Security update merged from 2.1.

[fa-stable.git] / reporting / rep101.php

diff --git a/reporting/rep101.php b/reporting/rep101.php
index 913c12b40f7ce42f81645e99f2b62df519b8d798..772d33f0cc6aec6a0199746f284dec5ed74a3c25 100644 (file)
--- a/reporting/rep101.php
+++ b/reporting/rep101.php
@@ -34,12 +34,12 @@ function get_open_balance($debtorno, $to, $convert)
        $to = date2sql($to);
 
     $sql = "SELECT SUM(IF(".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)";
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ", 0)) AS charges,
        SUM(IF(".TB_PREF."debtor_trans.type <> ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)";
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)";
     if ($convert)
        $sql .= " * rate";
     $sql .= " * -1, 0)) AS credits,
@@ -48,18 +48,18 @@ function get_open_balance($debtorno, $to, $convert)
                $sql .= " * rate";
        $sql .= ") AS Allocated,
                SUM(IF(".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount - ".TB_PREF."debtor_trans.alloc)";
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount - ".TB_PREF."debtor_trans.alloc)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ", 
        ((".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + 
-       ".TB_PREF."debtor_trans.ov_discount) * -1 + ".TB_PREF."debtor_trans.alloc)";
+       ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount) * -1 + ".TB_PREF."debtor_trans.alloc)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ")) AS OutStanding
                FROM ".TB_PREF."debtor_trans
        WHERE ".TB_PREF."debtor_trans.tran_date < '$to'
-               AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
+               AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
                AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY." GROUP BY debtor_no";
 
     $result = db_query($sql,"No transactions were returned");
@@ -72,14 +72,15 @@ function get_transactions($debtorno, $from, $to)
        $to = date2sql($to);
 
     $sql = "SELECT ".TB_PREF."debtor_trans.*,
-               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)
+               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + 
+               ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)
                AS TotalAmount, ".TB_PREF."debtor_trans.alloc AS Allocated,
                ((".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.")
                AND ".TB_PREF."debtor_trans.due_date < '$to') AS OverDue
        FROM ".TB_PREF."debtor_trans
        WHERE ".TB_PREF."debtor_trans.tran_date >= '$from'
                AND ".TB_PREF."debtor_trans.tran_date <= '$to'
-               AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
+               AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
                AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY."
        ORDER BY ".TB_PREF."debtor_trans.tran_date";
 
@@ -139,8 +140,8 @@ function print_customer_balances()
 
        $sql = "SELECT debtor_no, name, curr_code FROM ".TB_PREF."debtors_master ";
        if ($fromcust != ALL_NUMERIC)
-               $sql .= "WHERE debtor_no=$fromcust ";
-       $sql .= "ORDER BY name";
+               $sql .= "WHERE debtor_no=".db_escape($fromcust);
+       $sql .= " ORDER BY name";
        $result = db_query($sql, "The customers could not be retrieved");
 
        while ($myrow = db_fetch($result))