Security sql statements update against sql injection attacks.
[fa-stable.git] / sales / customer_payments.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $path_to_root="..";
13 $page_security = 3;
14 include_once($path_to_root . "/includes/session.inc");
15 include_once($path_to_root . "/includes/date_functions.inc");
16 include_once($path_to_root . "/includes/ui.inc");
17 include_once($path_to_root . "/includes/banking.inc");
18 include_once($path_to_root . "/includes/data_checks.inc");
19 include_once($path_to_root . "/sales/includes/sales_db.inc");
20
21 $js = "";
22 if ($use_popup_windows) {
23         $js .= get_js_open_window(900, 500);
24 }
25 if ($use_date_picker) {
26         $js .= get_js_date_picker();
27 }
28 page(_("Customer Payment Entry"), false, false, "", $js);
29
30 //----------------------------------------------------------------------------------------------
31
32 check_db_has_customers(_("There are no customers defined in the system."));
33
34 check_db_has_bank_accounts(_("There are no bank accounts defined in the system."));
35
36 //----------------------------------------------------------------------------------------
37 if ($ret = context_restore()) {
38         if(isset($ret['customer_id']))
39                 $_POST['customer_id'] = $ret['customer_id'];
40         if(isset($ret['branch_id']))
41                 $_POST['BranchID'] = $ret['branch_id'];
42 }
43 if (isset($_POST['_customer_id_editor'])) {
44         context_call($path_to_root.'/sales/manage/customers.php?debtor_no='.$_POST['customer_id'], 
45                 array( 'customer_id', 'BranchID', 'bank_account', 'DateBanked', 
46                         'ref', 'amount', 'discount', 'memo_') );
47 }
48
49 if (isset($_GET['AddedID'])) {
50         $payment_no = $_GET['AddedID'];
51
52         display_notification_centered(_("The customer payment has been successfully entered."));
53
54         display_note(get_gl_view_str(12, $payment_no, _("&View the GL Journal Entries for this Customer Payment")));
55
56         hyperlink_params($path_to_root . "/sales/allocations/customer_allocate.php", _("&Allocate this Customer Payment"), "trans_no=$payment_no&trans_type=12");
57
58         hyperlink_no_params($path_to_root . "/sales/customer_payments.php", _("Enter Another &Customer Payment"));
59         br(1);
60         end_page();
61         exit;
62 }
63
64 //----------------------------------------------------------------------------------------------
65
66 function can_process()
67 {
68         if (!isset($_POST['DateBanked']) || !is_date($_POST['DateBanked'])) {
69                 display_error(_("The entered date is invalid. Please enter a valid date for the payment."));
70                 set_focus('DateBanked');
71                 return false;
72         } elseif (!is_date_in_fiscalyear($_POST['DateBanked'])) {
73                 display_error(_("The entered date is not in fiscal year."));
74                 set_focus('DateBanked');
75                 return false;
76         }
77
78         if (!references::is_valid($_POST['ref'])) {
79                 display_error(_("You must enter a reference."));
80                 set_focus('ref');
81                 return false;
82         }
83
84         if (!is_new_reference($_POST['ref'], 12)) {
85                 display_error(_("The entered reference is already in use."));
86                 set_focus('ref');
87                 return false;
88         }
89
90         if (!check_num('amount', 0)) {
91                 display_error(_("The entered amount is invalid or negative and cannot be processed."));
92                 set_focus('amount');
93                 return false;
94         }
95
96         if (isset($_POST['_ex_rate']) && !check_num('_ex_rate', 0.000001))
97         {
98                 display_error(_("The exchange rate must be numeric and greater than zero."));
99                 set_focus('_ex_rate');
100                 return false;
101         }
102
103         if ($_POST['discount'] == "") 
104         {
105                 $_POST['discount'] = 0;
106         }
107
108         if (!check_num('discount')) {
109                 display_error(_("The entered discount is not a valid number."));
110                 set_focus('discount');
111                 return false;
112         }
113
114         if ((input_num('amount') - input_num('discount') <= 0)) {
115                 display_error(_("The balance of the amount and discout is zero or negative. Please enter valid amounts."));
116                 set_focus('discount');
117                 return false;
118         }
119
120         return true;
121 }
122
123 //----------------------------------------------------------------------------------------------
124
125 // validate inputs
126 if (isset($_POST['AddPaymentItem'])) {
127
128         if (!can_process()) {
129                 unset($_POST['AddPaymentItem']);
130         }
131 }
132 if (isset($_POST['_customer_id_button'])) {
133 //      unset($_POST['branch_id']);
