Security update merged from 2.1.
[fa-stable.git] / purchasing / supplier_invoice.php
index a0782e2bf15fff62e76160dc686d32f49cfa700f..afa2df18da28a0a573c37f9205c2c238e10f9381 100644 (file)
@@ -9,8 +9,8 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security=5;
-$path_to_root="..";
+$page_security = 'SA_SUPPLIERINVOICE';
+$path_to_root = "..";
 
 include_once($path_to_root . "/purchasing/includes/purchasing_db.inc");
 
@@ -27,29 +27,16 @@ if ($use_date_picker)
        $js .= get_js_date_picker();
 page(_("Enter Supplier Invoice"), false, false, "", $js);
 
-
 //----------------------------------------------------------------------------------------
 
 check_db_has_suppliers(_("There are no suppliers defined in the system."));
 
-//---------------------------------------------------------------------------------------------------------------
-if ($ret = context_restore()) {
- // return from supplier editor
-       copy_from_trans($_SESSION['supp_trans']);
-       if(isset($ret['supplier_id']))
-               $_POST['supplier_id'] = $ret['supplier_id'];
-}
-if (isset($_POST['_supplier_id_editor'])) {
-       copy_to_trans($_SESSION['supp_trans']);
-       context_call($path_to_root.'/purchasing/manage/suppliers.php?supplier_id='.$_POST['supplier_id'], 'supp_trans');
-}
-
 //---------------------------------------------------------------------------------------------------------------
 
 if (isset($_GET['AddedID'])) 
 {
        $invoice_no = $_GET['AddedID'];
-       $trans_type = 20;
+       $trans_type = ST_SUPPINVOICE;
 
 
     echo "<center>";
@@ -58,6 +45,8 @@ if (isset($_GET['AddedID']))
 
        display_note(get_gl_view_str($trans_type, $invoice_no, _("View the GL Journal Entries for this Invoice")), 1);
 
+       hyperlink_no_params("$path_to_root/purchasing/supplier_payment.php", _("Entry supplier &payment for this invoice"));
+
        hyperlink_params($_SERVER['PHP_SELF'], _("Enter Another Invoice"), "New=1");
 
        hyperlink_params("$path_to_root/admin/attachments.php", _("Add an Attachment"), "filterType=$trans_type&trans_no=$invoice_no");
@@ -110,7 +99,7 @@ if (isset($_POST['AddGLCodeToTrans'])){
        $Ajax->activate('gl_items');
        $input_error = false;
 
-       $sql = "SELECT account_code, account_name FROM ".TB_PREF."chart_master WHERE account_code='" . $_POST['gl_code'] . "'";
+       $sql = "SELECT account_code, account_name FROM ".TB_PREF."chart_master WHERE account_code=".db_escape($_POST['gl_code']);
        $result = db_query($sql,"get account information");
        if (db_num_rows($result) == 0)
        {
@@ -130,6 +119,12 @@ if (isset($_POST['AddGLCodeToTrans'])){
                }
        }
 
+       if (!is_tax_gl_unique(get_post('gl_code'))) {
+               display_error(_("Cannot post to GL account used by more than one tax type."));
+               set_focus('gl_code');
+               $input_error = true;
+       }
+
        if ($input_error == false)
        {
                $_SESSION['supp_trans']->add_gl_codes_to_trans($_POST['gl_code'], $gl_act_name,
@@ -143,27 +138,29 @@ if (isset($_POST['AddGLCodeToTrans'])){
 
 function check_data()
 {
-       If (!$_SESSION['supp_trans']->is_valid_trans_to_post())
+       global $Refs;
+
+       if (!$_SESSION['supp_trans']->is_valid_trans_to_post())
        {
                display_error(_("The invoice cannot be processed because the there are no items or values on the invoice.  Invoices are expected to have a charge."));
                return false;
        }
 
-       if (!references::is_valid($_SESSION['supp_trans']->reference)) 
+       if (!$Refs->is_valid($_SESSION['supp_trans']->reference)) 
        {
                display_error(_("You must enter an invoice reference."));
                set_focus('reference');
                return false;
        }
 
-       if (!is_new_reference($_SESSION['supp_trans']->reference, 20)) 
+       if (!is_new_reference($_SESSION['supp_trans']->reference, ST_SUPPINVOICE)) 
        {
                display_error(_("The entered reference is already in use."));
                set_focus('reference');
                return false;
        }
 
-       if (!references::is_valid($_SESSION['supp_trans']->supp_reference)) 
+       if (!$Refs->is_valid($_SESSION['supp_trans']->supp_reference)) 
        {
                display_error(_("You must enter a supplier's invoice reference."));
                set_focus('supp_reference');
@@ -189,7 +186,11 @@ function check_data()
                return false;
        }
 
