Security statements update against sql injection attacks.
[fa-stable.git] / inventory / purchasing_data.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 4;
13 $path_to_root="..";
14 include_once($path_to_root . "/includes/session.inc");
15
16 page(_("Supplier Purchasing Data"));
17
18 include_once($path_to_root . "/includes/date_functions.inc");
19 include_once($path_to_root . "/includes/ui.inc");
20 include_once($path_to_root . "/includes/manufacturing.inc");
21 include_once($path_to_root . "/includes/data_checks.inc");
22
23 check_db_has_purchasable_items(_("There are no purchasable inventory items defined in the system."));
24 check_db_has_suppliers(_("There are no suppliers defined in the system."));
25
26 //----------------------------------------------------------------------------------------
27 if ($ret = context_restore()) {
28         if(isset($ret['supplier_id']))
29                 $_POST['supplier_id'] = $ret['supplier_id'];
30 }
31 if (isset($_POST['_supplier_id_editor'])) {
32         context_call($path_to_root.'/purchasing/manage/suppliers.php?supplier_id='.$_POST['supplier_id'], 
33                 array( 'supplier_id', 'stock_id','_stock_id_edit', 'price', 
34                         'suppliers_uom', 'supplier_description','conversion_factor'));
35 }
36 simple_page_mode(true);
37 //--------------------------------------------------------------------------------------------------
38
39 if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
40 {
41
42         $input_error = 0;
43         if ($_POST['stock_id'] == "" || !isset($_POST['stock_id']))
44         {
45         $input_error = 1;
46         display_error( _("There is no item selected."));
47         set_focus('stock_id');
48         }
49         elseif (!check_num('price', 0))
50         {
51         $input_error = 1;
52         display_error( _("The price entered was not numeric."));
53         set_focus('price');
54         }
55         elseif (!check_num('conversion_factor'))
56         {
57         $input_error = 1;
58         display_error( _("The conversion factor entered was not numeric. The conversion factor is the number by which the price must be divided by to get the unit price in our unit of measure."));
59                 set_focus('conversion_factor');
60         }
61
62         if ($input_error == 0)
63         {
64         if ($Mode == 'ADD_ITEM') 
65         {
66
67                 $sql = "INSERT INTO ".TB_PREF."purch_data (supplier_id, stock_id, price, suppliers_uom,
68                         conversion_factor, supplier_description) VALUES (";
69                 $sql .= db_escape($_POST['supplier_id']).", ".db_escape($_POST['stock_id']). ", "
70                         .input_num('price',0) . ", ".db_escape( $_POST['suppliers_uom'] ). ", "
71                         .input_num('conversion_factor') . ", "
72                         .db_escape($_POST['supplier_description']) . ")";
73
74                 db_query($sql,"The supplier purchasing details could not be added");
75                 display_notification(_("This supplier purchasing data has been added."));
76         } else
77         {
78                 $sql = "UPDATE ".TB_PREF."purch_data SET price=" . input_num('price',0) . ",
79                                 suppliers_uom=".db_escape($_POST['suppliers_uom']) . ",
80                                 conversion_factor=" . input_num('conversion_factor') . ",
81                                 supplier_description=" . db_escape($_POST['supplier_description']) . "
82                                 WHERE stock_id=".db_escape($_POST['stock_id']) . " AND
83                                 supplier_id=".db_escape($selected_id);
84                 db_query($sql,"The supplier purchasing details could not be updated");
85
86                 display_notification(_("Supplier purchasing data has been updated."));
87         }
88                 $Mode = 'RESET';
89         }
90 }
91
92 //--------------------------------------------------------------------------------------------------
93
94 if ($Mode == 'Delete')
95 {
96
97         $sql = "DELETE FROM ".TB_PREF."purch_data WHERE supplier_id=".db_escape($selected_id)."
