X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=reporting%2Frep209.php;h=e8278e60e13036c644e5742654c61c983c4b0a79;hb=883307779f9ca5bac0533702a8702b0cccb4742f;hp=b9a8a049509fd75b3252f9abc339b2bced951cd1;hpb=95303d7b5280820af76ddbd8908b120813f1e763;p=fa-stable.git

diff --git a/reporting/rep209.php b/reporting/rep209.php
index b9a8a049..e8278e60 100644
--- a/reporting/rep209.php
+++ b/reporting/rep209.php
@@ -9,7 +9,9 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
-$page_security = 2;
+
+$page_security = $_POST['PARAM_0'] == $_POST['PARAM_1'] ?
+	'SA_SUPPTRANSVIEW' : 'SA_SUPPBULKREP';
 // ----------------------------------------------------------------
 // $ Revision:	2.0 $
 // Creator:	Joe Hunt
@@ -35,7 +37,7 @@ function get_po($order_no)
 		FROM ".TB_PREF."purch_orders, ".TB_PREF."suppliers, ".TB_PREF."locations
 		WHERE ".TB_PREF."purch_orders.supplier_id = ".TB_PREF."suppliers.supplier_id
 		AND ".TB_PREF."locations.loc_code = into_stock_location
-		AND ".TB_PREF."purch_orders.order_no = " . $order_no;
+		AND ".TB_PREF."purch_orders.order_no = ".db_escape($order_no);
    	$result = db_query($sql, "The order cannot be retrieved");
     return db_fetch($result);
 }
@@ -46,7 +48,7 @@ function get_po_details($order_no)
 		FROM ".TB_PREF."purch_order_details
 		LEFT JOIN ".TB_PREF."stock_master
 		ON ".TB_PREF."purch_order_details.item_code=".TB_PREF."stock_master.stock_id
-		WHERE order_no =$order_no ";
+		WHERE order_no =".db_escape($order_no)." ";
 	$sql .= " ORDER BY po_detail_item";
 	return db_query($sql, "Retreive order Line Items");
 }
@@ -60,9 +62,8 @@ function print_po()
 	$from = $_POST['PARAM_0'];
 	$to = $_POST['PARAM_1'];
 	$currency = $_POST['PARAM_2'];
-	$bankaccount = $_POST['PARAM_3'];
-	$email = $_POST['PARAM_4'];
-	$comments = $_POST['PARAM_5'];
+	$email = $_POST['PARAM_3'];
+	$comments = $_POST['PARAM_4'];
 
 	if ($from == null)
 		$from = 0;
@@ -75,10 +76,8 @@ function print_po()
 	// $headers in doctext.inc
 	$aligns = array('left',	'left',	'left', 'right', 'left', 'right', 'right');
 
-	$params = array('comments' => $comments,
-					'bankaccount' => $bankaccount);
+	$params = array('comments' => $comments);
 
-	$baccount = get_bank_account($params['bankaccount']);
 	$cur = get_company_Pref('curr_default');
 
 	if ($email == 0)
@@ -92,6 +91,8 @@ function print_po()
 	for ($i = $from; $i <= $to; $i++)
 	{
 		$myrow = get_po($i);
+		$baccount = get_default_bank_account($myrow['curr_code']);
+		$params['bankaccount'] = $baccount['id'];
 
 		if ($email == 1)
 		{
@@ -104,7 +105,7 @@ function print_po()
 		}
 		else
 			$rep->title = _('PURCHASE ORDER');
-		$rep->Header2($myrow, null, $myrow, $baccount, 8);
+		$rep->Header2($myrow, null, $myrow, $baccount, ST_PURCHORDER);
 
 		$result = get_po_details($i);
 		$SubTotal = 0;
@@ -138,7 +139,7 @@ function print_po()
 			$rep->TextCol(6, 7,	$DisplayNet, -2);
 			$rep->NewLine(1);
 			if ($rep->row < $rep->bottomMargin + (15 * $rep->lineHeight))
-				$rep->Header2($myrow, $branch, $myrow, $baccount, 8);
+				$rep->Header2($myrow, $branch, $myrow, $baccount, ST_PURCHORDER);
 		}
 		if ($myrow['comments'] != "")
 		{
@@ -149,7 +150,7 @@ function print_po()
 
 		$rep->row = $rep->bottomMargin + (15 * $rep->lineHeight);
 		$linetype = true;
-		$doctype = 8;
+		$doctype = ST_PURCHORDER;
 		if ($rep->currency != $myrow['curr_code'])
 		{
 			include($path_to_root . "/reporting/includes/doctext2.inc");