-       $sql = "SELECT Count(*) FROM ".TB_PREF."supp_trans WHERE supplier_id='" . $_SESSION['supp_trans']->supplier_id . "' AND supp_reference='" . $_POST['supp_reference'] . "'";
+       $sql = "SELECT Count(*) FROM ".TB_PREF."supp_trans WHERE supplier_id="
+               .db_escape($_SESSION['supp_trans']->supplier_id) . " AND supp_reference=" 
+               .db_escape( $_POST['supp_reference']) 
+               . " AND ov_amount!=0"; // ignore voided invoice references
+
        $result=db_query($sql,"The sql to check for the previous entry of the same invoice failed");
 
        $myrow = db_fetch_row($result);
@@ -229,7 +230,7 @@ if (isset($_POST['PostInvoice']))
 function check_item_data($n)
 {
        global $check_price_charged_vs_order_price,
-               $check_qty_charged_vs_del_qty;
+               $check_qty_charged_vs_del_qty, $SysPrefs;
        if (!check_num('this_quantity_inv'.$n, 0) || input_num('this_quantity_inv'.$n)==0)
        {
                display_error( _("The quantity to invoice must be numeric and greater than zero."));
@@ -244,15 +245,16 @@ function check_item_data($n)
                return false;
        }
 
+       $margin = $SysPrefs->over_charge_allowance();
        if ($check_price_charged_vs_order_price == True)
        {
                if ($_POST['order_price'.$n]!=input_num('ChgPrice'.$n)) {
                     if ($_POST['order_price'.$n]==0 ||
                                input_num('ChgPrice'.$n)/$_POST['order_price'.$n] >
-                           (1 + (sys_prefs::over_charge_allowance() / 100)))
+                           (1 + ($margin/ 100)))
                    {
                        display_error(_("The price being invoiced is more than the purchase order price by more than the allowed over-charge percentage. The system is set up to prohibit this. See the system administrator to modify the set up parameters if necessary.") .
-                       _("The over-charge percentage allowance is :") . sys_prefs::over_charge_allowance() . "%");
+                       _("The over-charge percentage allowance is :") . $margin . "%");
                        set_focus('ChgPrice'.$n);
                        return false;
                    }
@@ -262,10 +264,10 @@ function check_item_data($n)
        if ($check_qty_charged_vs_del_qty == True)
        {
                if (input_num('this_quantity_inv'.$n) / ($_POST['qty_recd'.$n] - $_POST['prev_quantity_inv'.$n]) >
-                       (1+ (sys_prefs::over_charge_allowance() / 100)))
+                       (1+ ($margin / 100)))
                {
                        display_error( _("The quantity being invoiced is more than the outstanding quantity by more than the allowed over-charge percentage. The system is set up to prohibit this. See the system administrator to modify the set up parameters if necessary.")
-                       . _("The over-charge percentage allowance is :") . sys_prefs::over_charge_allowance() . "%");
+                       . _("The over-charge percentage allowance is :") . $margin . "%");
                        set_focus('this_quantity_inv'.$n);
                        return false;
                }
@@ -335,20 +337,10 @@ if ($id4 != -1)
 }
 
 $id2 = -1;
-if ($_SESSION["wa_current_user"]->access == 2)
+if ($_SESSION["wa_current_user"]->can_access('SA_GRNDELETE'))
 {
-       $id3 = find_submit('void_item_id');
-       if ($id3 != -1) 
-       {
-               $js = "if(confirm(\""
-               .sprintf(_('You are about to remove all yet non-invoiced items from delivery line #%d. This operation also irreversibly changes related order line. Do you want to continue ?'), $id3)
-               ."\")) {
-                       JsHttpRequest.request(\"void_confirm".$id3."\");
-               }";
-               $Ajax->addScript(true,$js);
-       }
-       $id2 = find_submit('void_confirm');
-       if ($id2 != -1) // Added section 2008-10-18 Joe Hunt for voiding delivery lines
+       $id2 = find_submit('void_item_id');
+       if ($id2 != -1) 
        {
                begin_transaction();
                
@@ -367,7 +359,7 @@ if ($_SESSION["wa_current_user"]->access == 2)
                update_average_material_cost($grn["supplier_id"], $myrow["item_code"],
                        $myrow["unit_price"], -$myrow["QtyOstdg"], Today());
 
-               add_stock_move(25, $myrow["item_code"], $myrow['grn_batch_id'], $grn['loc_code'], sql2date($grn["delivery_date"]), "",
+               add_stock_move(ST_SUPPRECEIVE, $myrow["item_code"], $myrow['grn_batch_id'], $grn['loc_code'], sql2date($grn["delivery_date"]), "",
                        -$myrow["QtyOstdg"], $myrow['std_cost_unit'], $grn["supplier_id"], 1, $myrow['unit_price']);
                        
                commit_transaction();