Sealing against XSS atacks: purchasing,sales,install,admin,taxes
[fa-stable.git] / sales / manage / customers.php
1 <?php
2
3 $page_security = 3;
4 $path_to_root="../..";
5
6 include_once($path_to_root . "/includes/session.inc");
7 page(_("Customers")); 
8
9 include_once($path_to_root . "/includes/date_functions.inc");
10 include_once($path_to_root . "/includes/banking.inc");
11 include_once($path_to_root . "/includes/ui.inc");
12
13 if (isset($_GET['New']) || !isset($_POST['customer_id']) || $_POST['customer_id'] == "") 
14 {
15         $_POST['New'] = "1";
16 }
17
18 if (isset($_POST['SelectCustomer'])) 
19 {
20         unset($_POST['New']);
21 }
22
23 //--------------------------------------------------------------------------------------------
24
25 function can_process()
26 {
27         if (strlen($_POST['CustName']) == 0) 
28         {
29                 display_error(_("The customer name cannot be empty."));
30                 return false;
31         } 
32         
33         if (!check_num('credit_limit', 0))
34         {
35                 display_error(_("The credit limit must be numeric and not less than zero."));
36                 return false;           
37         } 
38         
39         if (!check_num('pymt_discount', 0, 100)) 
40         {
41                 display_error(_("The payment discount must be numeric and is expected to be less than 100% and greater than or equal to 0."));
42                 return false;           
43         } 
44         
45         if (!check_num('discount', 0, 100)) 
46         {
47                 display_error(_("The discount percentage must be numeric and is expected to be less than 100% and greater than or equal to 0."));
48                 return false;           
49         } 
50
51         return true;
52 }
53
54 //--------------------------------------------------------------------------------------------
55
56 function handle_submit()
57 {
58         global $path_to_root;
59         if (!can_process())
60                 return;
61                 
62         if (!isset($_POST['New'])) 
63         {
64
65                 $sql = "UPDATE ".TB_PREF."debtors_master SET name=" . db_escape($_POST['CustName']) . ", 
66                         address=".db_escape($_POST['address']) . ", 
67                         tax_id=".db_escape($_POST['tax_id']) . ", 
68                         curr_code=".db_escape($_POST['curr_code']) . ", 
69                         email=".db_escape($_POST['email']) . ", 
70                         dimension_id=".db_escape($_POST['dimension_id']) . ", 
71                         dimension2_id=".db_escape($_POST['dimension2_id']) . ", 
72             credit_status=".db_escape($_POST['credit_status']) . ", 
73             payment_terms=".db_escape($_POST['payment_terms']) . ", 
74             discount=" . input_num('discount') / 100 . ", 
75             pymt_discount=" . input_num('pymt_discount') / 100 . ", 
76             credit_limit=" . input_num('credit_limit') . ", 
77             sales_type = ".db_escape($_POST['sales_type']) . " 
78             WHERE debtor_no = '". $_POST['customer_id'] . "'";
79
80                 db_query($sql,"The customer could not be updated");
81                 display_notification(_("Customer has been updated."));
82                 clear_fields();                 
83
84         } 
85         else 
86         {       //it is a new customer
87
88                 begin_transaction();
89
90                 $sql = "INSERT INTO ".TB_PREF."debtors_master (name, address, tax_id, email, dimension_id, dimension2_id,  
91                         curr_code, credit_status, payment_terms, discount, pymt_discount,credit_limit, 
92                         sales_type) VALUES (".db_escape($_POST['CustName']) .", " 
93                         .db_escape($_POST['address']) . ", " . db_escape($_POST['tax_id']) . ","
94                         .db_escape($_POST['email']) . ", ".db_escape($_POST['dimension_id']) . ", " 
95                         .db_escape($_POST['dimension2_id']) . ", ".db_escape($_POST['curr_code']) . ", 
96                         " . db_escape($_POST['credit_status']) . ", ".db_escape($_POST['payment_terms']) . ", " . input_num('discount')/100 . ", 
