Security update merged from 2.1.
[fa-stable.git] / sales / includes / db / sales_order_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //----------------------------------------------------------------------------------------
13 function add_sales_order(&$order)
14 {
15         global $loc_notification, $path_to_root, $Refs;
16
17         begin_transaction();
18
19         $order_no = get_next_trans_no($order->trans_type);
20         $del_date = date2sql($order->due_date);
21         $order_type = 0; // this is default on new order
22         $sql = "INSERT INTO ".TB_PREF."sales_orders (order_no, type, debtor_no, trans_type, branch_code, customer_ref, reference, comments, ord_date,
23                 order_type, ship_via, deliver_to, delivery_address, contact_phone,
24                 contact_email, freight_cost, from_stk_loc, delivery_date)
25                 VALUES (" .db_escape($order_no) . "," .db_escape($order_type) . "," . db_escape($order->customer_id) .
26                  ", " .db_escape($order->trans_type) . "," .db_escape($order->Branch) . ", ".
27                         db_escape($order->cust_ref) .",". 
28                         db_escape($order->reference) .",". 
29                         db_escape($order->Comments) .",'" . 
30                         date2sql($order->document_date) . "', " .
31                         db_escape($order->sales_type) . ", " .
32                         db_escape($order->ship_via)."," . 
33                         db_escape($order->deliver_to) . "," .
34                         db_escape($order->delivery_address) . ", " .
35                         db_escape($order->phone) . ", " . 
36                         db_escape($order->email) . ", " .
37                         db_escape($order->freight_cost) .", " . 
38                         db_escape($order->Location) .", " .
39                         db_escape($del_date) . ")";
40
41         db_query($sql, "order Cannot be Added");
42
43         $order->trans_no = array($order_no=>0);
44
45         if ($loc_notification == 1)
46         {
47                 include_once($path_to_root . "/inventory/includes/inventory_db.inc");
48                 $st_ids = array();
49                 $st_names = array();
50                 $st_num = array();
51                 $st_reorder = array();
52         }
53         foreach ($order->line_items as $line)
54         {
55                 if ($loc_notification == 1 && is_inventory_item($line->stock_id))
56                 {
57                         $sql = "SELECT ".TB_PREF."loc_stock.*, ".TB_PREF."locations.location_name, ".TB_PREF."locations.email
58                                 FROM ".TB_PREF."loc_stock, ".TB_PREF."locations
59                                 WHERE ".TB_PREF."loc_stock.loc_code=".TB_PREF."locations.loc_code
60                                 AND ".TB_PREF."loc_stock.stock_id = '" . $line->stock_id . "'
61                                 AND ".TB_PREF."loc_stock.loc_code = '" . $order->Location . "'";
62                         $res = db_query($sql,"a location could not be retreived");
63                         $loc = db_fetch($res);
64                         if ($loc['email'] != "")
65                         {
66                                 $qoh = get_qoh_on_date($line->stock_id, $order->Location);
67                                 $qoh -= get_demand_qty($line->stock_id, $order->Location);
68                                 $qoh -= get_demand_asm_qty($line->stock_id, $order->Location);
69                                 $qoh -= $line->quantity;
70                                 if ($qoh < $loc['reorder_level'])
71                                 {
72                                         $st_ids[] = $line->stock_id;
73                                         $st_names[] = $line->item_description;
74                                         $st_num[] = $qoh - $loc['reorder_level'];
75                                         $st_reorder[] = $loc['reorder_level'];
76                                 }
77                         }
78                 }
79
80                 $sql = "INSERT INTO ".TB_PREF."sales_order_details (order_no, trans_type, stk_code, description, unit_price, quantity, discount_percent) VALUES (";
81                 $sql .= $order_no . ",".$order->trans_type .
