Security update merged from 2.1.

[fa-stable.git] / sales / inquiry / customer_allocation_inquiry.php

diff --git a/sales/inquiry/customer_allocation_inquiry.php b/sales/inquiry/customer_allocation_inquiry.php
index dde0a8a535e9fc77d1b1dcfece5a25946ecfa104..fae2ad0ff7c0c840558e3b3f1bef71d75e9e22e9 100644 (file)
--- a/sales/inquiry/customer_allocation_inquiry.php
+++ b/sales/inquiry/customer_allocation_inquiry.php
@@ -1,7 +1,16 @@
 <?php
-
-$page_security = 1;
-$path_to_root="../..";
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_SALESALLOC';
+$path_to_root = "../..";
 include($path_to_root . "/includes/db_pager.inc");
 include_once($path_to_root . "/includes/session.inc");
 
@@ -25,7 +34,7 @@ if (isset($_GET['customer_id']))
 if (!isset($_POST['customer_id']))
        $_POST['customer_id'] = get_global_customer();
 
-start_form(false, true);
+start_form();
 
 start_table("class='tablestyle_noborder'");
 start_row();
@@ -39,7 +48,7 @@ cust_allocations_list_cells(_("Type:"), 'filterType', null);
 
 check_cells(" " . _("show settled:"), 'showSettled', null);
 
-submit_cells('RefreshInquiry', _("Search"),'',_('Refresh Inquiry'), true);
+submit_cells('RefreshInquiry', _("Search"),'',_('Refresh Inquiry'), 'default');
 
 set_global_customer($_POST['customer_id']);
 
@@ -56,13 +65,15 @@ function check_overdue($row)
 function order_link($row)
 {
        return $row['order_']>0 ?
-               get_customer_trans_view_str(systypes::sales_order(), $row['order_'])
+               get_customer_trans_view_str(ST_SALESORDER, $row['order_'])
                : "";
 }
 
 function systype_name($dummy, $type)
 {
-       return systypes::name($type);
+       global $systypes_array;
+
+       return $systypes_array[$type];
 }
 
 function view_link($trans)
@@ -85,20 +96,20 @@ function alloc_link($row)
        $link = 
        pager_link(_("Allocation"),
                "/sales/allocations/customer_allocate.php?trans_no=" . $row["trans_no"] 
-               ."&trans_type=" . $row["type"]);
+               ."&trans_type=" . $row["type"], ICON_MONEY);
 
-       if ($row["type"] == 11 && $row['TotalAmount'] > 0)
+       if ($row["type"] == ST_CUSTCREDIT && $row['TotalAmount'] > 0)
        {
                /*its a credit note which could have an allocation */
                return $link;
        }
-       elseif (($row["type"] == systypes::cust_payment() || $row["type"] == systypes::bank_deposit()) &&
+       elseif (($row["type"] == ST_CUSTPAYMENT || $row["type"] == ST_BANKDEPOSIT) &&
                ($row['TotalAmount'] - $row['Allocated']) > 0)
        {
                /*its a receipt  which could have an allocation*/
                return $link;
        }
-       elseif ($row["type"] == systypes::cust_payment() && $row['TotalAmount'] < 0)
+       elseif ($row["type"] == ST_CUSTPAYMENT && $row['TotalAmount'] < 0)
        {
                /*its a negative receipt */
                return '';
@@ -108,7 +119,7 @@ function alloc_link($row)
 function fmt_debit($row)
 {
        $value =
-           $row['type']==11 || $row['type']==12 || $row['type']==2 ?
+           $row['type']==ST_CUSTCREDIT || $row['type']==ST_CUSTPAYMENT || $row['type']==ST_BANKDEPOSIT ?
                -$row["TotalAmount"] : $row["TotalAmount"];
        return $value>=0 ? price_format($value) : '';
 
