Security sql statements update against sql injection attacks.
[fa-stable.git] / sales / includes / db / cust_trans_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //------------------------------------------------------------------------------
13 //      Retreive parent document number(s) for given transaction
14 //
15 function get_parent_trans($trans_type, $trans_no) {
16
17         $sql = 'SELECT trans_link FROM
18                         '.TB_PREF.'debtor_trans WHERE
19                         (trans_no='.db_escape($trans_no).' AND type='.db_escape($trans_type).' AND trans_link!=0)';
20
21         $result = db_query($sql, 'Parent document numbers cannot be retrieved');
22
23         if (db_num_rows($result)) {
24                 $link = db_fetch($result);
25                 return array($link['trans_link']);
26         }
27         if ($trans_type!=10) return 0;  // this is credit note with no parent invoice
28         // invoice: find batch invoice parent trans.
29         $sql = 'SELECT trans_no FROM
30                         '.TB_PREF.'debtor_trans WHERE
31                         (trans_link='.db_escape($trans_no).' AND type='. get_parent_type($trans_type) .')';
32
33         $result = db_query($sql, 'Delivery links cannot be retrieved');
34
35         $delivery = array();
36         if(db_num_rows($result)>0) {
37                 while($link = db_fetch($result)) {
38                         $delivery[] = $link['trans_no'];
39                 }
40         }
41         return count($delivery) ? $delivery : 0;
42 }
43
44 //----------------------------------------------------------------------------------------
45 // Mark changes in debtor_trans_details
46 //
47 function update_customer_trans_version($type, $versions) {
48
49         $sql= 'UPDATE '.TB_PREF. 'debtor_trans SET version=version+1
50                         WHERE type='.db_escape($type).' AND (';
51
52         foreach ($versions as $trans_no=>$version)
53                 $where[] =      '(trans_no='.db_escape($trans_no).' AND version='.$version.')';
54
55                 $sql .= implode(' OR ', $where) .')';
56
57         return  db_query($sql, 'Concurrent editing conflict');
58 }
59
60 //----------------------------------------------------------------------------------------
61 // Gets document header versions for transaction set of type $type
62 // $trans_no = array(num1, num2,...);
63 // returns array(num1=>ver1, num2=>ver2...)
64 //
65 function get_customer_trans_version($type, $trans_no) {
66         if (!is_array($trans_no))
67                 $trans_no = array( $trans_no );
68
69         $sql= 'SELECT trans_no, version FROM '.TB_PREF. 'debtor_trans
70                         WHERE type='.db_escape($type).' AND (';
71
72         foreach ($trans_no as $key=>$trans)
73                 $trans_no[$key] =       'trans_no='.$trans_no[$key];
74
75         $sql .= implode(' OR ', $trans_no) . ')';
76
77         $res = db_query($sql, 'document version retreival');
78
79         $vers = array();
80         while($mysql=db_fetch($res)) {
81                 $vers[$mysql['trans_no']] = $mysql['version'];
82         }
83         return $vers;
84 }
85 //----------------------------------------------------------------------------------------
86 // $Total, $Tax, $Freight, $discount all in customer's currency
87 // date_ is display date (non-sql)
88 function write_customer_trans($trans_type, $trans_no, $debtor_no, $BranchNo,
89         $date_, $reference, $Total, $discount=0, $Tax=0, $Freight=0, $FreightTax=0,
90         $sales_type=0, $order_no=0, $trans_link=0, $ship_via=0, $due_date="",
91         $AllocAmt=0, $rate=0, $dimension_id=0, $dimension2_id=0)
92 {
93
94         $curr = get_customer_currency($debtor_no);
95         if ($rate == 0)
96                 $rate = get_exchange_rate_from_home_currency($curr, $date_);
97
98         $SQLDate = date2sql($date_);
99         if ($due_date == "")
100                 $SQLDueDate = "000-00-00";
101         else
102                 $SQLDueDate = date2sql($due_date);
103         
104         if ($trans_type == systypes::bank_payment())
105                 $Total = -$Total;
106         if ($trans_no==0) {
107         $trans_no = get_next_trans_no($trans_type);
108
109         $sql = "INSERT INTO ".TB_PREF."debtor_trans (
110                 trans_no, type,
111                 debtor_no, branch_code,
112                 tran_date, due_date,
113                 reference, tpe,
114                 order_, ov_amount, ov_discount,
115                 ov_gst, ov_freight, ov_freight_tax,
116                 rate, ship_via, alloc, trans_link,
117                 dimension_id, dimension2_id
118                 ) VALUES ($trans_no, ".db_escape($trans_type).",
119                 ".db_escape($debtor_no).", ".db_escape($BranchNo).",
120                 '$SQLDate', '$SQLDueDate', ".db_escape($reference).",
121                 ".db_escape($sales_type).", ".db_escape($order_no).", $Total, ".db_escape($discount).", $Tax,
122                 ".db_escape($Freight).",
123                 $FreightTax, $rate, ".db_escape($ship_via).", $AllocAmt, ".db_escape($trans_link).",
124                 ".db_escape($dimension_id).", ".db_escape($dimension2_id).")";
125         } else {        // may be optional argument should stay unchanged ?