82                                 ",".db_escape($line->stock_id).", "
83                                 .db_escape($line->item_description).", $line->price,
84                                 $line->quantity,
85                                 $line->discount_percent)";
86                 db_query($sql, "order Details Cannot be Added");
87
88         } /* inserted line items into sales order details */
89
90         add_audit_trail($order->trans_type, $order_no, $order->document_date);
91         $Refs->save($order->trans_type, $order_no, $order->reference);
92         commit_transaction();
93
94         if ($loc_notification == 1 && count($st_ids) > 0)
95         {
96                 require_once($path_to_root . "/reporting/includes/class.mail.inc");
97                 $company = get_company_prefs();
98                 $mail = new email($company['coy_name'], $company['email']);
99                 $from = $company['coy_name'] . " <" . $company['email'] . ">";
100                 $to = $loc['location_name'] . " <" . $loc['email'] . ">";
101                 $subject = _("Stocks below Re-Order Level at " . $loc['location_name']);
102                 $msg = "\n";
103                 for ($i = 0; $i < count($st_ids); $i++)
104                         $msg .= $st_ids[$i] . " " . $st_names[$i] . ", " . _("Re-Order Level") . ": " . $st_reorder[$i] . ", " . _("Below") . ": " . $st_num[$i] . "\n";
105                 $msg .= "\n" . _("Please reorder") . "\n\n";
106                 $msg .= $company['coy_name'];
107                 $mail->to($to);
108                 $mail->subject($subject);
109                 $mail->text($msg);
110                 $ret = $mail->send();
111         }
112         return $order_no;
113 }
114
115 //----------------------------------------------------------------------------------------
116
117 function delete_sales_order($order_no, $trans_type)
118 {
119         begin_transaction();
120
121         $sql = "DELETE FROM ".TB_PREF."sales_orders WHERE order_no=" . db_escape($order_no) 
122                 . " AND trans_type=".db_escape($trans_type);
123
124         db_query($sql, "order Header Delete");
125
126         $sql = "DELETE FROM ".TB_PREF."sales_order_details WHERE order_no =" 
127                 .db_escape($order_no) . " AND trans_type=".db_escape($trans_type);
128         db_query($sql, "order Detail Delete");
129
130         add_audit_trail($trans_type, $order_no, Today(), _("Deleted."));
131         commit_transaction();
132 }
133
134 //----------------------------------------------------------------------------------------
135 // Mark changes in sales_order_details
136 //
137 function update_sales_order_version($order)
138 {
139   foreach ($order as $so_num => $so_ver) {
140   $sql= 'UPDATE '.TB_PREF.'sales_orders SET version=version+1 WHERE order_no='. $so_num.
141         ' AND version='.$so_ver . " AND trans_type=30";
142   db_query($sql, 'Concurrent editing conflict while sales order update');
143   }
144 }
145
146 //----------------------------------------------------------------------------------------
147
148 function update_sales_order($order)
149 {
150         global $loc_notification, $path_to_root, $Refs;
151
152         $del_date = date2sql($order->due_date);
153         $ord_date = date2sql($order->document_date);
154         $order_no =  key($order->trans_no);
155         $version= current($order->trans_no);
156
157         begin_transaction();
158
159         $sql = "UPDATE ".TB_PREF."sales_orders SET type =".db_escape($order->so_type)." ,
160                 debtor_no = " . db_escape($order->customer_id) . ",
161                 branch_code = " . db_escape($order->Branch) . ",
162                 customer_ref = ". db_escape($order->cust_ref) .",
163                 reference = ". db_escape($order->reference) .",
164                 comments = ". db_escape($order->Comments) .",
165                 ord_date = " . db_escape($ord_date) . ",
166                 order_type = " .db_escape($order->sales_type) . ",
167                 ship_via = " . db_escape($order->ship_via) .",
168                 deliver_to = " . db_escape($order->deliver_to) . ",
169                 delivery_address = " . db_escape($order->delivery_address) . ",
170                 contact_phone = " .db_escape($order->phone) . ",
171                 contact_email = " .db_escape($order->email) . ",
172                 freight_cost = " .db_escape($order->freight_cost) .",
173                 from_stk_loc = " .db_escape($order->Location) .",
174                 delivery_date = " .db_escape($del_date). ",
175                 version = ".($version+1)."
176          WHERE order_no=" . $order_no ."
177          AND trans_type=".$order->trans_type." AND version=".$version;
178         db_query($sql, "order Cannot be Updated, this can be concurrent edition conflict");
179
180         $sql = "DELETE FROM ".TB_PREF."sales_order_details WHERE order_no =" . $order_no . " AND trans_type=".$order->trans_type;
181
182         db_query($sql, "Old order Cannot be Deleted");
183
184         if ($loc_notification == 1)
185         {
186                 include_once($path_to_root . "/inventory/includes/inventory_db.inc");
187                 $st_ids = array();
188                 $st_names = array();
189                 $st_num = array();
190                 $st_reorder = array();
191         }
192         foreach ($order->line_items as $line)
193         {
194                 if ($loc_notification == 1 && is_inventory_item($line->stock_id))
195                 {
196                         $sql = "SELECT ".TB_PREF."loc_stock.*, "
197                                   .TB_PREF."locations.location_name, "