97                         " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') . ", ".db_escape($_POST['sales_type']) . ")";
98
99                 db_query($sql,"The customer could not be added");
100
101                 $new_customer_id = db_insert_id();
102                 
103                 commit_transaction();                   
104
105                 display_notification(_("A new customer has been added."));
106
107                 hyperlink_params($path_to_root . "/sales/manage/customer_branches.php", _("Add branches for this customer"), "debtor_no=$new_customer_id");
108
109                 clear_fields();
110         }
111 }
112
113 //--------------------------------------------------------------------------------------------
114
115 if (isset($_POST['submit'])) 
116 {
117         
118         handle_submit();
119 }
120
121 //-------------------------------------------------------------------------------------------- 
122
123 if (isset($_POST['delete'])) 
124 {
125
126         //the link to delete a selected record was clicked instead of the submit button
127
128         $cancel_delete = 0;
129
130         // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
131
132         $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no='" . $_POST['customer_id'] . "'";
133         $result = db_query($sql,"check failed");
134         $myrow = db_fetch_row($result);
135         if ($myrow[0] > 0) 
136         {
137                 $cancel_delete = 1;
138                 display_error(_("This customer cannot be deleted because there are transactions that refer to it."));
139         } 
140         else 
141         {
142                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no='" . $_POST['customer_id'] . "'";
143                 $result = db_query($sql,"check failed");
144                 $myrow = db_fetch_row($result);
145                 if ($myrow[0] > 0) 
146                 {
147                         $cancel_delete = 1;
148                         display_error(_("Cannot delete the customer record because orders have been created against it."));
149                 } 
150                 else 
151                 {
152                         $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no='" . $_POST['customer_id'] . "'";
153                         $result = db_query($sql,"check failed");
154                         $myrow = db_fetch_row($result);
155                         if ($myrow[0] > 0) 
156                         {
157                                 $cancel_delete = 1;
158                                 display_error(_("Cannot delete this customer because there are branch records set up against it."));
159                                 //echo "<br> There are " . $myrow[0] . " branch records relating to this customer";
160                         }
161                 }
162         }
163         
164         if ($cancel_delete == 0) 
165         {       //ie not cancelled the delete as a result of above tests
166                 $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no='" . $_POST['customer_id'] . "'";
167                 db_query($sql,"cannot delete customer");
168                 
169                 meta_forward($_SERVER['PHP_SELF']); 
170         } //end if Delete Customer
171 }
172
173 function clear_fields() 
174 {
175         unset($_POST['CustName']);
176         unset($_POST['address']);
177         unset($_POST['tax_id']);
178         unset($_POST['email']);
179         unset($_POST['dimension_id']);
180         unset($_POST['dimension2_id']);
181         unset($_POST['credit_status']);
182         unset($_POST['payment_terms']);
183         unset($_POST['discount']);
184         unset($_POST['pymt_discount']);
185         unset($_POST['credit_limit']);
186         unset($_POST['sales_type']);
187         unset($_POST['customer_id']);
188         $_POST['New'] = 1;
189 }
190
191 check_db_has_sales_types(_("There are no sales types defined. Please define at least one sales type before adding a customer."));
192  
193 start_form();
194
195 if (db_has_customers()) 
196 {
197         start_table("class = 'tablestyle_noborder'");
198         start_row();
