Security update merged from 2.1.

[fa-stable.git] / sales / manage / sales_types.php

diff --git a/sales/manage/sales_types.php b/sales/manage/sales_types.php
index 08de58cb3f804dec5a81ed850c525b9aad1cc22e..4d9d1f08a54a753940613792eabd3f56d4643bfb 100644 (file)
--- a/sales/manage/sales_types.php
+++ b/sales/manage/sales_types.php
@@ -1,7 +1,16 @@
 <?php
-
-$page_security = 14;
-$path_to_root="../..";
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_SALESTYPES';
+$path_to_root = "../..";
 include_once($path_to_root . "/includes/session.inc");
 
 page(_("Sales Types"));
@@ -57,7 +66,7 @@ if ($Mode == 'Delete')
 {
        // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
 
-       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE tpe='$selected_id'";
+       $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE tpe=".db_escape($selected_id);
        $result = db_query($sql,"check failed");
        check_db_error("The number of transactions using this Sales type record could not be retrieved", $sql);
 
@@ -70,7 +79,7 @@ if ($Mode == 'Delete')
        else
        {
 
-               $sql = "SELECT COUNT(*) FROM ".TB_PREF."debtors_master WHERE sales_type='$selected_id'";
+               $sql = "SELECT COUNT(*) FROM ".TB_PREF."debtors_master WHERE sales_type=".db_escape($selected_id);
                $result = db_query($sql,"check failed");
                check_db_error("The number of customers using this Sales type record could not be retrieved", $sql);
 
@@ -83,24 +92,27 @@ if ($Mode == 'Delete')
                {
                        delete_sales_type($selected_id);
                        display_notification(_('Selected sales type has been deleted'));
-                       $Mode = 'RESET';
                }
        } //end if sales type used in debtor transactions or in customers set up
+       $Mode = 'RESET';
 }
 
 if ($Mode == 'RESET')
 {
        $selected_id = -1;
+       $sav = get_post('show_inactive');
        unset($_POST);
+       $_POST['show_inactive'] = $sav;
 }
 //----------------------------------------------------------------------------------------------------
 
-$result = get_all_sales_types();
+$result = get_all_sales_types(check_value('show_inactive'));
 
 start_form();
 start_table("$table_style width=30%");
 
 $th = array (_('Type Name'), _('Factor'), _('Tax Incl'), '','');
+inactive_control_column($th);
 table_header($th);
 $k = 0;
 $base_sales = get_base_sales_type();
@@ -116,24 +128,24 @@ while ($myrow = db_fetch($result))
        if($myrow["id"] == $base_sales) $f = "<I>"._('Base')."</I>";
        label_cell($f);
        label_cell($myrow["tax_included"] ? _('Yes'):_('No'), 'align=center');
+       inactive_control_cell($myrow["id"], $myrow["inactive"], 'sales_types', 'id');
        edit_button_cell("Edit".$myrow['id'], _("Edit"));
-       edit_button_cell("Delete".$myrow['id'], _("Delete"));
+       delete_button_cell("Delete".$myrow['id'], _("Delete"));
        end_row();
 }
-
+inactive_control_row($th);
 end_table();
-end_form();
+
 display_note(_("Marked sales type is the company base pricelist for prices calculations."), 0, 0, "class='overduefg'");
 
 //----------------------------------------------------------------------------------------------------
 
-start_form();
  if (!isset($_POST['tax_included']))
        $_POST['tax_included'] = 0;
  if (!isset($_POST['base']))
        $_POST['base'] = 0;
 
-start_table("$table_style2 width=30%");
+start_table($table_style2);
 
 if ($selected_id != -1)
 {
@@ -156,7 +168,7 @@ check_row(_("Tax included").':', 'tax_included', $_POST['tax_included']);
 
 end_table(1);
 
-submit_add_or_update_center($selected_id == -1, '', true);
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();