198                                   .TB_PREF."locations.email
199                                 FROM ".TB_PREF."loc_stock, "
200                                   .TB_PREF."locations
201                                 WHERE ".TB_PREF."loc_stock.loc_code=".TB_PREF."locations.loc_code
202                                  AND ".TB_PREF."loc_stock.stock_id = ".db_escape($line->stock_id)."
203                                  AND ".TB_PREF."loc_stock.loc_code = ".db_escape($order->Location);
204                         $res = db_query($sql,"a location could not be retreived");
205                         $loc = db_fetch($res);
206                         if ($loc['email'] != "")
207                         {
208                                 $qoh = get_qoh_on_date($line->stock_id, $order->Location);
209                                 $qoh -= get_demand_qty($line->stock_id, $order->Location);
210                                 $qoh -= get_demand_asm_qty($line->stock_id, $order->Location);
211                                 $qoh -= $line->quantity;
212                                 if ($qoh < $loc['reorder_level'])
213                                 {
214                                         $st_ids[] = $line->stock_id;
215                                         $st_names[] = $line->item_description;
216                                         $st_num[] = $qoh - $loc['reorder_level'];
217                                         $st_reorder[] = $loc['reorder_level'];
218                                 }
219                         }
220                 }
221                 $sql = "INSERT INTO ".TB_PREF."sales_order_details
222                  (order_no, trans_type, stk_code,  description, unit_price, quantity,
223                   discount_percent, qty_sent)
224                  VALUES (";
225                 $sql .= $order_no . ",".$order->trans_type.","
226                   .db_escape($line->stock_id) . ","
227                   .db_escape($line->item_description) . ", "
228                   .db_escape($line->price) . ", "
229                   .db_escape($line->quantity) . ", "
230                   .db_escape($line->discount_percent) . ", "
231                   .db_escape($line->qty_done) ." )";
232
233                 db_query($sql, "Old order Cannot be Inserted");
234
235         } /* inserted line items into sales order details */
236
237         add_audit_trail($order->trans_type, $order_no, $order->document_date, _("Updated."));
238         $Refs->delete($order->trans_type, $order_no);
239         $Refs->save($order->trans_type, $order_no, $order->reference);
240         commit_transaction();
241         if ($loc_notification == 1 && count($st_ids) > 0)
242         {
243                 require_once($path_to_root . "/reporting/includes/class.mail.inc");
244                 $company = get_company_prefs();
245                 $mail = new email($company['coy_name'], $company['email']);
246                 $from = $company['coy_name'] . " <" . $company['email'] . ">";
247                 $to = $loc['location_name'] . " <" . $loc['email'] . ">";
248                 $subject = _("Stocks below Re-Order Level at " . $loc['location_name']);
249                 $msg = "\n";
250                 for ($i = 0; $i < count($st_ids); $i++)
251                         $msg .= $st_ids[$i] . " " . $st_names[$i] . ", "
252                           . _("Re-Order Level") . ": " . $st_reorder[$i] . ", "
253                           . _("Below") . ": " . $st_num[$i] . "\n";
254                 $msg .= "\n" . _("Please reorder") . "\n\n";
255                 $msg .= $company['coy_name'];
256                 $mail->to($to);
257                 $mail->subject($subject);
258                 $mail->text($msg);
259                 $ret = $mail->send();
260         }
261 }
262
263 //----------------------------------------------------------------------------------------
264
265 function get_sales_order_header($order_no, $trans_type)
266 {
267         $sql = "SELECT ".TB_PREF."sales_orders.*, "
268           .TB_PREF."debtors_master.name, "
269           .TB_PREF."debtors_master.curr_code, "
270           .TB_PREF."debtors_master.email AS master_email, "
271           .TB_PREF."locations.location_name, "
272           .TB_PREF."debtors_master.payment_terms, "
273           .TB_PREF."debtors_master.discount, "
274           .TB_PREF."sales_types.sales_type, "
275           .TB_PREF."sales_types.id AS sales_type_id, "
276           .TB_PREF."sales_types.tax_included, "
277           .TB_PREF."shippers.shipper_name, "
278           .TB_PREF."tax_groups.name AS tax_group_name , "
279           .TB_PREF."tax_groups.id AS tax_group_id
280         FROM ".TB_PREF."sales_orders, "
281           .TB_PREF."debtors_master, "
282           .TB_PREF."sales_types, "
283           .TB_PREF."tax_groups, "
284           .TB_PREF."cust_branch, "
285           .TB_PREF."locations, "
