Security update merged from 2.1.

[fa-stable.git] / reporting / rep101.php

diff --git a/reporting/rep101.php b/reporting/rep101.php
index 9476d543e715d3787d175dd3d0ef4ec669fb5051..772d33f0cc6aec6a0199746f284dec5ed74a3c25 100644 (file)
--- a/reporting/rep101.php
+++ b/reporting/rep101.php
@@ -9,7 +9,7 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security = 2;
+$page_security = 'SA_CUSTPAYMREP';
 
 // ----------------------------------------------------------------
 // $ Revision: 2.0 $
@@ -33,13 +33,13 @@ function get_open_balance($debtorno, $to, $convert)
 {
        $to = date2sql($to);
 
-    $sql = "SELECT SUM(IF(".TB_PREF."debtor_trans.type = 10, (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)";
+    $sql = "SELECT SUM(IF(".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ", 0)) AS charges,
-       SUM(IF(".TB_PREF."debtor_trans.type <> 10, (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)";
+       SUM(IF(".TB_PREF."debtor_trans.type <> ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)";
     if ($convert)
        $sql .= " * rate";
     $sql .= " * -1, 0)) AS credits,
@@ -47,20 +47,20 @@ function get_open_balance($debtorno, $to, $convert)
        if ($convert)
                $sql .= " * rate";
        $sql .= ") AS Allocated,
-               SUM(IF(".TB_PREF."debtor_trans.type = 10, (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
-       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount - ".TB_PREF."debtor_trans.alloc)";
+               SUM(IF(".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.", (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + 
+       ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount - ".TB_PREF."debtor_trans.alloc)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ", 
        ((".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + 
-       ".TB_PREF."debtor_trans.ov_discount) * -1 + ".TB_PREF."debtor_trans.alloc)";
+       ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount) * -1 + ".TB_PREF."debtor_trans.alloc)";
     if ($convert)
        $sql .= " * rate";
     $sql .= ")) AS OutStanding
                FROM ".TB_PREF."debtor_trans
        WHERE ".TB_PREF."debtor_trans.tran_date < '$to'
-               AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
-               AND ".TB_PREF."debtor_trans.type <> 13 GROUP BY debtor_no";
+               AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
+               AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY." GROUP BY debtor_no";
 
     $result = db_query($sql,"No transactions were returned");
     return db_fetch($result);
@@ -72,15 +72,16 @@ function get_transactions($debtorno, $from, $to)
        $to = date2sql($to);
 
     $sql = "SELECT ".TB_PREF."debtor_trans.*,
-               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)
+               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + 
+               ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)
                AS TotalAmount, ".TB_PREF."debtor_trans.alloc AS Allocated,
-               ((".TB_PREF."debtor_trans.type = 10)
+               ((".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.")
                AND ".TB_PREF."debtor_trans.due_date < '$to') AS OverDue
        FROM ".TB_PREF."debtor_trans
        WHERE ".TB_PREF."debtor_trans.tran_date >= '$from'
                AND ".TB_PREF."debtor_trans.tran_date <= '$to'
-               AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
-               AND ".TB_PREF."debtor_trans.type <> 13
+               AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
+               AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY."
        ORDER BY ".TB_PREF."debtor_trans.tran_date";
 
     return db_query($sql,"No transactions were returned");
@@ -90,7 +91,7 @@ function get_transactions($debtorno, $from, $to)
 
 function print_customer_balances()
 {
-    global $path_to_root;
+    global $path_to_root, $systypes_array;
 
     $from = $_POST['PARAM_0'];
     $to = $_POST['PARAM_1'];
@@ -103,13 +104,13 @@ function print_customer_balances()
        else
                include_once($path_to_root . "/reporting/includes/pdf_report.inc");
 
-       if ($fromcust == reserved_words::get_all_numeric())
+       if ($fromcust == ALL_NUMERIC)
                $cust = _('All');
        else
                $cust = get_customer_name($fromcust);
     $dec = user_price_dec();
 
-       if ($currency == reserved_words::get_all())
+       if ($currency == ALL_TEXT)
        {
                $convert = true;
                $currency = _('Balances in Home Currency');
@@ -138,9 +139,9 @@ function print_customer_balances()
        $grandtotal = array(0,0,0,0);
 
        $sql = "SELECT debtor_no, name, curr_code FROM ".TB_PREF."debtors_master ";
-       if ($fromcust != reserved_words::get_all_numeric())
-               $sql .= "WHERE debtor_no=$fromcust ";
-       $sql .= "ORDER BY name";
+       if ($fromcust != ALL_NUMERIC)
+               $sql .= "WHERE debtor_no=".db_escape($fromcust);
+       $sql .= " ORDER BY name";
        $result = db_query($sql, "The customers could not be retrieved");
 
        while ($myrow = db_fetch($result))
@@ -177,17 +178,17 @@ function print_customer_balances()
                while ($trans = db_fetch($res))
                {
                        $rep->NewLine(1, 2);
-                       $rep->TextCol(0, 1, systypes::name($trans['type']));
+                       $rep->TextCol(0, 1, $systypes_array[$trans['type']]);
                        $rep->TextCol(1, 2,     $trans['reference']);
                        $rep->DateCol(2, 3,     $trans['tran_date'], true);
-                       if ($trans['type'] == 10)
+                       if ($trans['type'] == ST_SALESINVOICE)
                                $rep->DateCol(3, 4,     $trans['due_date'], true);
                        $item[0] = $item[1] = 0.0;
                        if ($convert)
                                $rate = $trans['rate'];
                        else
                                $rate = 1.0;
-                       if ($trans['type'] == 11 || $trans['type'] == 12 || $trans['type'] == 2)
+                       if ($trans['type'] == ST_CUSTCREDIT || $trans['type'] == ST_CUSTPAYMENT || $trans['type'] == ST_BANKDEPOSIT)
                                $trans['TotalAmount'] *= -1;
                        if ($trans['TotalAmount'] > 0.0)
                        {
@@ -207,7 +208,7 @@ function print_customer_balances()
                        else
                                $item[3] = ($trans['TotalAmount'] + $trans['Allocated']) * $rate;
                        */
-                       if ($trans['type'] == 10)
+                       if ($trans['type'] == ST_SALESINVOICE || $trans['type'] == ST_BANKPAYMENT)
                                $item[3] = $item[0] + $item[1] - $item[2];
                        else    
                                $item[3] = $item[0] - $item[1] + $item[2];