@@ -117,7 +128,7 @@ function fmt_debit($row)
 function fmt_credit($row)
 {
        $value =
-           !($row['type']==11 || $row['type']==12 || $row['type']==2) ?
+           !($row['type']==ST_CUSTCREDIT || $row['type']==ST_CUSTPAYMENT || $row['type']==ST_BANKDEPOSIT) ?
                -$row["TotalAmount"] : $row["TotalAmount"];
        return $value>0 ? price_format($value) : '';
 }
@@ -138,7 +149,7 @@ function fmt_credit($row)
        (trans.ov_amount + trans.ov_gst + trans.ov_freight 
                        + trans.ov_freight_tax + trans.ov_discount)     AS TotalAmount,
                trans.alloc AS Allocated,
-               ((trans.type = 10)
+               ((trans.type = ".ST_SALESINVOICE.")
                        AND trans.due_date < '" . date2sql(Today()) . "') AS OverDue
        FROM "
                        .TB_PREF."debtor_trans as trans, "
@@ -149,22 +160,22 @@ function fmt_credit($row)
                AND trans.tran_date >= '$data_after'
                AND trans.tran_date <= '$date_to'";
 
-       if ($_POST['customer_id'] != reserved_words::get_all())
-               $sql .= " AND trans.debtor_no = '" . $_POST['customer_id'] . "'";
+       if ($_POST['customer_id'] != ALL_TEXT)
+               $sql .= " AND trans.debtor_no = ".db_escape($_POST['customer_id']);
 
-       if (isset($_POST['filterType']) && $_POST['filterType'] != reserved_words::get_all())
+       if (isset($_POST['filterType']) && $_POST['filterType'] != ALL_TEXT)
        {
                if ($_POST['filterType'] == '1' || $_POST['filterType'] == '2')
                {
-                       $sql .= " AND trans.type = 10 ";
+                       $sql .= " AND trans.type = ".ST_SALESINVOICE." ";
                }
                elseif ($_POST['filterType'] == '3')
                {
-                       $sql .= " AND trans.type = " . systypes::cust_payment();
+                       $sql .= " AND trans.type = " . ST_CUSTPAYMENT;
                }
                elseif ($_POST['filterType'] == '4')
                {
-                       $sql .= " AND trans.type = 11 ";
+                       $sql .= " AND trans.type = ".ST_CUSTCREDIT." ";
                }
 
        if ($_POST['filterType'] == '2')
@@ -177,7 +188,7 @@ function fmt_credit($row)
        }
        }else
        {
-           $sql .= " AND trans.type != 13 ";
+           $sql .= " AND trans.type <> ".ST_CUSTDELIVERY." ";
        }
 
 
@@ -191,10 +202,10 @@ function fmt_credit($row)
 
 $cols = array(
        _("Type") => array('fun'=>'systype_name'),
-       _("Number") => array('fun'=>'view_link'),
+       _("#") => array('fun'=>'view_link'),
        _("Reference"), 
        _("Order") => array('fun'=>'order_link'), 
-       _("Date") => array('type'=>'date', 'ord'=>'asc'),
+       _("Date") => array('name'=>'tran_date', 'type'=>'date', 'ord'=>'asc'),
        _("Due Date") => array('type'=>'date', 'fun'=>'due_date'),
        _("Customer"), 
        _("Currency") => array('align'=>'center'),
@@ -205,7 +216,7 @@ $cols = array(
        array('insert'=>true, 'fun'=>'alloc_link')
        );
 
-if ($_POST['customer_id'] != reserved_words::get_all()) {
+if ($_POST['customer_id'] != ALL_TEXT) {
        $cols[_("Customer")] = 'skip';
        $cols[_("Currency")] = 'skip';
 }
@@ -213,10 +224,7 @@ if ($_POST['customer_id'] != reserved_words::get_all()) {
 $table =& new_db_pager('doc_tbl', $sql, $cols);
 $table->set_marker('check_overdue', _("Marked items are overdue."));
 
-if (get_post('RefreshInquiry')) {
-       $table->set_sql($sql);
-       $table->set_columns($cols);
-}
+$table->width = "80%";
 start_form();
 
 display_db_pager($table);