286           .TB_PREF."shippers
287         WHERE ".TB_PREF."sales_orders.order_type=".TB_PREF."sales_types.id
288                 AND ".TB_PREF."cust_branch.branch_code = ".TB_PREF."sales_orders.branch_code
289                 AND ".TB_PREF."cust_branch.tax_group_id = ".TB_PREF."tax_groups.id
290                 AND ".TB_PREF."sales_orders.debtor_no = ".TB_PREF."debtors_master.debtor_no
291                 AND ".TB_PREF."locations.loc_code = ".TB_PREF."sales_orders.from_stk_loc
292                 AND ".TB_PREF."shippers.shipper_id = ".TB_PREF."sales_orders.ship_via
293                 AND ".TB_PREF."sales_orders.trans_type = " . db_escape($trans_type) ."
294                 AND ".TB_PREF."sales_orders.order_no = " . db_escape($order_no );
295
296         $result = db_query($sql, "order Retreival");
297
298         $num = db_num_rows($result);
299         if ($num > 1)
300         {
301                 display_db_error("FATAL : sales order query returned a duplicate - " . db_num_rows($result), $sql, true);
302         }
303         else if ($num == 1)
304         {
305                 return db_fetch($result);
306         }
307         else
308                 display_db_error("FATAL : sales order return nothing - " . db_num_rows($result), $sql, true);
309
310 }
311
312 //----------------------------------------------------------------------------------------
313
314 function get_sales_order_details($order_no, $trans_type) {
315         $sql = "SELECT id, stk_code, unit_price, "
316                 .TB_PREF."sales_order_details.description,"
317                 .TB_PREF."sales_order_details.quantity,
318                   discount_percent,
319                   qty_sent as qty_done, "
320                 .TB_PREF."stock_master.units,
321                 ".TB_PREF."stock_master.material_cost + "
322                         .TB_PREF."stock_master.labour_cost + "
323                         .TB_PREF."stock_master.overhead_cost AS standard_cost
324         FROM ".TB_PREF."sales_order_details, ".TB_PREF."stock_master
325         WHERE ".TB_PREF."sales_order_details.stk_code = ".TB_PREF."stock_master.stock_id
326         AND order_no =" . db_escape($order_no) 
327                 ." AND trans_type = " . db_escape($trans_type) . " ORDER BY id";
328
329         return db_query($sql, "Retreive order Line Items");
330 }
331 //----------------------------------------------------------------------------------------
332
333 function read_sales_order($order_no, &$order, $trans_type)
334 {
335         $myrow = get_sales_order_header($order_no, $trans_type);
336
337         $order->trans_type = $myrow['trans_type'];
338         $order->so_type =  $myrow["type"];
339         $order->trans_no = array($order_no=> $myrow["version"]);
340
341         $order->set_customer($myrow["debtor_no"], $myrow["name"],
342           $myrow["curr_code"], $myrow["discount"]);
343
344         $order->set_branch($myrow["branch_code"], $myrow["tax_group_id"],
345           $myrow["tax_group_name"], $myrow["contact_phone"], $myrow["contact_email"]);
346
347         $order->set_sales_type($myrow["sales_type_id"], $myrow["sales_type"], 
348             $myrow["tax_included"], 0); // no default price calculations on edit
349
350         $order->set_location($myrow["from_stk_loc"], $myrow["location_name"]);
351
352         $order->set_delivery($myrow["ship_via"], $myrow["deliver_to"],
353           $myrow["delivery_address"], $myrow["freight_cost"]);
354
355         $order->cust_ref = $myrow["customer_ref"];
356         $order->sales_type =$myrow["order_type"];
357         $order->reference = $myrow["reference"];
358         $order->Comments = $myrow["comments"];
359         $order->due_date = sql2date($myrow["delivery_date"]);
360         $order->document_date = sql2date($myrow["ord_date"]);
361
362         $result = get_sales_order_details($order_no, $order->trans_type);
363         if (db_num_rows($result) > 0)
364         {
365                 $line_no=0;
366                 while ($myrow = db_fetch($result))
367                 {
368                         $order->add_to_cart($line_no,$myrow["stk_code"],$myrow["quantity"],
369                                 $myrow["unit_price"], $myrow["discount_percent"],
370                                 $myrow["qty_done"], $myrow["standard_cost"], $myrow["description"], $myrow["id"] );
371                 $line_no++;
372                 }
373         }
374
375         return true;
376 }
377
378 //----------------------------------------------------------------------------------------
379
380 function sales_order_has_deliveries($order_no)
381 {
382         $sql = "SELECT SUM(qty_sent) FROM ".TB_PREF.
