Security update merged from 2.1.

[fa-stable.git] / purchasing / po_entry_items.php

diff --git a/purchasing/po_entry_items.php b/purchasing/po_entry_items.php
index 8c64fee522db9f255c409ed5558799a7db16c7b3..2f903ba12be839caa38e95236ec79283cf17f080 100644 (file)
--- a/purchasing/po_entry_items.php
+++ b/purchasing/po_entry_items.php
@@ -1,7 +1,16 @@
 <?php
-
-$page_security = 4;
-$path_to_root="..";
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_PURCHASEORDER';
+$path_to_root = "..";
 include_once($path_to_root . "/purchasing/includes/po_class.inc");
 include_once($path_to_root . "/includes/session.inc");
 include_once($path_to_root . "/purchasing/includes/purchasing_ui.inc");
@@ -29,39 +38,21 @@ check_db_has_suppliers(_("There are no suppliers defined in the system."));
 check_db_has_purchasable_items(_("There are no purchasable inventory items defined in the system."));
 
 //---------------------------------------------------------------------------------------------------------------
-if ($ret = context_restore()) {
- // return from supplier/items editors
-       copy_from_cart();
-       if(isset($ret['supplier_id']))
-               $_POST['supplier_id'] = $ret['supplier_id'];
-       if(isset($ret['stock_id'])) {
-               $_POST['stock_id'] = $_POST['_stock_id_edit'] = $ret['stock_id'];
-               set_focus('qty');
-       }
-}
-if (isset($_POST['_supplier_id_editor'])) {
-       copy_to_cart();
-       context_call($path_to_root.'/purchasing/manage/suppliers.php?supplier_id='.$_POST['supplier_id'], 'PO');
-}
-
-if (isset($_POST['_stock_id_editor'])) {
-       copy_to_cart();
-       context_call($path_to_root.'/inventory/manage/items.php?stock_id='.$_POST['stock_id'], 'PO');
-}
-//------------------------------------------------------------------------------
 
 if (isset($_GET['AddedID'])) 
 {
        $order_no = $_GET['AddedID'];
-       $trans_type = systypes::po();   
+       $trans_type = ST_PURCHORDER;    
 
        if (!isset($_GET['Updated']))
                display_notification_centered(_("Purchase Order has been entered"));
        else
                display_notification_centered(_("Purchase Order has been updated") . " #$order_no");
-       display_note(get_trans_view_str($trans_type, $order_no, _("&View this order")));
-       echo '<br>';
-       display_note(print_document_link($order_no, _("&Print This Order"), true, $trans_type));
+       display_note(get_trans_view_str($trans_type, $order_no, _("&View this order")), 0, 1);
+
+       display_note(print_document_link($order_no, _("&Print This Order"), true, $trans_type), 0, 1);
+
+       display_note(print_document_link($order_no, _("&Email This Order"), true, $trans_type, false, "", "", 1));
 
        hyperlink_params($path_to_root . "/purchasing/po_receive_items.php", _("&Receive Items on this Purchase Order"), "PONumber=$order_no");
 
@@ -145,12 +136,15 @@ function handle_cancel_po()
        if($_SESSION['PO']->order_no != 0)
        {
                delete_po($_SESSION['PO']->order_no);
-       }       
+       } else {
+               unset($_SESSION['PO']);
+               meta_forward($path_to_root.'/index.php','application=AP');
+       }
 
        $_SESSION['PO']->clear_items();
        $_SESSION['PO'] = new purch_order;
 
-       display_note(_("This purchase order has been cancelled."), 0, 1);
+       display_notification(_("This purchase order has been cancelled."));
 
        hyperlink_params($path_to_root . "/purchasing/po_entry_items.php", _("Enter a new purchase order"), "NewOrder=Yes");
        echo "<br>";
@@ -234,7 +228,7 @@ function handle_add_new_item()
                if ($allow_update == true)
                {
                        $sql = "SELECT description, units, mb_flag
-                               FROM ".TB_PREF."stock_master WHERE stock_id = '". $_POST['stock_id'] . "'";
+                               FROM ".TB_PREF."stock_master WHERE stock_id = ".db_escape($_POST['stock_id']);
 
                    $result = db_query($sql,"The stock details for " . $_POST['stock_id'] . " could not be retrieved");
 
@@ -267,6 +261,8 @@ function handle_add_new_item()
 
 function can_commit()
 {
+       global $Refs;
+
        if (!is_date($_POST['OrderDate'])) 
        {
                display_error(_("The entered order date is invalid."));
@@ -276,14 +272,14 @@ function can_commit()
        
        if (!$_SESSION['PO']->order_no) 
        {
-       if (!references::is_valid(get_post('ref'))) 
+       if (!$Refs->is_valid(get_post('ref'))) 
        {
                display_error(_("There is no reference entered for this purchase order."));
                        set_focus('ref');
                return false;
        } 
        
-       if (!is_new_reference(get_post('ref'), systypes::po())) 
+       if (!is_new_reference(get_post('ref'), ST_PURCHORDER)) 
        {
                display_error(_("The entered reference is already in use."));
                        set_focus('ref');
@@ -328,7 +324,7 @@ function handle_commit_order()
                        
                        /*its a new order to be inserted */
                        $order_no = add_po($_SESSION['PO']);
-                        
+                       new_doc_date($_SESSION['PO']->orig_order_date); 
                        unset($_SESSION['PO']);
                         
                meta_forward($_SERVER['PHP_SELF'], "AddedID=$order_no");        
@@ -375,7 +371,7 @@ if (isset($_GET['ModifyOrderNumber']) && $_GET['ModifyOrderNumber'] != "")
 
        /*read in all the selected order into the Items cart  */
        read_po($_SESSION['PO']->order_no, $_SESSION['PO']);
-
+       
        copy_from_cart();
 }
 
@@ -388,7 +384,7 @@ if (isset($_GET['NewOrder']))
 
 //---------------------------------------------------------------------------------------------------
 
-start_form(false, true);
+start_form();
 
 display_po_header($_SESSION['PO']);
 echo "<br>";
@@ -404,13 +400,13 @@ div_start('controls', 'items_table');
 if ($_SESSION['PO']->order_has_items()) 
 {
        if ($_SESSION['PO']->order_no)
-               submit_center_first('Commit', _("Update Order"), '', true);
+               submit_center_first('Commit', _("Update Order"), '', 'default');
        else
-               submit_center_first('Commit', _("Place Order"), '', true);
+               submit_center_first('Commit', _("Place Order"), '', 'default');
        submit_center_last('CancelOrder', _("Cancel Order"));   
 }
 else
-       submit_center('CancelOrder', _("Cancel Order"));        
+       submit_center('CancelOrder', _("Cancel Order"), true, false, 'cancel');
 div_end();
 //---------------------------------------------------------------------------------------------------