199         customer_list_cells(_("Select a customer: "), 'customer_id', null);
200         submit_cells('SelectCustomer', _("Edit Customer"));
201         end_row();
202         end_table();
203
204 else 
205 {
206         hidden('customer_id', $_POST['customer_id']);
207 }
208
209 hyperlink_params($_SERVER['PHP_SELF'], _("Enter a new customer"), "New=1");
210 echo "<br>";     
211
212 start_table($table_style2, 7, 6);
213 echo "<tr valign=top><td>"; // outer table      
214
215 start_table("class='tablestyle_noborder'");     
216
217 if (isset($_POST['New'])) 
218 {
219
220         hidden('New', 'Yes');
221
222         $_POST['CustName'] = $_POST['address'] = $_POST['tax_id']  = '';
223         $_POST['dimension_id'] = 0;
224         $_POST['dimension2_id'] = 0;
225         $_POST['sales_type'] = -1;
226         $_POST['curr_code']  = get_company_currency();
227         $_POST['credit_status']  = -1;
228         $_POST['payment_terms']  = '';
229         $_POST['discount']  = $_POST['pymt_discount'] = percent_format(0);
230         $_POST['credit_limit']  = price_format(sys_prefs::default_credit_limit());
231
232 else 
233 {
234
235         $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = '" . $_POST['customer_id'] . "'";
236         $result = db_query($sql,"check failed");
237
238         $myrow = db_fetch($result);
239
240         $_POST['CustName'] = $myrow["name"];
241         $_POST['address']  = $myrow["address"];
242         $_POST['tax_id']  = $myrow["tax_id"];
243         $_POST['email']  = $myrow["email"];
244         $_POST['dimension_id']  = $myrow["dimension_id"];
245         $_POST['dimension2_id']  = $myrow["dimension2_id"];
246         $_POST['sales_type'] = $myrow["sales_type"];
247         $_POST['curr_code']  = $myrow["curr_code"];
248         $_POST['credit_status']  = $myrow["credit_status"];
249         $_POST['payment_terms']  = $myrow["payment_terms"];
250         $_POST['discount']  = percent_format($myrow["discount"] * 100);
251         $_POST['pymt_discount']  = percent_format($myrow["pymt_discount"] * 100);
252         $_POST['credit_limit']  = price_format($myrow["credit_limit"]);
253 }
254
255 text_row(_("Customer Name:"), 'CustName', $_POST['CustName'], 40, 40);
256 textarea_row(_("Address:"), 'address', $_POST['address'], 35, 5);
257
258 text_row(_("Email:"), 'email', null, 40, 40);
259 text_row(_("GSTNo:"), 'tax_id', null, 40, 40);
260
261
262 // Sherifoz 23.09.03 currency can't be changed if editing
263 if (isset($_POST['New'])) 
264 {
265         currencies_list_row(_("Customer's Currency:"), 'curr_code', $_POST['curr_code']);
266
267 else 
268 {
269         label_row(_("Customer's Currency:"), $_POST['curr_code']);
270         hidden('curr_code', $_POST['curr_code']);                               
271 }       
272 end_table();
273
274 echo "</td><td class='tableseparator'>"; // outer table
275
276 start_table("class='tablestyle_noborder'");     
277
278 sales_types_list_row(_("Sales Type/Price List:"), 'sales_type', $_POST['sales_type']);
279 $dim = get_company_pref('use_dimension');
280 if ($dim >= 1)
281         dimensions_list_row(_("Dimension")." 1:", 'dimension_id', $_POST['dimension_id'], true, " ", false, 1);
282 if ($dim > 1)
283         dimensions_list_row(_("Dimension")." 2:", 'dimension2_id', $_POST['dimension2_id'], true, " ", false, 2);
284 if ($dim < 1)
285         hidden('dimension_id', 0);
286 if ($dim < 2)
287         hidden('dimension2_id', 0);
288
289 percent_row(_("Discount Percent:"), 'discount', $_POST['discount']);
290 percent_row(_("Prompt Payment Discount Percent:"), 'pymt_discount', $_POST['pymt_discount']);
291 amount_row(_("Credit Limit:"), 'credit_limit', $_POST['credit_limit']);
292
293 payment_terms_list_row(_("Payment Terms:"), 'payment_terms', $_POST['payment_terms']);
294 credit_status_list_row(_("Credit Status:"), 'credit_status', $_POST['credit_status']); 
295
296 end_table();
297
298 end_table(1); // outer table    
299
300 if (isset($_POST['New'])) 
301 {
302         submit_center('submit', _("Add New Customer"));
303
304 else 
305 {
306         submit_center_first('submit', _("Update Customer"));
307         submit_center_last('delete', _("Delete Customer"));
308 }
309
310 end_form();
311 end_page();
312
313 ?>