Security update merged from 2.1.
[fa-stable.git] / inventory / purchasing_data.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 'SA_PURCHASEPRICING';
13 $path_to_root = "..";
14 include_once($path_to_root . "/includes/session.inc");
15
16 page(_("Supplier Purchasing Data"));
17
18 include_once($path_to_root . "/includes/date_functions.inc");
19 include_once($path_to_root . "/includes/ui.inc");
20 include_once($path_to_root . "/includes/manufacturing.inc");
21 include_once($path_to_root . "/includes/data_checks.inc");
22
23 check_db_has_purchasable_items(_("There are no purchasable inventory items defined in the system."));
24 check_db_has_suppliers(_("There are no suppliers defined in the system."));
25
26 //----------------------------------------------------------------------------------------
27 simple_page_mode(true);
28
29 //--------------------------------------------------------------------------------------------------
30
31 if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
32 {
33
34         $input_error = 0;
35         if ($_POST['stock_id'] == "" || !isset($_POST['stock_id']))
36         {
37         $input_error = 1;
38         display_error( _("There is no item selected."));
39         set_focus('stock_id');
40         }
41         elseif (!check_num('price', 0))
42         {
43         $input_error = 1;
44         display_error( _("The price entered was not numeric."));
45         set_focus('price');
46         }
47         elseif (!check_num('conversion_factor'))
48         {
49         $input_error = 1;
50         display_error( _("The conversion factor entered was not numeric. The conversion factor is the number by which the price must be divided by to get the unit price in our unit of measure."));
51                 set_focus('conversion_factor');
52         }
53
54         if ($input_error == 0)
55         {
56         if ($Mode == 'ADD_ITEM') 
57         {
58
59                 $sql = "INSERT INTO ".TB_PREF."purch_data (supplier_id, stock_id, price, suppliers_uom,
60                         conversion_factor, supplier_description) VALUES (";
61                 $sql .= db_escape($_POST['supplier_id']).", ".db_escape($_POST['stock_id']). ", "
62                         .input_num('price',0) . ", ".db_escape( $_POST['suppliers_uom'] ). ", "
63                         .input_num('conversion_factor') . ", "
64                         .db_escape($_POST['supplier_description']) . ")";
65
66                 db_query($sql,"The supplier purchasing details could not be added");
67                 display_notification(_("This supplier purchasing data has been added."));
68         } else
69         {
70                 $sql = "UPDATE ".TB_PREF."purch_data SET price=" . input_num('price',0) . ",
71                                 suppliers_uom=".db_escape($_POST['suppliers_uom']) . ",
72                                 conversion_factor=" . input_num('conversion_factor') . ",
73                                 supplier_description=" . db_escape($_POST['supplier_description']) . "
74                                 WHERE stock_id=".db_escape($_POST['stock_id']) . " AND
75                                 supplier_id=".db_escape($selected_id);
76                 db_query($sql,"The supplier purchasing details could not be updated");
77
78                 display_notification(_("Supplier purchasing data has been updated."));
79         }
80                 $Mode = 'RESET';
81         }
82 }
83
84 //--------------------------------------------------------------------------------------------------
85
86 if ($Mode == 'Delete')
87 {
88
89         $sql = "DELETE FROM ".TB_PREF."purch_data WHERE supplier_id=".db_escape($selected_id)."