134         $Ajax->activate('BranchID');
135 }
136 if (isset($_POST['_DateBanked_changed'])) {
137   $Ajax->activate('_ex_rate');
138 }
139 //----------------------------------------------------------------------------------------------
140
141 if (isset($_POST['AddPaymentItem'])) {
142         
143         $cust_currency = get_customer_currency($_POST['customer_id']);
144         $bank_currency = get_bank_account_currency($_POST['bank_account']);
145         $comp_currency = get_company_currency();
146         if ($comp_currency != $bank_currency && $bank_currency != $cust_currency)
147                 $rate = 0;
148         else
149                 $rate = input_num('_ex_rate');
150
151         $payment_no = write_customer_payment(0, $_POST['customer_id'], $_POST['BranchID'],
152                 $_POST['bank_account'], $_POST['DateBanked'], $_POST['ref'],
153                 input_num('amount'), input_num('discount'), $_POST['memo_'], $rate);
154         meta_forward($_SERVER['PHP_SELF'], "AddedID=$payment_no");
155 }
156
157 //----------------------------------------------------------------------------------------------
158
159 function read_customer_data()
160 {
161         $sql = "SELECT ".TB_PREF."debtors_master.pymt_discount,
162                 ".TB_PREF."credit_status.dissallow_invoices
163                 FROM ".TB_PREF."debtors_master, ".TB_PREF."credit_status
164                 WHERE ".TB_PREF."debtors_master.credit_status = ".TB_PREF."credit_status.id
165                         AND ".TB_PREF."debtors_master.debtor_no = ".db_escape($_POST['customer_id']);
166
167         $result = db_query($sql, "could not query customers");
168
169         $myrow = db_fetch($result);
170
171         $_POST['HoldAccount'] = $myrow["dissallow_invoices"];
172         $_POST['pymt_discount'] = $myrow["pymt_discount"];
173         $_POST['ref'] = references::get_next(12);
174 }
175
176 //-------------------------------------------------------------------------------------------------
177
178 function display_item_form()
179 {
180         global $table_style2;
181
182         start_outer_table($table_style2, 5);
183         table_section(1);
184
185         if (!isset($_POST['customer_id']))
186                 $_POST['customer_id'] = get_global_customer(false);
187         if (!isset($_POST['DateBanked'])) {
188                 $_POST['DateBanked'] = Today();
189                 if (!is_date_in_fiscalyear($_POST['DateBanked'])) {
190                         $_POST['DateBanked'] = end_fiscalyear();
191                 }
192         }
193         customer_list_row(_("From Customer:"), 'customer_id', null, false, true);
194         if (db_customer_has_branches($_POST['customer_id'])) {
195                 customer_branches_list_row(_("Branch:"), $_POST['customer_id'], 'BranchID', null, false, true, true);
196         } else {
197                 hidden('BranchID', reserved_words::get_any_numeric());
198         }
199
200         read_customer_data();
201
202         set_global_customer($_POST['customer_id']);
203         if (isset($_POST['HoldAccount']) && $_POST['HoldAccount'] != 0) {
204                 end_outer_table();
205                 display_error(_("This customer account is on hold."));
206         } else {
207                 $display_discount_percent = percent_format($_POST['pymt_discount']*100) . "%";
208
209                 amount_row(_("Amount:"), 'amount');
210
211                 amount_row(_("Amount of Discount:"), 'discount');
212
213                 label_row(_("Customer prompt payment discount :"), $display_discount_percent);
214
215                 date_row(_("Date of Deposit:"), 'DateBanked','',null, 0, 0, 0, null, true);
216
217                 table_section(2);
218
219                 bank_accounts_list_row(_("Into Bank Account:"), 'bank_account', null, true);
220
221                 $comp_currency = get_company_currency();
222                 $cust_currency = get_customer_currency($_POST['customer_id']);
223                 $bank_currency = get_bank_account_currency($_POST['bank_account']);
224
225                 if ($cust_currency != $bank_currency) {
226                         exchange_rate_display($bank_currency, $cust_currency, $_POST['DateBanked'], ($bank_currency == $comp_currency));
227                 }
228
229                 text_row(_("Reference:"), 'ref', null, 20, 40);
230
231                 textarea_row(_("Memo:"), 'memo_', null, 22, 4);
232
233                 end_outer_table(1);
234
235                 if ($cust_currency != $bank_currency)
236                         display_note(_("Amount and discount are in customer's currency."));
237
238                 echo"<br>";
239
240                 submit_center('AddPaymentItem', _("Add Payment"), true, '', true);
241         }
242
243         echo "<br>";
244 }
245
246 //----------------------------------------------------------------------------------------------
247
248 start_form();
249
250 display_item_form();
251
252 end_form();
253 end_page();
254 ?>