Security statements update against sql injection attacks.
[fa-stable.git] / admin / payment_terms.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 10;
13 $path_to_root="..";
14 include($path_to_root . "/includes/session.inc");
15
16 page(_("Payment Terms"));
17
18 include($path_to_root . "/includes/ui.inc");
19
20 simple_page_mode(true);
21 //-------------------------------------------------------------------------------------------
22
23 if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM') 
24 {
25
26         $inpug_error = 0;
27
28         if (!is_numeric($_POST['DayNumber']))
29         {
30                 $inpug_error = 1;
31                 display_error( _("The number of days or the day in the following month must be numeric."));
32                 set_focus('DayNumber');
33         } 
34         elseif (strlen($_POST['terms']) == 0) 
35         {
36                 $inpug_error = 1;
37                 display_error( _("The Terms description must be entered."));
38                 set_focus('terms');
39         } 
40         elseif ($_POST['DayNumber'] > 30 && !check_value('DaysOrFoll')) 
41         {
42                 $inpug_error = 1;
43                 display_error( _("When the check box to indicate a day in the following month is the due date, the due date cannot be a day after the 30th. A number between 1 and 30 is expected."));
44                 set_focus('DayNumber');
45         } 
46         elseif ($_POST['DayNumber'] > 500 && check_value('DaysOrFoll')) 
47         {
48                 $inpug_error = 1;
49                 display_error( _("When the check box is not checked to indicate that the term expects a number of days after which accounts are due, the number entered should be less than 500 days."));
50                 set_focus('DayNumber');
51         }
52
53         if ($_POST['DayNumber'] == '')
54                 $_POST['DayNumber'] = 0;
55
56         if ($inpug_error != 1)
57         {
58         if ($selected_id != -1) 
59         {
60                 if (check_value('DaysOrFoll')) 
61                 {
62                         $sql = "UPDATE ".TB_PREF."payment_terms SET terms=" . db_escape($_POST['terms']) . ",
63                                         day_in_following_month=0,
64                                         days_before_due=" . db_escape($_POST['DayNumber']) . "
65                                         WHERE terms_indicator = " .db_escape($selected_id);
66                 } 
67                 else 
68                 {
69                         $sql = "UPDATE ".TB_PREF."payment_terms SET terms=" . db_escape($_POST['terms']) . ",
70                                         day_in_following_month=" . db_escape($_POST['DayNumber']) . ",
71                                         days_before_due=0
72                                         WHERE terms_indicator = " .db_escape( $selected_id );
73                 }
74                         $note = _('Selected payment terms have been updated');
75         } 
76         else 
77         {
78
79                 if (check_value('DaysOrFoll')) 
80                 {
81                         $sql = "INSERT INTO ".TB_PREF."payment_terms (terms,
82                                         days_before_due, day_in_following_month)
