Security statements update against sql injection attacks.
[fa-stable.git] / purchasing / manage / suppliers.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security=5;
13 $path_to_root="../..";
14 include($path_to_root . "/includes/session.inc");
15
16 page(_("Suppliers"));
17
18 //include($path_to_root . "/includes/date_functions.inc");
19
20 include($path_to_root . "/includes/ui.inc");
21
22 check_db_has_tax_groups(_("There are no tax groups defined in the system. At least one tax group is required before proceeding."));
23
24 if (isset($_GET['supplier_id'])) 
25 {
26         $_POST['supplier_id'] = $_GET['supplier_id'];
27 }
28 $new_supplier = get_post('supplier_id') == ''; 
29
30 if (isset($_POST['submit'])) 
31 {
32
33         //initialise no input errors assumed initially before we test
34         $input_error = 0;
35
36         /* actions to take once the user has clicked the submit button
37         ie the page has called itself with some user input */
38
39         //first off validate inputs sensible
40
41         if (strlen($_POST['supp_name']) == 0 || $_POST['supp_name'] == "") 
42         {
43                 $input_error = 1;
44                 display_error(_("The supplier name must be entered."));
45                 set_focus('supp_name');
46         }
47
48         if ($input_error !=1 )
49         {
50
51                 if (!$new_supplier) 
52                 {
53
54                         $sql = "UPDATE ".TB_PREF."suppliers SET supp_name=".db_escape($_POST['supp_name']) . ",
55                 address=".db_escape($_POST['address']) . ",
56                 supp_address=".db_escape($_POST['supp_address']) . ",
57                 phone=".db_escape($_POST['phone']) . ",
58                 fax=".db_escape($_POST['fax']) . ",
59                 gst_no=".db_escape($_POST['gst_no']) . ",
60                 email=".db_escape($_POST['email']) . ",
61                 website=".db_escape($_POST['website']) . ",
62                 contact=".db_escape($_POST['contact']) . ",
63                 supp_account_no=".db_escape($_POST['supp_account_no']) . ",
64                 bank_account=".db_escape($_POST['bank_account']) . ",
65                 credit_limit=".input_num('credit_limit', 0) . ",
66                 dimension_id=".db_escape($_POST['dimension_id']) . ",
67                 dimension2_id=".db_escape($_POST['dimension2_id']) . ",
68                 curr_code=".db_escape($_POST['curr_code']).",
69                 payment_terms=".db_escape($_POST['payment_terms']) . ",
70                                 payable_account=".db_escape($_POST['payable_account']) . ",
71                                 purchase_account=".db_escape($_POST['purchase_account']) . ",
72                                 payment_discount_account=".db_escape($_POST['payment_discount_account']) . ",
73                 notes=".db_escape($_POST['notes']) . ",
74                                 tax_group_id=".db_escape($_POST['tax_group_id']) . " WHERE supplier_id = ".db_escape($_POST['supplier_id']);
75
76                         db_query($sql,"The supplier could not be updated");
77                         display_notification(_("Supplier has been updated."));
78                 } 
79                 else 
80                 {
81
82                         $sql = "INSERT INTO ".TB_PREF."suppliers (supp_name, address, supp_address, phone, fax, gst_no, email, website,
83                                 contact, supp_account_no, bank_account, credit_limit, dimension_id, dimension2_id, curr_code,
84                                 payment_terms, payable_account, purchase_account, payment_discount_account, notes, tax_group_id)
85                                 VALUES (".db_escape($_POST['supp_name']). ", "
86                                 .db_escape($_POST['address']) . ", "
87                                 .db_escape($_POST['supp_address']) . ", "
88                                 .db_escape($_POST['phone']). ", "
89                                 .db_escape($_POST['fax']). ", "
90                                 .db_escape($_POST['gst_no']). ", "
91                                 .db_escape($_POST['email']). ", "
92                                 .db_escape($_POST['website']). ", "
93                                 .db_escape($_POST['contact']). ", "
94                                 .db_escape($_POST['supp_account_no']). ", "
