Security update merged from 2.1.
[fa-stable.git] / purchasing / includes / db / po_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //----------------------------------------------------------------------------------------
13
14 function delete_po($po)
15 {
16         $sql = "DELETE FROM ".TB_PREF."purch_orders WHERE order_no=".db_escape($po);
17         db_query($sql, "The order header could not be deleted");
18
19         $sql = "DELETE FROM ".TB_PREF."purch_order_details WHERE order_no =".db_escape($po);
20         db_query($sql, "The order detail lines could not be deleted");
21 }
22
23 //----------------------------------------------------------------------------------------
24
25 function add_po(&$po_obj)
26 {
27         global $Refs;
28
29         begin_transaction();
30
31      /*Insert to purchase order header record */
32      $sql = "INSERT INTO ".TB_PREF."purch_orders (supplier_id, Comments, ord_date, reference, requisition_no, into_stock_location, delivery_address) VALUES(";
33      $sql .= db_escape($po_obj->supplier_id) . "," .
34          db_escape($po_obj->Comments) . ",'" .
35          date2sql($po_obj->orig_order_date) . "', " .
36                  db_escape($po_obj->reference) . ", " .
37          db_escape($po_obj->requisition_no) . ", " .
38          db_escape($po_obj->Location) . ", " .
39          db_escape($po_obj->delivery_address) . ")";
40
41         db_query($sql, "The purchase order header record could not be inserted");
42
43      /*Get the auto increment value of the order number created from the sql above */
44      $po_obj->order_no = db_insert_id();
45
46      /*Insert the purchase order detail records */
47      foreach ($po_obj->line_items as $po_line)
48      {
49         if ($po_line->Deleted == false)
50         {
51                 $sql = "INSERT INTO ".TB_PREF."purch_order_details (order_no, item_code, description, delivery_date,    unit_price,     quantity_ordered) VALUES (";
52                 $sql .= $po_obj->order_no . ", " . db_escape($po_line->stock_id). "," .
53                         db_escape($po_line->item_description). ",'" .
54                         date2sql($po_line->req_del_date) . "'," .
55                         db_escape($po_line->price) . ", " .
56                         db_escape($po_line->quantity). ")";
57                         db_query($sql, "One of the purchase order detail records could not be inserted");
58         }
59      }
60
61         $Refs->save(ST_PURCHORDER, $po_obj->order_no, $po_obj->reference);
62
63         //add_comments(ST_PURCHORDER, $po_obj->order_no, $po_obj->orig_order_date, $po_obj->Comments);
64
65         add_audit_trail(ST_PURCHORDER, $po_obj->order_no, $po_obj->orig_order_date);
66         commit_transaction();
67
68         return $po_obj->order_no;
69 }
70
71 //----------------------------------------------------------------------------------------
72
73 function update_po(&$po_obj)
74 {
75         begin_transaction();
76
77     /*Update the purchase order header with any changes */
78     $sql = "UPDATE ".TB_PREF."purch_orders SET Comments=" . db_escape($po_obj->Comments) . ",
79                 requisition_no= ". db_escape( $po_obj->requisition_no). ",
80                 into_stock_location=" . db_escape($po_obj->Location). ",
81                 ord_date='" . date2sql($po_obj->orig_order_date) . "',
82                 delivery_address=" . db_escape($po_obj->delivery_address);
83     $sql .= " WHERE order_no = " . $po_obj->order_no;
84         db_query($sql, "The purchase order could not be updated");
85
86     /*Now Update the purchase order detail records */
87     foreach ($po_obj->line_items as $po_line)
88     {
89
90                 if ($po_line->Deleted==True)
91                 {
92                         // Sherifoz 21.06.03 Handle deleting existing lines
93                         if ($po_line->po_detail_rec!='')
94                         {
95                                 $sql = "DELETE FROM ".TB_PREF."purch_order_details WHERE po_detail_item=".db_escape($po_line->po_detail_rec);
96                                 db_query($sql, "could not query purch order details");
97                         }
98                 }
99                 else if ($po_line->po_detail_rec == '')
100                 {
101                         // Sherifoz 21.06.03 Handle adding new lines vs. updating. if no key(po_detail_rec) then it's a new line
102                         $sql = "INSERT INTO ".TB_PREF."purch_order_details (order_no, item_code, description, delivery_date, unit_price,        quantity_ordered) VALUES (";
103                         $sql .= $po_obj->order_no . "," .
104                                 db_escape($po_line->stock_id). "," .
105                                 db_escape($po_line->item_description). ",'" .
106                                 date2sql($po_line->req_del_date) . "'," .