383         "sales_order_details WHERE order_no=".db_escape($order_no)
384         ." AND trans_type=".ST_SALESORDER."";
385
386         $result = db_query($sql, "could not query for sales order usage");
387
388         $row = db_fetch_row($result);
389
390         return ($row[0] > 0);
391 }
392
393 //----------------------------------------------------------------------------------------
394
395 function close_sales_order($order_no)
396 {
397         // set the quantity of each item to the already sent quantity. this will mark item as closed.
398         $sql = "UPDATE ".TB_PREF."sales_order_details
399                 SET quantity = qty_sent WHERE order_no = ".db_escape($order_no)
400                 ." AND trans_type=".ST_SALESORDER."";
401
402         db_query($sql, "The sales order detail record could not be updated");
403 }
404
405 //---------------------------------------------------------------------------------------------------------------
406
407 function get_invoice_duedate($debtorno, $invdate)
408 {
409         if (!is_date($invdate))
410         {
411                 return new_doc_date();
412         }
413         $sql = "SELECT ".TB_PREF."debtors_master.debtor_no, ".TB_PREF."debtors_master.payment_terms, ".TB_PREF."payment_terms.* FROM ".TB_PREF."debtors_master,
414                 ".TB_PREF."payment_terms WHERE ".TB_PREF."debtors_master.payment_terms = ".TB_PREF."payment_terms.terms_indicator AND
415                 ".TB_PREF."debtors_master.debtor_no = ".db_escape($debtorno);
416
417         $result = db_query($sql,"The customer details could not be retrieved");
418         $myrow = db_fetch($result);
419
420         if (db_num_rows($result) == 0)
421                 return $invdate;
422         if ($myrow['day_in_following_month'] > 0)
423                 $duedate = add_days(end_month($invdate), $myrow['day_in_following_month']);
424         else
425                 $duedate = add_days($invdate, $myrow['days_before_due']);
426         return $duedate;
427 }
428
429 function get_customer_to_order($customer_id) {
430
431         // Now check to ensure this account is not on hold */
432         $sql = "SELECT ".TB_PREF."debtors_master.name, "
433                   .TB_PREF."debtors_master.address, "
434                   .TB_PREF."credit_status.dissallow_invoices, "
435                   .TB_PREF."debtors_master.sales_type AS salestype, "
436                   .TB_PREF."debtors_master.dimension_id, "
437                   .TB_PREF."debtors_master.dimension2_id, "
438                   .TB_PREF."sales_types.sales_type, "
439                   .TB_PREF."sales_types.tax_included, "
440                   .TB_PREF."sales_types.factor, "
441                   .TB_PREF."debtors_master.curr_code, "
442                   .TB_PREF."debtors_master.discount,"
443                   .TB_PREF."debtors_master.pymt_discount
444                 FROM ".TB_PREF."debtors_master, "
445                   .TB_PREF."credit_status, "
446                   .TB_PREF."sales_types
447                 WHERE ".TB_PREF."debtors_master.sales_type="
448                   .TB_PREF."sales_types.id
449                 AND ".TB_PREF."debtors_master.credit_status=".TB_PREF."credit_status.id
450                 AND ".TB_PREF."debtors_master.debtor_no = ".db_escape($customer_id);
451
452         $result =db_query($sql,"Customer Record Retreive");
453         return  db_fetch($result);
454 }
455
456 function get_branch_to_order($customer_id, $branch_id) {
457
458         // the branch was also selected from the customer selection so default the delivery details from the customer branches table cust_branch. The order process will ask for branch details later anyway
459                 $sql = "SELECT ".TB_PREF."cust_branch.br_name, "
460                         .TB_PREF."cust_branch.br_address, "
461                         .TB_PREF."cust_branch.br_post_address, "
462                         .TB_PREF."cust_branch.phone, "
463                         .TB_PREF."cust_branch.email,
464                           default_location, location_name, default_ship_via, "
465                         .TB_PREF."tax_groups.name AS tax_group_name, "
466                         .TB_PREF."tax_groups.id AS tax_group_id
467                         FROM ".TB_PREF."cust_branch, "
468                           .TB_PREF."tax_groups, "
469                           .TB_PREF."locations
470                         WHERE ".TB_PREF."cust_branch.tax_group_id = ".TB_PREF."tax_groups.id
471                                 AND ".TB_PREF."locations.loc_code=default_location
472                                 AND ".TB_PREF."cust_branch.branch_code=".db_escape($branch_id)."
473                                 AND ".TB_PREF."cust_branch.debtor_no = ".db_escape($customer_id);
474
475             return db_query($sql,"Customer Branch Record Retreive");
476 }
477 ?>