95                                 .db_escape($_POST['bank_account']). ", "
96                                 .input_num('credit_limit',0). ", "
97                                 .db_escape($_POST['dimension_id']). ", "
98                                 .db_escape($_POST['dimension2_id']). ", "
99                                 .db_escape($_POST['curr_code']). ", "
100                                 .db_escape($_POST['payment_terms']). ", "
101                                 .db_escape($_POST['payable_account']). ", "
102                                 .db_escape($_POST['purchase_account']). ", "
103                                 .db_escape($_POST['payment_discount_account']). ", "
104                                 .db_escape($_POST['notes']). ", "
105                                 .db_escape($_POST['tax_group_id']). ")";
106
107                         db_query($sql,"The supplier could not be added");
108                         $_POST['supplier_id'] = db_insert_id();
109                         $new_supplier = false;
110                         display_notification(_("A new supplier has been added."));
111                         $Ajax->activate('_page_body');
112                 }
113         }
114
115
116 elseif (isset($_POST['delete']) && $_POST['delete'] != "") 
117 {
118         //the link to delete a selected record was clicked instead of the submit button
119
120         $cancel_delete = 0;
121
122         // PREVENT DELETES IF DEPENDENT RECORDS IN 'supp_trans' , purch_orders
123
124         $sql= "SELECT COUNT(*) FROM ".TB_PREF."supp_trans WHERE supplier_id=".db_escape($_POST['supplier_id']);
125         $result = db_query($sql,"check failed");
126         $myrow = db_fetch_row($result);
127         if ($myrow[0] > 0) 
128         {
129                 $cancel_delete = 1;
130                 display_error(_("Cannot delete this supplier because there are transactions that refer to this supplier."));
131
132         } 
133         else 
134         {
135                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."purch_orders WHERE supplier_id=".db_escape($_POST['supplier_id']);
136                 $result = db_query($sql,"check failed");
137                 $myrow = db_fetch_row($result);
138                 if ($myrow[0] > 0) 
139                 {
140                         $cancel_delete = 1;
141                         display_error(_("Cannot delete the supplier record because purchase orders have been created against this supplier."));
142                 }
143
144         }
145         if ($cancel_delete == 0) 
146         {
147                 $sql="DELETE FROM ".TB_PREF."suppliers WHERE supplier_id=".db_escape($_POST['supplier_id']);
148                 db_query($sql,"check failed");
149
150                 unset($_SESSION['supplier_id']);
151                 $new_supplier = true;
152                 $Ajax->activate('_page_body');
153         } //end if Delete supplier
154 }
155 elseif (isset($_POST['select']))
156 {
157         context_return(array('supplier_id' => $_POST['supplier_id']));
158 }
159
160 start_form();
161
162 if (db_has_suppliers()) 
163 {
164         start_table("", 3);
165 //      start_table("class = 'tablestyle_noborder'");
166         supplier_list_row(_("Select a supplier: "), 'supplier_id', null,
167                   _('New supplier'), true);
168         end_table();
169
170 else 
171 {
172         hidden('supplier_id', get_post('supplier_id'));
173 }
174
175 start_outer_table($table_style2, 5);
176
177 table_section(1);
178
179 if (!$new_supplier) 
180 {
181         //SupplierID exists - either passed when calling the form or from the form itself
182         $myrow = get_supplier($_POST['supplier_id']);
183
184         $_POST['supp_name'] = $myrow["supp_name"];
185         $_POST['address']  = $myrow["address"];
186         $_POST['supp_address']  = $myrow["supp_address"];
187         $_POST['phone']  = $myrow["phone"];
188         $_POST['fax']  = $myrow["fax"];
189         $_POST['gst_no']  = $myrow["gst_no"];
190         $_POST['email']  = $myrow["email"];
191         $_POST['website']  = $myrow["website"];
192         $_POST['contact']  = $myrow["contact"];
193         $_POST['supp_account_no']  = $myrow["supp_account_no"];
194         $_POST['bank_account']  = $myrow["bank_account"];
195         $_POST['dimension_id']  = $myrow["dimension_id"];
