PT_SUPPLIER, $supp_trans->supplier_id);       
 
        add_comments($trans_type, $invoice_id, $date_, $supp_trans->Comments);
 
-       references::save_last($supp_trans->reference, $trans_type);
+       $Refs->save($trans_type, $invoice_id, $supp_trans->reference);
 
        if ($invoice_no != 0)
        {
-               $invoice_alloc_balance = get_supp_trans_allocation_balance(20, $invoice_no);
+               $invoice_alloc_balance = get_supp_trans_allocation_balance(ST_SUPPINVOICE, $invoice_no);
                if ($invoice_alloc_balance > 0) 
                {       //the invoice is not already fully allocated 
 
-                       $trans = get_supp_trans($invoice_no, 20);
+                       $trans = get_supp_trans($invoice_no, ST_SUPPINVOICE);
                        $total = $trans['Total'];
 
                        $allocate_amount = ($invoice_alloc_balance > $total) ? $total : $invoice_alloc_balance;
                        /*Now insert the allocation record if > 0 */
                        if ($allocate_amount != 0) 
                        {
-                               update_supp_trans_allocation(20, $invoice_no, $allocate_amount);
-                               update_supp_trans_allocation(21, $invoice_id, $allocate_amount); // ***
-                               add_supp_allocation($allocate_amount, 21, $invoice_id, 20, $invoice_no,
+                               update_supp_trans_allocation(ST_SUPPINVOICE, $invoice_no, $allocate_amount);
+                               update_supp_trans_allocation(ST_SUPPCREDIT, $invoice_id, $allocate_amount); // ***
+                               add_supp_allocation($allocate_amount, ST_SUPPCREDIT, $invoice_id, ST_SUPPINVOICE, $invoice_no,
                                        $date_);
                                // Exchange Variations Joe Hunt 2008-09-20 ////////////////////////////////////////
 
-                               exchange_variation(21, $invoice_id, 20, $invoice_no, $date_,
-                                       $allocate_amount, payment_person_types::supplier());
+                               exchange_variation(ST_SUPPCREDIT, $invoice_id, ST_SUPPINVOICE, $invoice_no, $date_,
+                                       $allocate_amount, PT_SUPPLIER);
 
                                ///////////////////////////////////////////////////////////////////////////
                        }
@@ -329,10 +343,12 @@ function get_po_invoices_credits($po_number)
        $sql = "SELECT DISTINCT ".TB_PREF."supp_trans.trans_no, ".TB_PREF."supp_trans.type,
                ov_amount+ov_discount+ov_gst AS Total,
                ".TB_PREF."supp_trans.tran_date
-               FROM ".TB_PREF."supp_trans, ".TB_PREF."supp_invoice_items, ".TB_PREF."purch_order_details
+               FROM ".TB_PREF."supp_trans, ".TB_PREF."supp_invoice_items, "
+               .TB_PREF."purch_order_details, ".TB_PREF."purch_orders
                WHERE ".TB_PREF."supp_invoice_items.supp_trans_no = ".TB_PREF."supp_trans.trans_no
                AND ".TB_PREF."supp_invoice_items.po_detail_item_id = ".TB_PREF."purch_order_details.po_detail_item
-               AND ".TB_PREF."purch_order_details.order_no = $po_number";
+               AND ".TB_PREF."purch_orders.supplier_id = ".TB_PREF."supp_trans.supplier_id
+               AND ".TB_PREF."purch_order_details.order_no = ".db_escape($po_number);
 
        return db_query($sql, "The invoices/credits for the po $po_number could not be retreived");
 }
@@ -342,7 +358,7 @@ function get_po_invoices_credits($po_number)
 function read_supp_invoice($trans_no, $trans_type, &$supp_trans)
 {
        $sql = "SELECT ".TB_PREF."supp_trans.*, supp_name FROM ".TB_PREF."supp_trans,".TB_PREF."suppliers
-               WHERE trans_no = $trans_no AND type = $trans_type
+               WHERE trans_no = ".db_escape($trans_no)." AND type = ".db_escape($trans_type)."
                AND ".TB_PREF."suppliers.supplier_id=".TB_PREF."supp_trans.supplier_id";
        $result = db_query($sql, "Cannot retreive a supplier transaction");
 
@@ -399,10 +415,22 @@ function read_supp_invoice($trans_no, $trans_type, &$supp_trans)
 
 //----------------------------------------------------------------------------------------
 
+function get_matching_invoice_item($stock_id, $po_item_id)
+{
+       $sql = "SELECT *, tran_date FROM ".TB_PREF."supp_invoice_items, ".TB_PREF."supp_trans
+               WHERE supp_trans_type = ".ST_SUPPINVOICE." AND stock_id = "
+               .db_escape($stock_id)." AND po_detail_item_id = ".db_escape($po_item_id)."
+               AND supp_trans_no = trans_no";
+       $result = db_query($sql, "Cannot retreive supplier transaction detail records");
+       return db_fetch($result);  
+}
+
 function void_supp_invoice($type, $type_no)
 {
        begin_transaction();
 
