Security update merged from 2.1.

[fa-stable.git] / sales / manage / customers.php

diff --git a/sales/manage/customers.php b/sales/manage/customers.php
index e5ea837ab7228c08f75c2ca6d5efe089d31f4017..3b967e886a210046fe6ab705e218503bc1e3f09f 100644 (file)
--- a/sales/manage/customers.php
+++ b/sales/manage/customers.php
@@ -9,8 +9,8 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security = 3;
-$path_to_root="../..";
+$page_security = 'SA_CUSTOMER';
+$path_to_root = "../..";
 
 include_once($path_to_root . "/includes/session.inc");
 page(_("Customers"), @$_REQUEST['popup']); 
@@ -34,6 +34,13 @@ function can_process()
                set_focus('CustName');
                return false;
        } 
+
+       if (strlen($_POST['cust_ref']) == 0) 
+       {
+               display_error(_("The customer short name cannot be empty."));
+               set_focus('cust_ref');
+               return false;
+       } 
        
        if (!check_num('credit_limit', 0))
        {
@@ -72,6 +79,7 @@ function handle_submit()
        {
 
                $sql = "UPDATE ".TB_PREF."debtors_master SET name=" . db_escape($_POST['CustName']) . ", 
+                       debtor_ref=" . db_escape($_POST['cust_ref']) . ",
                        address=".db_escape($_POST['address']) . ", 
                        tax_id=".db_escape($_POST['tax_id']) . ", 
                        curr_code=".db_escape($_POST['curr_code']) . ", 
@@ -83,8 +91,9 @@ function handle_submit()
             discount=" . input_num('discount') / 100 . ", 
             pymt_discount=" . input_num('pymt_discount') / 100 . ", 
             credit_limit=" . input_num('credit_limit') . ", 
-            sales_type = ".db_escape($_POST['sales_type']) . " 
-            WHERE debtor_no = '". $_POST['customer_id'] . "'";
+            sales_type = ".db_escape($_POST['sales_type']) . ", 
+            notes=".db_escape($_POST['notes']) . "
+            WHERE debtor_no = ".db_escape($_POST['customer_id']);
 
                db_query($sql,"The customer could not be updated");
 
@@ -99,14 +108,15 @@ function handle_submit()
 
                begin_transaction();
 
-               $sql = "INSERT INTO ".TB_PREF."debtors_master (name, address, tax_id, email, dimension_id, dimension2_id,  
+               $sql = "INSERT INTO ".TB_PREF."debtors_master (name, debtor_ref, address, tax_id, email, dimension_id, dimension2_id,  
                        curr_code, credit_status, payment_terms, discount, pymt_discount,credit_limit,  
-                       sales_type) VALUES (".db_escape($_POST['CustName']) .", " 
+                       sales_type, notes) VALUES (".db_escape($_POST['CustName']) .", " .db_escape($_POST['cust_ref']) .", "
                        .db_escape($_POST['address']) . ", " . db_escape($_POST['tax_id']) . ","
                        .db_escape($_POST['email']) . ", ".db_escape($_POST['dimension_id']) . ", " 
                        .db_escape($_POST['dimension2_id']) . ", ".db_escape($_POST['curr_code']) . ", 
                        " . db_escape($_POST['credit_status']) . ", ".db_escape($_POST['payment_terms']) . ", " . input_num('discount')/100 . ", 
-                       " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') . ", ".db_escape($_POST['sales_type']) . ")";
+                       " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') 
+                        .", ".db_escape($_POST['sales_type']).", ".db_escape($_POST['notes']) . ")";
 
                db_query($sql,"The customer could not be added");
 
@@ -205,16 +215,17 @@ else
 
 if ($new_customer) 
 {
-       $_POST['CustName'] = $_POST['address'] = $_POST['tax_id']  = '';
+       $_POST['CustName'] = $_POST['cust_ref'] = $_POST['address'] = $_POST['tax_id']  = '';
        $_POST['dimension_id'] = 0;
        $_POST['dimension2_id'] = 0;
        $_POST['sales_type'] = -1;
        $_POST['email'] = '';
        $_POST['curr_code']  = get_company_currency();
        $_POST['credit_status']  = -1;
-       $_POST['payment_terms']  = '';
+       $_POST['payment_terms']  = $_POST['notes']  = '';
+
        $_POST['discount']  = $_POST['pymt_discount'] = percent_format(0);
-       $_POST['credit_limit']  = price_format(sys_prefs::default_credit_limit());
+       $_POST['credit_limit']  = price_format($SysPrefs->default_credit_limit());
        $_POST['inactive'] = 0;
 } 
 else 
@@ -226,6 +237,7 @@ else
        $myrow = db_fetch($result);
 
        $_POST['CustName'] = $myrow["name"];
+       $_POST['cust_ref'] = $myrow["debtor_ref"];
        $_POST['address']  = $myrow["address"];
        $_POST['tax_id']  = $myrow["tax_id"];
        $_POST['email']  = $myrow["email"];
@@ -238,6 +250,7 @@ else
        $_POST['discount']  = percent_format($myrow["discount"] * 100);
        $_POST['pymt_discount']  = percent_format($myrow["pymt_discount"] * 100);
        $_POST['credit_limit']  = price_format($myrow["credit_limit"]);
+       $_POST['notes']  = $myrow["notes"];
        $_POST['inactive'] = $myrow["inactive"];
 }
 
@@ -246,6 +259,7 @@ table_section(1);
 table_section_title(_("Name and Address"));
 
 text_row(_("Customer Name:"), 'CustName', $_POST['CustName'], 40, 80);
+text_row(_("Customer Short Name:"), 'cust_ref', null, 30, 30);
 textarea_row(_("Address:"), 'address', $_POST['address'], 35, 5);
 
 email_row(_("E-mail:"), 'email', null, 40, 40);
@@ -293,6 +307,7 @@ if (!$new_customer)  {
 
 }
 
+textarea_row(_("General Notes:"), 'notes', null, 35, 5);
 record_status_list_row(_("Customer status:"), 'inactive');
 end_outer_table(1);
 
@@ -304,7 +319,7 @@ if ($new_customer)
 else 
 {
        submit_center_first('submit', _("Update Customer"), 
-         _('Update customer data'), true);
+         _('Update customer data'), @$_REQUEST['popup'] ? true : 'default');
        submit_return('select', get_post('customer_id'), _("Select this customer and return to document entry."));
        submit_center_last('delete', _("Delete Customer"), 
          _('Delete customer data if have been never used'), true);