83                                         VALUES (" .
84                                         db_escape($_POST['terms']) . ", " . db_escape($_POST['DayNumber']) . ", 0)";
85                 } 
86                 else 
87                 {
88                         $sql = "INSERT INTO ".TB_PREF."payment_terms (terms,
89                                         days_before_due, day_in_following_month)
90                                         VALUES (" . db_escape($_POST['terms']) . ",
91                                         0, " . db_escape($_POST['DayNumber']) . ")";
92                 }
93                         $note = _('New payment terms have been added');
94         }
95         //run the sql from either of the above possibilites
96         db_query($sql,"The payment term could not be added or updated");
97                 display_notification($note);
98                 $Mode = 'RESET';
99         }
100 }
101
102 if ($Mode == 'Delete')
103 {
104         // PREVENT DELETES IF DEPENDENT RECORDS IN debtors_master
105
106         $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtors_master WHERE payment_terms = ".db_escape($selected_id);
107         $result = db_query($sql,"check failed");
108         $myrow = db_fetch_row($result);
109         if ($myrow[0] > 0) 
110         {
111                 display_error(_("Cannot delete this payment term, because customer accounts have been created referring to this term."));
112         } 
113         else 
114         {
115                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."suppliers WHERE payment_terms = ".db_escape($selected_id);
116                 $result = db_query($sql,"check failed");
117                 $myrow = db_fetch_row($result);
118                 if ($myrow[0] > 0) 
119                 {
120                         display_error(_("Cannot delete this payment term, because supplier accounts have been created referring to this term"));
121                 } 
122                 else 
123                 {
124                         //only delete if used in neither customer or supplier accounts
125
126                         $sql="DELETE FROM ".TB_PREF."payment_terms WHERE terms_indicator=".db_escape($selected_id);
127                         db_query($sql,"could not delete a payment terms");
128                         display_notification(_('Selected payment terms have been deleted'));
129                 }
130         }
131         //end if payment terms used in customer or supplier accounts
132         $Mode = 'RESET';
133 }
134
135 if ($Mode == 'RESET')
136 {
137         $selected_id = -1;
138         unset($_POST);
139 }
140 //-------------------------------------------------------------------------------------------------
141
142 $sql = "SELECT * FROM ".TB_PREF."payment_terms";
143 $result = db_query($sql,"could not get payment terms");
144 start_form();
145 start_table($table_style);
146 $th = array(_("Description"), _("Following Month On"), _("Due After (Days)"), "", "");
147 table_header($th);
148
149 $k = 0; //row colour counter
150 while ($myrow = db_fetch($result)) 
151 {
152         if ($myrow["day_in_following_month"] == 0) 
153         {
154                 $full_text = _("N/A");
155         } 
156         else 
157         {
158                 $full_text = $myrow["day_in_following_month"];
159         }
160
161         if ($myrow["days_before_due"] == 0) 
162         {
163                 $after_text = _("N/A");
164         } 
165         else 
166         {
167                 $after_text = $myrow["days_before_due"] . " " . _("days");
168         }
169
170         alt_table_row_color($k);
171
172     label_cell($myrow["terms"]);
173     label_cell($full_text);
174     label_cell($after_text);
175         edit_button_cell("Edit".$myrow["terms_indicator"], _("Edit"));
176         delete_button_cell("Delete".$myrow["terms_indicator"], _("Delete"));
177     end_row();
178
179
180 } //END WHILE LIST LOOP
181
182 end_table();
183 end_form();
184 echo '<br>';
185
186 //-------------------------------------------------------------------------------------------------
187
188 start_form();
189
190 start_table($table_style2);
191
192 $day_in_following_month = $days_before_due = 0;
193 if ($selected_id != -1) 
194 {
195         if ($Mode == 'Edit') {
196                 //editing an existing payment terms
197                 $sql = "SELECT * FROM ".TB_PREF."payment_terms
198                         WHERE terms_indicator=".db_escape($selected_id);
199
200                 $result = db_query($sql,"could not get payment term");
201                 $myrow = db_fetch($result);
202
203                 $_POST['terms']  = $myrow["terms"];
204                 $days_before_due  = $myrow["days_before_due"];
205                 $day_in_following_month  = $myrow["day_in_following_month"];
206         }
207         hidden('selected_id', $selected_id);
208 }
209 text_row(_("Terms Description:"), 'terms', null, 40, 40);
210
211 check_row(_("Due After A Given No. Of Days:"), 'DaysOrFoll', $day_in_following_month == 0);
212
213 if (!isset($_POST['DayNumber'])) 
214 {
215     if ($days_before_due != 0)
216         $_POST['DayNumber'] = $days_before_due;
217     else
218         $_POST['DayNumber'] = $day_in_following_month;
219 }
220
221 text_row_ex(_("Days (Or Day In Following Month):"), 'DayNumber', 3);
222
223 end_table(1);
224
225 submit_add_or_update_center($selected_id == -1, '', true);
226
227 end_form();
228
229 end_page();
230
231 ?>