+       $trans = get_supp_trans($type_no, $type);
+
        void_bank_trans($type, $type_no, true);
 
        void_gl_trans($type, $type_no, true);
@@ -430,37 +458,46 @@ function void_supp_invoice($type, $type_no)
                                
                                $batch = get_grn_batch_from_item($details_row["grn_item_id"]);  
                                $grn = get_grn_batch($batch);
-                               
-                               $diff = get_diff_in_home_currency($grn["supplier_id"], $old_date, $date_, $old[2], 
-                                       $details_row["FullUnitPrice"]);
-                               // Only adjust the avg for the diff
-                               $mat_cost = update_average_material_cost(null, $details_row["stock_id"],
-                                       $diff, -$details_row["quantity"], $date_, true);
-
+                       if ($type == ST_SUPPCREDIT) // credit note 2009-06-14 Joe Hunt Must restore the po and grn
+                       {       // We must get the corresponding invoice item to check for price chg.
+                                       $match = get_matching_invoice_item($details_row["stock_id"], $details_row["po_detail_item_id"]);
+                                       if ($match !== false)
+                                               $mat_cost = update_average_material_cost($grn["supplier_id"], $details_row["stock_id"],  
+                                                       $match["unit_price"], -$details_row["quantity"], sql2date($match['tran_date']), $match['tran_date'] !== $trans['tran_date']);
+                                       else            
+                                               $mat_cost = update_average_material_cost($grn["supplier_id"], $details_row["stock_id"],  
+                                                       $details_row["FullUnitPrice"], -$details_row["quantity"], $old_date, $old[1] !== $trans['tran_date']);
+                                       $sql = "UPDATE ".TB_PREF."purch_order_details
+                                       SET quantity_ordered = quantity_ordered + ".-$details_row["quantity"].", ";
+                               if ($match !== false)
+                                       $sql .= "act_price=".$match['unit_price'].", ";
+                               $sql .= "quantity_received = quantity_received + ".-$details_row["quantity"]."
+                                   WHERE po_detail_item = ".$details_row["po_detail_item_id"];
+                                       db_query($sql, "a purchase order details record could not be updated. This receipt of goods has not been processed ");
+                                       $sql = "UPDATE ".TB_PREF."grn_items SET qty_recd=qty_recd+".-$details_row["quantity"]."
+                                               WHERE id=".$details_row["grn_item_id"];
+                                       db_query($sql);
+                       }
+                       else
+                       {
+                                       $diff = get_diff_in_home_currency($grn["supplier_id"], $old_date, sql2date($trans['tran_date']), $old[2], 
+                                               $details_row["FullUnitPrice"]);
+                                       // Only adjust the avg for the diff
+                                       $mat_cost = update_average_material_cost(null, $details_row["stock_id"],
+                                               $diff, -$details_row["quantity"], $old_date, true);
+                               }
                                $deliveries = get_deliveries_between($details_row["stock_id"], $old_date, $date_);
                                if ($deliveries[0] != 0) // have deliveries been done during the period?
                                {
-                                       $deliveries[1] /= $deliveries[0];
-                                       $amt = ($mat_cost - $deliveries[1]) * $deliveries[0]; // $amt in home currency
-                                       if ($amt != 0.0)
-                                       {
-                                               $stock_gl_code = get_stock_gl_code($details_row["stock_id"]);
-                                               add_gl_trans($type, $type_no, $date_,   $stock_gl_code["cogs_account"],
-                                                       $stock_gl_code['dimension_id'], $stock_gl_code['dimension2_id'], _("Cost diff."),
-                                                       -$amt, null, null, null,
-                                                       "The general ledger transaction could not be added for the price variance of the inventory item");
-                                               add_gl_trans($type, $type_no, $date_, $stock_gl_code["inventory_account"],
-                                                       0, 0, _("Cost diff."), $amt, null, null, null,
-                                                       "The general ledger transaction could not be added for the price variance of the inventory item");
-                                       }               
-                                       update_stock_move_pid(13, $details_row["stock_id"], $old_date, $date_, 0, $mat_cost);
+                                       update_stock_move_pid(ST_CUSTDELIVERY, $details_row["stock_id"], $old_date, $date_, 0, $mat_cost);
                                }
-                               update_stock_move_pid(25, $details_row["stock_id"], $old_date, $old_date, $grn['supplier_id'], $mat_cost);
-
+                               update_stock_move_pid(ST_SUPPRECEIVE, $details_row["stock_id"], $old_date, $old_date, $grn['supplier_id'], $mat_cost);
                }
         }
        }
 
+       if ($type == ST_SUPPCREDIT) // void the credits in stock moves
+               void_stock_move($type, $type_no); 
        void_supp_invoice_items($type, $type_no);
        void_trans_tax_details($type, $type_no);