Security update merged from 2.1.

[fa-stable.git] / reporting / rep108.php

diff --git a/reporting/rep108.php b/reporting/rep108.php
index 0fcfb6e40061af1e79bae48a93bfad6e36ff773b..97c4413bc711cf308dc8ae5200cb1e2c86e2ebb6 100644 (file)
--- a/reporting/rep108.php
+++ b/reporting/rep108.php
@@ -32,13 +32,14 @@ print_statements();
 function getTransactions($debtorno, $date)
 {
     $sql = "SELECT ".TB_PREF."debtor_trans.*,
-                               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + ".TB_PREF."debtor_trans.ov_discount)
+                               (".TB_PREF."debtor_trans.ov_amount + ".TB_PREF."debtor_trans.ov_gst + ".TB_PREF."debtor_trans.ov_freight + 
+                               ".TB_PREF."debtor_trans.ov_freight_tax + ".TB_PREF."debtor_trans.ov_discount)
                                AS TotalAmount, ".TB_PREF."debtor_trans.alloc AS Allocated,
-                               ((".TB_PREF."debtor_trans.type = 10)
+                               ((".TB_PREF."debtor_trans.type = ".ST_SALESINVOICE.")
                                        AND ".TB_PREF."debtor_trans.due_date < '$date') AS OverDue
                        FROM ".TB_PREF."debtor_trans
-                       WHERE ".TB_PREF."debtor_trans.tran_date <= '$date' AND ".TB_PREF."debtor_trans.debtor_no = '$debtorno'
-                               AND ".TB_PREF."debtor_trans.type <> 13
+                       WHERE ".TB_PREF."debtor_trans.tran_date <= '$date' AND ".TB_PREF."debtor_trans.debtor_no = ".db_escape($debtorno)."
+                               AND ".TB_PREF."debtor_trans.type <> ".ST_CUSTDELIVERY."
                                ORDER BY ".TB_PREF."debtor_trans.tran_date";
 
     return db_query($sql,"No transactions were returned");
@@ -54,9 +55,8 @@ function print_statements()
 
        $customer = $_POST['PARAM_0'];
        $currency = $_POST['PARAM_1'];
-       $bankaccount = $_POST['PARAM_2'];
-       $email = $_POST['PARAM_3'];
-       $comments = $_POST['PARAM_4'];
+       $email = $_POST['PARAM_2'];
+       $comments = $_POST['PARAM_3'];
 
        $dec = user_price_dec();
 
@@ -66,10 +66,7 @@ function print_statements()
 
        $aligns = array('left', 'left', 'left', 'left', 'right', 'right', 'right', 'right');
 
-       $params = array('comments' => $comments,
-                                       'bankaccount' => $bankaccount);
-
-       $baccount = get_bank_account($params['bankaccount']);
+       $params = array('comments' => $comments);
 
        $cur = get_company_pref('curr_default');
        $PastDueDays1 = get_company_pref('past_due_days');
@@ -85,7 +82,7 @@ function print_statements()
 
        $sql = "SELECT debtor_no, name AS DebtorName, address, tax_id, email, curr_code, curdate() AS tran_date, payment_terms FROM ".TB_PREF."debtors_master";
        if ($customer != ALL_NUMERIC)
-               $sql .= " WHERE debtor_no = $customer";
+               $sql .= " WHERE debtor_no = ".db_escape($customer);
        else
                $sql .= " ORDER by name";
        $result = db_query($sql, "The customers could not be retrieved");
@@ -97,6 +94,8 @@ function print_statements()
                $myrow['order_'] = "";
 
                $TransResult = getTransactions($myrow['debtor_no'], $date);
+               $baccount = get_default_bank_account($myrow['curr_code']);
+               $params['bankaccount'] = $baccount['id'];
                if (db_num_rows($TransResult) == 0)
                        continue;
                if ($email == 1)
@@ -133,9 +132,9 @@ function print_statements()
                        $rep->TextCol(0, 1, $systypes_array[$myrow2['type']], -2);
                        $rep->TextCol(1, 2,     $myrow2['reference'], -2);
                        $rep->TextCol(2, 3,     sql2date($myrow2['tran_date']), -2);
-                       if ($myrow2['type'] == 10)
+                       if ($myrow2['type'] == ST_SALESINVOICE)
                                $rep->TextCol(3, 4,     sql2date($myrow2['due_date']), -2);
-                       if ($myrow2['type'] == 10)
+                       if ($myrow2['type'] == ST_SALESINVOICE)
                                $rep->TextCol(4, 5,     $DisplayTotal, -2);
                        else
                                $rep->TextCol(5, 6,     $DisplayTotal, -2);