107                                 db_escape($po_line->price) . ", ".db_escape($po_line->quantity) . ")";
108                 }
109                 else
110                 {
111                         $sql = "UPDATE ".TB_PREF."purch_order_details SET item_code=".db_escape($po_line->stock_id).",
112                                 description =" . db_escape($po_line->item_description). ",
113                                 delivery_date ='" . date2sql($po_line->req_del_date) . "',
114                                 unit_price=".db_escape($po_line->price).",
115                                 quantity_ordered=".db_escape($po_line->quantity) . "
116                                 WHERE po_detail_item=".db_escape($po_line->po_detail_rec);
117                 }
118                 db_query($sql, "One of the purchase order detail records could not be updated");
119     }
120
121         //add_comments(ST_PURCHORDER, $po_obj->order_no, $po_obj->orig_order_date, $po_obj->Comments);
122
123         commit_transaction();
124
125         return $po_obj->order_no;
126 }
127
128 //----------------------------------------------------------------------------------------
129
130 function read_po_header($order_no, &$order)
131 {
132         $sql = "SELECT ".TB_PREF."purch_orders.*, ".TB_PREF."suppliers.supp_name,
133                 ".TB_PREF."suppliers.curr_code, ".TB_PREF."locations.location_name
134                 FROM ".TB_PREF."purch_orders, ".TB_PREF."suppliers, ".TB_PREF."locations
135                 WHERE ".TB_PREF."purch_orders.supplier_id = ".TB_PREF."suppliers.supplier_id
136                 AND ".TB_PREF."locations.loc_code = into_stock_location
137                 AND ".TB_PREF."purch_orders.order_no = ".db_escape($order_no);
138
139         $result = db_query($sql, "The order cannot be retrieved");
140
141         if (db_num_rows($result) == 1)
142         {
143
144         $myrow = db_fetch($result);
145
146         $order->order_no = $order_no;
147         $order->supplier_id = $myrow["supplier_id"];
148         $order->supplier_name = $myrow["supp_name"];
149         $order->curr_code = $myrow["curr_code"];
150
151         $order->orig_order_date = sql2date($myrow["ord_date"]);
152         $order->Comments = $myrow["comments"];
153         $order->Location = $myrow["into_stock_location"];
154         $order->requisition_no = $myrow["requisition_no"];
155         $order->reference = $myrow["reference"];
156         $order->delivery_address = $myrow["delivery_address"];
157
158         return true;
159         }
160
161         display_db_error("FATAL : duplicate purchase order found", "", true);
162         return false;
163 }
164
165 //----------------------------------------------------------------------------------------
166
167 function read_po_items($order_no, &$order, $open_items_only=false)
168 {
169         /*now populate the line po array with the purchase order details records */
170
171         $sql = "SELECT ".TB_PREF."purch_order_details.*, units
172                 FROM ".TB_PREF."purch_order_details
173                 LEFT JOIN ".TB_PREF."stock_master
174                 ON ".TB_PREF."purch_order_details.item_code=".TB_PREF."stock_master.stock_id
175                 WHERE order_no =".db_escape($order_no);
176
177     if ($open_items_only)
178                 $sql .= " AND (".TB_PREF."purch_order_details.quantity_ordered > ".TB_PREF."purch_order_details.quantity_received) ";
179
180         $sql .= " ORDER BY po_detail_item";
181
182         $result = db_query($sql, "The lines on the purchase order cannot be retrieved");
183
184     if (db_num_rows($result) > 0)
185     {
186
187                 while ($myrow = db_fetch($result))
188         {
189
190                 $data = get_purchase_data($order->supplier_id, $myrow['item_code']);
191                 if ($data !== false)
192                 {
193                         if ($data['supplier_description'] != "")
194                                 $myrow['description'] = $data['supplier_description'];
195                         //if ($data['suppliers_uom'] != "")
196                         //      $myrow['units'] = $data['suppliers_uom'];
197                 }               
198             if (is_null($myrow["units"]))
199             {
200                         $units = "";
201             }
202             else
203             {
204                 $units = $myrow["units"];
205             }
206
207             if ($order->add_to_order($order->lines_on_order+1, $myrow["item_code"],
208                 $myrow["quantity_ordered"],$myrow["description"],
209                 $myrow["unit_price"],$units, sql2date($myrow["delivery_date"]),
210                 $myrow["qty_invoiced"], $myrow["quantity_received"])) {
211                                         $order->line_items[$order->lines_on_order]->po_detail_rec = $myrow["po_detail_item"];
212                                         $order->line_items[$order->lines_on_order]->standard_cost = $myrow["std_cost_unit"];  /*Needed for receiving goods and GL interface */
213                         }
214         } /* line po from purchase order details */
215     } //end of checks on returned data set
216 }
217
218 //----------------------------------------------------------------------------------------
219
220 function read_po($order_no, &$order, $open_items_only=false)
221 {
222         $result = read_po_header($order_no, $order);
223
224         if ($result)
225                 read_po_items($order_no, $order, $open_items_only);
226 }
227
228 //----------------------------------------------------------------------------------------
229
230
231 ?>