Added text fields sanitization on upgrdae to 2.2.

[fa-stable.git] / sales / customer_payments.php

diff --git a/sales/customer_payments.php b/sales/customer_payments.php
index 1dcce02d3f6411535da166cefaa7a279f6cea83f..a01bd2896df7df19760a7caa17dc94ce56f54b19 100644 (file)
--- a/sales/customer_payments.php
+++ b/sales/customer_payments.php
@@ -109,11 +109,13 @@ function can_process()
                set_focus('charge');
                return false;
        }
-
-       if (isset($_POST['charge']) && input_num('charge') > 0 && get_company_pref('bank_charge_act') == '') {
-               display_error(_("The Bank Charge Account has not been set in System and General GL Setup."));
-               set_focus('charge');
-               return false;
+       if (isset($_POST['charge']) && input_num('charge') > 0) {
+               $charge_acct = get_company_pref('bank_charge_act');
+               if (get_gl_account($charge_acct) == false) {
+                       display_error(_("The Bank Charge Account has not been set in System and General GL Setup."));
+                       set_focus('charge');
+                       return false;
+               }       
        }
 
        if (isset($_POST['_ex_rate']) && !check_num('_ex_rate', 0.000001))
@@ -141,7 +143,11 @@ function can_process()
        }
 
        $_SESSION['alloc']->amount = input_num('amount');
-       return check_allocations();
+
+       if (isset($_POST["TotalNumberOfAllocs"]))
+               return check_allocations();
+       else
+               return true;
 }
 
 //----------------------------------------------------------------------------------------------
@@ -198,7 +204,7 @@ function read_customer_data()
                ".TB_PREF."credit_status.dissallow_invoices
                FROM ".TB_PREF."debtors_master, ".TB_PREF."credit_status
                WHERE ".TB_PREF."debtors_master.credit_status = ".TB_PREF."credit_status.id
-                       AND ".TB_PREF."debtors_master.debtor_no = '" . $_POST['customer_id'] . "'";
+                       AND ".TB_PREF."debtors_master.debtor_no = ".db_escape($_POST['customer_id']);
 
        $result = db_query($sql, "could not query customers");