98                 AND stock_id=".db_escape($_POST['stock_id']);
99         db_query($sql,"could not delete purchasing data");
100
101         display_notification(_("The purchasing data item has been sucessfully deleted."));
102         $Mode = 'RESET';
103 }
104
105 if ($Mode == 'RESET')
106 {
107         $selected_id = -1;
108 }
109
110 if (isset($_POST['_selected_id_update']) )
111 {
112         $selected_id = $_POST['selected_id'];
113         $Ajax->activate('_page_body');
114 }
115
116 if (list_updated('stock_id')) 
117         $Ajax->activate('price_table');
118 //--------------------------------------------------------------------------------------------------
119
120 start_form(false, true);
121
122 if (!isset($_POST['stock_id']))
123         $_POST['stock_id'] = get_global_stock_item();
124
125 echo "<center>" . _("Item:"). "&nbsp;";
126 stock_purchasable_items_list('stock_id', $_POST['stock_id'], false, true);
127
128 echo "<hr></center>";
129
130 set_global_stock_item($_POST['stock_id']);
131
132 $mb_flag = get_mb_flag($_POST['stock_id']);
133
134 if ($mb_flag == -1)
135 {
136         display_error(_("Entered item is not defined. Please re-enter."));
137         set_focus('stock_id');
138 }
139 else
140 {
141
142     $sql = "SELECT ".TB_PREF."purch_data.*,".TB_PREF."suppliers.supp_name,"
143         .TB_PREF."suppliers.curr_code
144                 FROM ".TB_PREF."purch_data INNER JOIN ".TB_PREF."suppliers
145                 ON ".TB_PREF."purch_data.supplier_id=".TB_PREF."suppliers.supplier_id
146                 WHERE stock_id = ".db_escape($_POST['stock_id']);
147
148     $result = db_query($sql, "The supplier purchasing details for the selected part could not be retrieved");
149   div_start('price_table');
150     if (db_num_rows($result) == 0)
151     {
152         display_note(_("There is no purchasing data set up for the part selected"));
153     }
154     else
155     {
156         start_table("$table_style width=65%");
157
158                 $th = array(_("Supplier"), _("Price"), _("Currency"),
159                         _("Supplier's Unit"), _("Conversion Factor"), _("Supplier's Description"), "", "");
160
161         table_header($th);
162
163         $k = $j = 0; //row colour counter
164
165         while ($myrow = db_fetch($result))
166         {
167                         alt_table_row_color($k);
168
169             label_cell($myrow["supp_name"]);
170             amount_decimal_cell($myrow["price"]);
171             label_cell($myrow["curr_code"]);
172             label_cell($myrow["suppliers_uom"]);
173             qty_cell($myrow['conversion_factor'], false, user_exrate_dec());
174             label_cell($myrow["supplier_description"]);
175                         edit_button_cell("Edit".$myrow['supplier_id'], _("Edit"));
176                         delete_button_cell("Delete".$myrow['supplier_id'], _("Delete"));
177             end_row();
178
179             $j++;
180             If ($j == 12)
181             {
182                 $j = 1;
183                         table_header($th);
184             } //end of page full new headings
185         } //end of while loop
186
187         end_table();
188     }
189  div_end();
190 }
191
192 //-----------------------------------------------------------------------------------------------
193
194 $dec2 = 6;
195 if ($Mode =='Edit')
196 {
197
198         $sql = "SELECT ".TB_PREF."purch_data.*,".TB_PREF."suppliers.supp_name FROM ".TB_PREF."purch_data
199                 INNER JOIN ".TB_PREF."suppliers ON ".TB_PREF."purch_data.supplier_id=".TB_PREF."suppliers.supplier_id
200                 WHERE ".TB_PREF."purch_data.supplier_id=".db_escape($selected_id)."
201                 AND ".TB_PREF."purch_data.stock_id=".db_escape($_POST['stock_id']);
202
203         $result = db_query($sql, "The supplier purchasing details for the selected supplier and item could not be retrieved");
204
205         $myrow = db_fetch($result);
206
207     $supp_name = $myrow["supp_name"];
208     $_POST['price'] = price_decimal_format($myrow["price"], $dec2);
209     $_POST['suppliers_uom'] = $myrow["suppliers_uom"];
210     $_POST['supplier_description'] = $myrow["supplier_description"];
211     $_POST['conversion_factor'] = exrate_format($myrow["conversion_factor"]);
212 }
213
214 br();
215 hidden('selected_id', $selected_id);
216 start_table($table_style2);
217
218 if ($Mode == 'Edit')
219 {
220         hidden('supplier_id');
221         label_row(_("Supplier:"), $supp_name);
222 }
223 else
224 {
225         supplier_list_row(_("Supplier:"), 'supplier_id', null, false, true);
226         $_POST['price'] = $_POST['suppliers_uom'] = $_POST['conversion_factor'] = $_POST['supplier_description'] = "";
227 }
228 amount_row(_("Price:"), 'price', null,'', get_supplier_currency($selected_id), $dec2);
229 text_row(_("Suppliers Unit of Measure:"), 'suppliers_uom', null, 50, 51);
230
231 if (!isset($_POST['conversion_factor']) || $_POST['conversion_factor'] == "")
232 {
233         $_POST['conversion_factor'] = exrate_format(1);
234 }
235 amount_row(_("Conversion Factor (to our UOM):"), 'conversion_factor',
236   exrate_format($_POST['conversion_factor']), null, null, user_exrate_dec() );
237 text_row(_("Supplier's Code or Description:"), 'supplier_description', null, 50, 51);
238
239 end_table(1);
240
241 submit_add_or_update_center($selected_id == -1, '', true);
242
243 end_form();
244 end_page();
245
246 ?>