90                 AND stock_id=".db_escape($_POST['stock_id']);
91         db_query($sql,"could not delete purchasing data");
92
93         display_notification(_("The purchasing data item has been sucessfully deleted."));
94         $Mode = 'RESET';
95 }
96
97 if ($Mode == 'RESET')
98 {
99         $selected_id = -1;
100 }
101
102 if (isset($_POST['_selected_id_update']) )
103 {
104         $selected_id = $_POST['selected_id'];
105         $Ajax->activate('_page_body');
106 }
107
108 if (list_updated('stock_id')) 
109         $Ajax->activate('price_table');
110 //--------------------------------------------------------------------------------------------------
111
112 start_form();
113
114 if (!isset($_POST['stock_id']))
115         $_POST['stock_id'] = get_global_stock_item();
116
117 echo "<center>" . _("Item:"). "&nbsp;";
118 stock_purchasable_items_list('stock_id', $_POST['stock_id'], false, true);
119
120 echo "<hr></center>";
121
122 set_global_stock_item($_POST['stock_id']);
123
124 $mb_flag = get_mb_flag($_POST['stock_id']);
125
126 if ($mb_flag == -1)
127 {
128         display_error(_("Entered item is not defined. Please re-enter."));
129         set_focus('stock_id');
130 }
131 else
132 {
133
134     $sql = "SELECT ".TB_PREF."purch_data.*,".TB_PREF."suppliers.supp_name,"
135         .TB_PREF."suppliers.curr_code
136                 FROM ".TB_PREF."purch_data INNER JOIN ".TB_PREF."suppliers
137                 ON ".TB_PREF."purch_data.supplier_id=".TB_PREF."suppliers.supplier_id
138                 WHERE stock_id = ".db_escape($_POST['stock_id']);
139
140     $result = db_query($sql, "The supplier purchasing details for the selected part could not be retrieved");
141   div_start('price_table');
142     if (db_num_rows($result) == 0)
143     {
144         display_note(_("There is no purchasing data set up for the part selected"));
145     }
146     else
147     {
148         start_table("$table_style width=65%");
149
150                 $th = array(_("Supplier"), _("Price"), _("Currency"),
151                         _("Supplier's Unit"), _("Conversion Factor"), _("Supplier's Description"), "", "");
152
153         table_header($th);
154
155         $k = $j = 0; //row colour counter
156
157         while ($myrow = db_fetch($result))
158         {
159                         alt_table_row_color($k);
160
161             label_cell($myrow["supp_name"]);
162             amount_decimal_cell($myrow["price"]);
163             label_cell($myrow["curr_code"]);
164             label_cell($myrow["suppliers_uom"]);
165             qty_cell($myrow['conversion_factor'], false, user_exrate_dec());
166             label_cell($myrow["supplier_description"]);
167                         edit_button_cell("Edit".$myrow['supplier_id'], _("Edit"));
168                         delete_button_cell("Delete".$myrow['supplier_id'], _("Delete"));
169             end_row();
170
171             $j++;
172             If ($j == 12)
173             {
174                 $j = 1;
175                         table_header($th);
176             } //end of page full new headings
177         } //end of while loop
178
179         end_table();
180     }
181  div_end();
182 }
183
184 //-----------------------------------------------------------------------------------------------
185
186 $dec2 = 6;
187 if ($Mode =='Edit')
188 {
189
190         $sql = "SELECT ".TB_PREF."purch_data.*,".TB_PREF."suppliers.supp_name FROM ".TB_PREF."purch_data
191                 INNER JOIN ".TB_PREF."suppliers ON ".TB_PREF."purch_data.supplier_id=".TB_PREF."suppliers.supplier_id
192                 WHERE ".TB_PREF."purch_data.supplier_id=".db_escape($selected_id)."
193                 AND ".TB_PREF."purch_data.stock_id=".db_escape($_POST['stock_id']);
194
195         $result = db_query($sql, "The supplier purchasing details for the selected supplier and item could not be retrieved");
196
197         $myrow = db_fetch($result);
198
199     $supp_name = $myrow["supp_name"];
200     $_POST['price'] = price_decimal_format($myrow["price"], $dec2);
201     $_POST['suppliers_uom'] = $myrow["suppliers_uom"];
202     $_POST['supplier_description'] = $myrow["supplier_description"];
203     $_POST['conversion_factor'] = exrate_format($myrow["conversion_factor"]);
204 }
205
206 br();
207 hidden('selected_id', $selected_id);
208 start_table($table_style2);
209
210 if ($Mode == 'Edit')
211 {
212         hidden('supplier_id');
213         label_row(_("Supplier:"), $supp_name);
214 }
215 else
216 {
217         supplier_list_row(_("Supplier:"), 'supplier_id', null, false, true);
218         $_POST['price'] = $_POST['suppliers_uom'] = $_POST['conversion_factor'] = $_POST['supplier_description'] = "";
219 }
220 amount_row(_("Price:"), 'price', null,'', get_supplier_currency($selected_id), $dec2);
221 text_row(_("Suppliers Unit of Measure:"), 'suppliers_uom', null, 50, 51);
222
223 if (!isset($_POST['conversion_factor']) || $_POST['conversion_factor'] == "")
224 {
225         $_POST['conversion_factor'] = exrate_format(1);
226 }
227 amount_row(_("Conversion Factor (to our UOM):"), 'conversion_factor',
228   exrate_format($_POST['conversion_factor']), null, null, user_exrate_dec() );
229 text_row(_("Supplier's Code or Description:"), 'supplier_description', null, 50, 51);
230
231 end_table(1);
232
233 submit_add_or_update_center($selected_id == -1, '', 'both');
234
235 end_form();
236 end_page();
237
238 ?>