126         $sql = "UPDATE ".TB_PREF."debtor_trans SET
127                 debtor_no=".db_escape($debtor_no)." , branch_code=".db_escape($BranchNo).",
128                 tran_date='$SQLDate', due_date='$SQLDueDate',
129                 reference=".db_escape($reference).", tpe=".db_escape($sales_type).", order_=".db_escape($order_no).",
130                 ov_amount=$Total, ov_discount=".db_escape($discount).", ov_gst=$Tax,
131                 ov_freight=".db_escape($Freight).", ov_freight_tax=$FreightTax, rate=$rate,
132                 ship_via=".db_escape($ship_via).", alloc=$AllocAmt, trans_link=$trans_link,
133                 dimension_id=".db_escape($dimension_id).", dimension2_id=".db_escape($dimension2_id)."
134                 WHERE trans_no=$trans_no AND type=".db_escape($trans_type);
135         }
136         db_query($sql, "The debtor transaction record could not be inserted");
137
138         return $trans_no;
139 }
140
141 //----------------------------------------------------------------------------------------
142
143 function get_customer_trans($trans_id, $trans_type)
144 {
145         $sql = "SELECT ".TB_PREF."debtor_trans.*,
146                 ov_amount+ov_gst+ov_freight+ov_freight_tax+ov_discount AS Total,
147                 ".TB_PREF."debtors_master.name AS DebtorName, ".TB_PREF."debtors_master.address, ".TB_PREF."debtors_master.email AS email2,
148                 ".TB_PREF."debtors_master.curr_code, ".TB_PREF."debtors_master.tax_id, ".TB_PREF."debtors_master.payment_terms ";
149
150         if ($trans_type == systypes::cust_payment()) {
151                 // it's a payment so also get the bank account
152                 $sql .= ", ".TB_PREF."bank_accounts.bank_name, ".TB_PREF."bank_accounts.bank_account_name,
153                         ".TB_PREF."bank_accounts.account_type AS BankTransType ";
154         }
155
156         if ($trans_type == 10 OR $trans_type == 11 OR $trans_type == 13) {
157                 // it's an invoice so also get the shipper and salestype
158                 $sql .= ", ".TB_PREF."shippers.shipper_name, "
159                 .TB_PREF."sales_types.sales_type, "
160                 .TB_PREF."sales_types.tax_included, "
161                 .TB_PREF."cust_branch.*, "
162                 .TB_PREF."debtors_master.discount, "
163                 .TB_PREF."tax_groups.name AS tax_group_name, "
164                 .TB_PREF."tax_groups.id AS tax_group_id ";
165         }
166
167
168         $sql .= " FROM ".TB_PREF."debtor_trans, ".TB_PREF."debtors_master ";
169
170         if ($trans_type == systypes::cust_payment()) {
171                 // it's a payment so also get the bank account
172                 $sql .= ", ".TB_PREF."bank_trans, ".TB_PREF."bank_accounts";
173         }
174
175         if ($trans_type == 10 OR $trans_type == 11 OR $trans_type == 13) {
176                 // it's an invoice so also get the shipper, salestypes
177                 $sql .= ", ".TB_PREF."shippers, ".TB_PREF."sales_types, ".TB_PREF."cust_branch, ".TB_PREF."tax_groups ";
178         }
179
180         $sql .= " WHERE ".TB_PREF."debtor_trans.trans_no=".db_escape($trans_id)."
