Security update merged from 2.1.

[fa-stable.git] / purchasing / supplier_invoice.php

diff --git a/purchasing/supplier_invoice.php b/purchasing/supplier_invoice.php
index 5302ee670e774011182c69145e0670d2f8304802..afa2df18da28a0a573c37f9205c2c238e10f9381 100644 (file)
--- a/purchasing/supplier_invoice.php
+++ b/purchasing/supplier_invoice.php
@@ -36,7 +36,7 @@ check_db_has_suppliers(_("There are no suppliers defined in the system."));
 if (isset($_GET['AddedID'])) 
 {
        $invoice_no = $_GET['AddedID'];
-       $trans_type = 20;
+       $trans_type = ST_SUPPINVOICE;
 
 
     echo "<center>";
@@ -99,7 +99,7 @@ if (isset($_POST['AddGLCodeToTrans'])){
        $Ajax->activate('gl_items');
        $input_error = false;
 
-       $sql = "SELECT account_code, account_name FROM ".TB_PREF."chart_master WHERE account_code='" . $_POST['gl_code'] . "'";
+       $sql = "SELECT account_code, account_name FROM ".TB_PREF."chart_master WHERE account_code=".db_escape($_POST['gl_code']);
        $result = db_query($sql,"get account information");
        if (db_num_rows($result) == 0)
        {
@@ -138,27 +138,29 @@ if (isset($_POST['AddGLCodeToTrans'])){
 
 function check_data()
 {
-       If (!$_SESSION['supp_trans']->is_valid_trans_to_post())
+       global $Refs;
+
+       if (!$_SESSION['supp_trans']->is_valid_trans_to_post())
        {
                display_error(_("The invoice cannot be processed because the there are no items or values on the invoice.  Invoices are expected to have a charge."));
                return false;
        }
 
-       if (!references::is_valid($_SESSION['supp_trans']->reference)) 
+       if (!$Refs->is_valid($_SESSION['supp_trans']->reference)) 
        {
                display_error(_("You must enter an invoice reference."));
                set_focus('reference');
                return false;
        }
 
-       if (!is_new_reference($_SESSION['supp_trans']->reference, 20)) 
+       if (!is_new_reference($_SESSION['supp_trans']->reference, ST_SUPPINVOICE)) 
        {
                display_error(_("The entered reference is already in use."));
                set_focus('reference');
                return false;
        }
 
-       if (!references::is_valid($_SESSION['supp_trans']->supp_reference)) 
+       if (!$Refs->is_valid($_SESSION['supp_trans']->supp_reference)) 
        {
                display_error(_("You must enter a supplier's invoice reference."));
                set_focus('supp_reference');
@@ -184,10 +186,10 @@ function check_data()
                return false;
        }
 
-       $sql = "SELECT Count(*) FROM ".TB_PREF."supp_trans WHERE supplier_id='" 
-               . $_SESSION['supp_trans']->supplier_id . "' AND supp_reference='" 
-               . $_POST['supp_reference'] 
-               . "' AND ov_amount!=0"; // ignore voided invoice references
+       $sql = "SELECT Count(*) FROM ".TB_PREF."supp_trans WHERE supplier_id="
+               .db_escape($_SESSION['supp_trans']->supplier_id) . " AND supp_reference=" 
+               .db_escape( $_POST['supp_reference']) 
+               . " AND ov_amount!=0"; // ignore voided invoice references
 
        $result=db_query($sql,"The sql to check for the previous entry of the same invoice failed");
 
@@ -228,7 +230,7 @@ if (isset($_POST['PostInvoice']))
 function check_item_data($n)
 {
        global $check_price_charged_vs_order_price,
-               $check_qty_charged_vs_del_qty;
+               $check_qty_charged_vs_del_qty, $SysPrefs;
        if (!check_num('this_quantity_inv'.$n, 0) || input_num('this_quantity_inv'.$n)==0)
        {
                display_error( _("The quantity to invoice must be numeric and greater than zero."));
@@ -243,15 +245,16 @@ function check_item_data($n)
                return false;
        }
 
+       $margin = $SysPrefs->over_charge_allowance();
        if ($check_price_charged_vs_order_price == True)
        {
                if ($_POST['order_price'.$n]!=input_num('ChgPrice'.$n)) {
                     if ($_POST['order_price'.$n]==0 ||
                                input_num('ChgPrice'.$n)/$_POST['order_price'.$n] >
-                           (1 + (sys_prefs::over_charge_allowance() / 100)))
+                           (1 + ($margin/ 100)))
                    {
                        display_error(_("The price being invoiced is more than the purchase order price by more than the allowed over-charge percentage. The system is set up to prohibit this. See the system administrator to modify the set up parameters if necessary.") .
-                       _("The over-charge percentage allowance is :") . sys_prefs::over_charge_allowance() . "%");
+                       _("The over-charge percentage allowance is :") . $margin . "%");
                        set_focus('ChgPrice'.$n);
                        return false;
                    }
@@ -261,10 +264,10 @@ function check_item_data($n)
        if ($check_qty_charged_vs_del_qty == True)
        {
                if (input_num('this_quantity_inv'.$n) / ($_POST['qty_recd'.$n] - $_POST['prev_quantity_inv'.$n]) >
-                       (1+ (sys_prefs::over_charge_allowance() / 100)))
+                       (1+ ($margin / 100)))
                {
                        display_error( _("The quantity being invoiced is more than the outstanding quantity by more than the allowed over-charge percentage. The system is set up to prohibit this. See the system administrator to modify the set up parameters if necessary.")
-                       . _("The over-charge percentage allowance is :") . sys_prefs::over_charge_allowance() . "%");
+                       . _("The over-charge percentage allowance is :") . $margin . "%");
                        set_focus('this_quantity_inv'.$n);
                        return false;
                }
@@ -356,7 +359,7 @@ if ($_SESSION["wa_current_user"]->can_access('SA_GRNDELETE'))
                update_average_material_cost($grn["supplier_id"], $myrow["item_code"],
                        $myrow["unit_price"], -$myrow["QtyOstdg"], Today());
 
-               add_stock_move(25, $myrow["item_code"], $myrow['grn_batch_id'], $grn['loc_code'], sql2date($grn["delivery_date"]), "",
+               add_stock_move(ST_SUPPRECEIVE, $myrow["item_code"], $myrow['grn_batch_id'], $grn['loc_code'], sql2date($grn["delivery_date"]), "",
                        -$myrow["QtyOstdg"], $myrow['std_cost_unit'], $grn["supplier_id"], 1, $myrow['unit_price']);
                        
                commit_transaction();