Security update merged from 2.1.
[fa-stable.git] / admin / view_print_transaction.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 'SA_VIEWPRINTTRANSACTION';
13 $path_to_root = "..";
14
15 include($path_to_root . "/includes/db_pager.inc");
16 include_once($path_to_root . "/includes/session.inc");
17
18 include_once($path_to_root . "/includes/date_functions.inc");
19 include_once($path_to_root . "/includes/ui.inc");
20 include_once($path_to_root . "/includes/data_checks.inc");
21
22 include_once($path_to_root . "/reporting/includes/reporting.inc");
23 $js = "";
24 if ($use_popup_windows)
25         $js .= get_js_open_window(800, 500);
26 page(_("View or Print Transactions"), false, false, "", $js);
27
28 //----------------------------------------------------------------------------------------
29 function view_link($trans)
30 {
31         return get_trans_view_str($trans["type"], $trans["trans_no"]);
32 }
33
34 function prt_link($row)
35 {
36         if ($row['type'] != ST_CUSTPAYMENT && $row['type'] != ST_BANKDEPOSIT) // customer payment or bank deposit printout not defined yet.
37                 return print_document_link($row['trans_no'], _("Print"), true, $row['type'], ICON_PRINT);
38 }
39
40 function gl_view($row)
41 {
42         return get_gl_view_str($row["type"], $row["trans_no"]);
43 }
44
45 function viewing_controls()
46 {
47         display_note(_("Only documents can be printed."));
48
49     start_table("class='tablestyle_noborder'");
50         start_row();
51
52         systypes_list_cells(_("Type:"), 'filterType', null, true);
53
54         if (!isset($_POST['FromTransNo']))
55                 $_POST['FromTransNo'] = "1";
56         if (!isset($_POST['ToTransNo']))
57                 $_POST['ToTransNo'] = "999999";
58
59     ref_cells(_("from #:"), 'FromTransNo');
60
61     ref_cells(_("to #:"), 'ToTransNo');
62
63     submit_cells('ProcessSearch', _("Search"), '', '', 'default');
64
65         end_row();
66     end_table(1);
67
68 }
69
70 //----------------------------------------------------------------------------------------
71
72 function check_valid_entries()
73 {
74         if (!is_numeric($_POST['FromTransNo']) OR $_POST['FromTransNo'] <= 0)
75         {
76                 display_error(_("The starting transaction number is expected to be numeric and greater than zero."));
77                 return false;
78         }
79
80         if (!is_numeric($_POST['ToTransNo']) OR $_POST['ToTransNo'] <= 0)
81         {
82                 display_error(_("The ending transaction number is expected to be numeric and greater than zero."));
83                 return false;
84         }
85
86         return true;
87 }
88
89 //----------------------------------------------------------------------------------------
90
91 function handle_search()
92 {
93         global $table_style;
94         if (check_valid_entries()==true)
95         {
96                 $db_info = get_systype_db_info($_POST['filterType']);
97
98                 if ($db_info == null)
99                         return;
100
101                 $table_name = $db_info[0];
102                 $type_name = $db_info[1];
103                 $trans_no_name = $db_info[2];
104                 $trans_ref = $db_info[3];
105
106                 $sql = "SELECT DISTINCT $trans_no_name as trans_no";
107
108                 if ($trans_ref)
109                         $sql .= " ,$trans_ref ";
110
111                 $sql .= ", ".$_POST['filterType']." as type FROM $table_name
112                         WHERE $trans_no_name >= ".db_escape($_POST['FromTransNo']). "
113                         AND  $trans_no_name <= ".db_escape($_POST['ToTransNo']);
114
115                 if ($type_name != null)
116                         $sql .= " AND `$type_name` = ".db_escape($_POST['filterType']);
117
118                 $sql .= " ORDER BY $trans_no_name";
119
120
121                 $print_type = $_POST['filterType'];
122                 $print_out = ($print_type == ST_SALESINVOICE || $print_type == ST_CUSTCREDIT || $print_type == ST_CUSTDELIVERY ||
123                         $print_type == ST_PURCHORDER || $print_type == ST_SALESORDER || $print_type == ST_SALESQUOTE);
124
125                 $cols = array(
126                         _("#"), 
127                         _("Reference"), 
128                         _("View") => array('insert'=>true, 'fun'=>'view_link'),
129                         _("Print") => array('insert'=>true, 'fun'=>'prt_link'), 
130                         _("GL") => array('insert'=>true, 'fun'=>'gl_view')
131                 );
132                 if(!$print_out) {
133                         array_remove($cols, 3);
134                 }
135                 if(!$trans_ref) {
136                         array_remove($cols, 1);
137                 }
138
139                 $table =& new_db_pager('transactions', $sql, $cols);
140                 $table->width = "40%";
141                 display_db_pager($table);
142         }
143
144 }
145
146 //----------------------------------------------------------------------------------------
147
148 if (isset($_POST['ProcessSearch']))
149 {
150         if (!check_valid_entries())
151                 unset($_POST['ProcessSearch']);
152         $Ajax->activate('transactions');
153 }
154
155 //----------------------------------------------------------------------------------------
156
157 start_form(false);
158         viewing_controls();
159         handle_search();
160 end_form(2);
161
162 end_page();
163
164 ?>