181                 AND ".TB_PREF."debtor_trans.type=".db_escape($trans_type)."
182                 AND ".TB_PREF."debtor_trans.debtor_no=".TB_PREF."debtors_master.debtor_no";
183
184         if ($trans_type == systypes::cust_payment()) {
185                 // it's a payment so also get the bank account
186                 $sql .= " AND ".TB_PREF."bank_trans.trans_no =$trans_id
187                         AND ".TB_PREF."bank_trans.type=$trans_type
188                         AND ".TB_PREF."bank_accounts.id=".TB_PREF."bank_trans.bank_act ";
189         }
190         if ($trans_type == 10 OR $trans_type == 11 OR $trans_type == 13) {
191                 // it's an invoice so also get the shipper
192                 $sql .= " AND ".TB_PREF."shippers.shipper_id=".TB_PREF."debtor_trans.ship_via
193                         AND ".TB_PREF."sales_types.id = ".TB_PREF."debtor_trans.tpe
194                         AND ".TB_PREF."cust_branch.branch_code = ".TB_PREF."debtor_trans.branch_code
195                         AND ".TB_PREF."cust_branch.tax_group_id = ".TB_PREF."tax_groups.id ";
196         }
197
198         $result = db_query($sql, "Cannot retreive a debtor transaction");
199
200         if (db_num_rows($result) == 0) {
201                 // can't return nothing
202                 display_db_error("no debtor trans found for given params", $sql, true);
203                 exit;
204         }
205
206         if (db_num_rows($result) > 1) {
207                 // can't return multiple
208                 display_db_error("duplicate debtor transactions found for given params", $sql, true);
209                 exit;
210         }
211
212         //return db_fetch($result);
213         $row = db_fetch($result);
214         $row['email'] = $row['email2'];
215         return $row;
216 }
217
218 //----------------------------------------------------------------------------------------
219
220 function exists_customer_trans($type, $type_no)
221 {
222         $sql = "SELECT trans_no FROM ".TB_PREF."debtor_trans WHERE type=".db_escape($type)."
223                 AND trans_no=".db_escape($type_no);
224
225         $result = db_query($sql, "Cannot retreive a debtor transaction");
226
227         return (db_num_rows($result) > 0);
228 }
229
230 //----------------------------------------------------------------------------------------
231
232 // retreives the related sales order for a given trans
233
234 function get_customer_trans_order($type, $type_no)
235 {
236         $sql = "SELECT order_ FROM ".TB_PREF."debtor_trans WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
237
238         $result = db_query($sql, "The debtor transaction could not be queried");
239
240         $row = db_fetch_row($result);
241
242         return $row[0];
243 }
244
245 //----------------------------------------------------------------------------------------
246
247 function get_customer_details_from_trans($type, $type_no)
248 {
249         $sql = "SELECT ".TB_PREF."debtors_master.name, ".TB_PREF."debtors_master.curr_code, ".TB_PREF."cust_branch.br_name
250                 FROM ".TB_PREF."debtors_master,".TB_PREF."cust_branch,".TB_PREF."debtor_trans
251                 WHERE ".TB_PREF."debtor_trans.type=".db_escape($type)." AND ".TB_PREF."debtor_trans.trans_no=".db_escape($type_no)."
252                 AND ".TB_PREF."debtors_master.debtor_no = ".TB_PREF."debtor_trans.debtor_no
253                 AND     ".TB_PREF."cust_branch.branch_code = ".TB_PREF."debtor_trans.branch_code";
254
255         $result = db_query($sql, "could not get customer details from trans");
256         return db_fetch($result);
257 }
258
259 //----------------------------------------------------------------------------------------
260
261 function void_customer_trans($type, $type_no)
262 {
263         // clear all values and mark as void
264         $sql = "UPDATE ".TB_PREF."debtor_trans SET ov_amount=0, ov_discount=0, ov_gst=0, ov_freight=0,
265                 ov_freight_tax=0, alloc=0, version=version+1 WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
266
267         db_query($sql, "could not void debtor transactions for type=$type and trans_no=$type_no");
268 }
269
270 //----------------------------------------------------------------------------------------
271
272 function post_void_customer_trans($type, $type_no)
273 {
274         switch ($type) {
275                 case 10 :
276                 case 11 :
277                         void_sales_invoice($type, $type_no);
278                         break;
279                 case 13 :
280                         void_sales_delivery($type, $type_no);
281                         break;
282                 case 12 :
283                         void_customer_payment($type, $type_no);
284                         break;
285         }
286 }
287
288 //----------------------------------------------------------------------------------------
289
290 function get_customer_trans_link($type, $type_no)
291 {
292         $row = db_query("SELECT trans_link from ".TB_PREF."debtor_trans
293                 WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no),
294                 "could not get transaction link for type=$type and trans_no=$type_no");
295         return $row[0];
296 }
297 //----------------------------------------------------------------------------------------
298
299 ?>