196         $_POST['dimension2_id']  = $myrow["dimension2_id"];
197         $_POST['curr_code']  = $myrow["curr_code"];
198         $_POST['payment_terms']  = $myrow["payment_terms"];
199         $_POST['credit_limit']  = price_format($myrow["credit_limit"]);
200         $_POST['tax_group_id'] = $myrow["tax_group_id"];
201         $_POST['payable_account']  = $myrow["payable_account"];
202         $_POST['purchase_account']  = $myrow["purchase_account"];
203         $_POST['payment_discount_account'] = $myrow["payment_discount_account"];
204         $_POST['notes']  = $myrow["notes"];
205
206
207 else 
208 {
209         $_POST['supp_name'] = $_POST['address'] = $_POST['supp_address'] = $_POST['tax_group_id']  = 
210                 $_POST['website'] = $_POST['supp_account_no'] = $_POST['notes'] = '';
211         $_POST['dimension_id'] = 0;
212         $_POST['dimension2_id'] = 0;
213         $_POST['sales_type'] = -1;
214         $_POST['email'] = $_POST['phone'] = $_POST['fax'] = $_POST['gst_no'] = $_POST['contact'] = $_POST['bank_account'] = '';
215         $_POST['payment_terms']  = '';
216         $_POST['credit_limit']  = price_format(0);
217
218         $company_record = get_company_prefs();
219         $_POST['curr_code']  = $company_record["curr_default"];
220         $_POST['payable_account'] = $company_record["creditors_act"];
221         $_POST['purchase_account'] = $company_record["default_cogs_act"];
222         $_POST['payment_discount_account'] = $company_record['pyt_discount_act'];
223 }
224
225 table_section_title(_("Name and Contact"));
226
227 text_row(_("Supplier Name:"), 'supp_name', null, 42, 40);
228 text_row(_("Contact Person:"), 'contact', null, 42, 40);
229
230 text_row(_("Phone Number:"), 'phone', null, 42, 40);
231 text_row(_("Fax Number:"), 'fax', null, 42, 40);
232
233 email_row(_("E-mail:"), 'email', null, 35, 55);
234 link_row(_("Website:"), 'website', null, 35, 55);
235 text_row(_("Our Customer No:"), 'supp_account_no', null, 42, 40);
236
237 table_section_title(_("Addresses"));
238 textarea_row(_("Mailing Address:"), 'address', null, 35, 5);
239 textarea_row(_("Physical Address:"), 'supp_address', null, 35, 5);
240
241 table_section(2);
242
243 table_section_title(_("Purchasing"));
244 text_row(_("GSTNo:"), 'gst_no', null, 42, 40);
245 text_row(_("Bank Name/Account:"), 'bank_account', null, 42, 40);
246 amount_row(_("Credit Limit:"), 'credit_limit', null);
247 if (!$new_supplier) 
248 {
249         label_row(_("Supplier's Currency:"), $_POST['curr_code']);
250         hidden('curr_code', $_POST['curr_code']);
251
252 else 
253 {
254         currencies_list_row(_("Supplier's Currency:"), 'curr_code', null);
255 }
256
257 tax_groups_list_row(_("Tax Group:"), 'tax_group_id', null);
258
259 payment_terms_list_row(_("Payment Terms:"), 'payment_terms', null);
260
261 table_section_title(_("Accounts"));
262
263 gl_all_accounts_list_row(_("Accounts Payable Account:"), 'payable_account', $_POST['payable_account']);
264
265 gl_all_accounts_list_row(_("Purchase Account:"), 'purchase_account', $_POST['purchase_account']);
266
267 gl_all_accounts_list_row(_("Purchase Discount Account:"), 'payment_discount_account', $_POST['payment_discount_account']);
268
269 $dim = get_company_pref('use_dimension');
270 if ($dim >= 1)
271 {
272         table_section_title(_("Dimension"));
273
274         dimensions_list_row(_("Dimension")." 1:", 'dimension_id', null, true, " ", false, 1);
275         if ($dim > 1)
276                 dimensions_list_row(_("Dimension")." 2:", 'dimension2_id', null, true, " ", false, 2);
277 }
278 if ($dim < 1)
279         hidden('dimension_id', 0);
280 if ($dim < 2)
281         hidden('dimension2_id', 0);
282 table_section_title(_("General"));
283 textarea_row(_("General Notes:"), 'notes', null, 35, 5);
284
285 end_outer_table(1);
286
287 div_start('controls');
288 if (!$new_supplier) 
289 {
290         submit_center_first('submit', _("Update Supplier"), 
291           _('Update supplier data'), true);
292         submit_return('select', _("Return"), _("Select this supplier and return to document entry."), true);
293         submit_center_last('delete', _("Delete Supplier"), 
294           _('Delete supplier data if have been never used'), true);
295 }
296 else 
297 {
298         submit_center('submit', _("Add New Supplier Details"), true, '', true);
299 }
300 div_end();
301 end_form();
302
303 end_page();
304
305 ?>