Security update merged from 2.1.
[fa-stable.git] / sales / manage / customers.php
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 $page_security = 'SA_CUSTOMER';
13 $path_to_root = "../..";
14
15 include_once($path_to_root . "/includes/session.inc");
16 page(_("Customers"), @$_REQUEST['popup']); 
17
18 include_once($path_to_root . "/includes/date_functions.inc");
19 include_once($path_to_root . "/includes/banking.inc");
20 include_once($path_to_root . "/includes/ui.inc");
21
22 if (isset($_GET['debtor_no'])) 
23 {
24         $_POST['customer_id'] = $_GET['debtor_no'];
25 }
26 $new_customer = (!isset($_POST['customer_id']) || $_POST['customer_id'] == ""); 
27 //--------------------------------------------------------------------------------------------
28
29 function can_process()
30 {
31         if (strlen($_POST['CustName']) == 0) 
32         {
33                 display_error(_("The customer name cannot be empty."));
34                 set_focus('CustName');
35                 return false;
36         } 
37
38         if (strlen($_POST['cust_ref']) == 0) 
39         {
40                 display_error(_("The customer short name cannot be empty."));
41                 set_focus('cust_ref');
42                 return false;
43         } 
44         
45         if (!check_num('credit_limit', 0))
46         {
47                 display_error(_("The credit limit must be numeric and not less than zero."));
48                 set_focus('credit_limit');
49                 return false;           
50         } 
51         
52         if (!check_num('pymt_discount', 0, 100)) 
53         {
54                 display_error(_("The payment discount must be numeric and is expected to be less than 100% and greater than or equal to 0."));
55                 set_focus('pymt_discount');
56                 return false;           
57         } 
58         
59         if (!check_num('discount', 0, 100)) 
60         {
61                 display_error(_("The discount percentage must be numeric and is expected to be less than 100% and greater than or equal to 0."));
62                 set_focus('discount');
63                 return false;           
64         } 
65
66         return true;
67 }
68
69 //--------------------------------------------------------------------------------------------
70
71 function handle_submit()
72 {
73         global $path_to_root, $new_customer, $Ajax;
74
75         if (!can_process())
76                 return;
77                 
78         if ($new_customer == false) 
79         {
80
81                 $sql = "UPDATE ".TB_PREF."debtors_master SET name=" . db_escape($_POST['CustName']) . ", 
82                         debtor_ref=" . db_escape($_POST['cust_ref']) . ",
83                         address=".db_escape($_POST['address']) . ", 
84                         tax_id=".db_escape($_POST['tax_id']) . ", 
85                         curr_code=".db_escape($_POST['curr_code']) . ", 
86                         email=".db_escape($_POST['email']) . ", 
87                         dimension_id=".db_escape($_POST['dimension_id']) . ", 
88                         dimension2_id=".db_escape($_POST['dimension2_id']) . ", 
89             credit_status=".db_escape($_POST['credit_status']) . ", 
90             payment_terms=".db_escape($_POST['payment_terms']) . ", 
91             discount=" . input_num('discount') / 100 . ", 
92             pymt_discount=" . input_num('pymt_discount') / 100 . ", 
93             credit_limit=" . input_num('credit_limit') . ", 
94             sales_type = ".db_escape($_POST['sales_type']) . ", 
95             notes=".db_escape($_POST['notes']) . "
96             WHERE debtor_no = ".db_escape($_POST['customer_id']);
97
98                 db_query($sql,"The customer could not be updated");
99
100                 update_record_status($_POST['customer_id'], $_POST['inactive'],
101                         'debtors_master', 'debtor_no');
102
103                 $Ajax->activate('customer_id'); // in case of status change
104                 display_notification(_("Customer has been updated."));
105         } 
106         else 
107         {       //it is a new customer
108
109                 begin_transaction();
110
111                 $sql = "INSERT INTO ".TB_PREF."debtors_master (name, debtor_ref, address, tax_id, email, dimension_id, dimension2_id,  
112                         curr_code, credit_status, payment_terms, discount, pymt_discount,credit_limit,  
113                         sales_type, notes) VALUES (".db_escape($_POST['CustName']) .", " .db_escape($_POST['cust_ref']) .", "
114                         .db_escape($_POST['address']) . ", " . db_escape($_POST['tax_id']) . ","
115                         .db_escape($_POST['email']) . ", ".db_escape($_POST['dimension_id']) . ", " 
116                         .db_escape($_POST['dimension2_id']) . ", ".db_escape($_POST['curr_code']) . ", 
117                         " . db_escape($_POST['credit_status']) . ", ".db_escape($_POST['payment_terms']) . ", " . input_num('discount')/100 . ", 
118                         " . input_num('pymt_discount')/100 . ", " . input_num('credit_limit') 
119                          .", ".db_escape($_POST['sales_type']).", ".db_escape($_POST['notes']) . ")";
120
121                 db_query($sql,"The customer could not be added");
122
123                 $_POST['customer_id'] = db_insert_id();
124                 $new_customer = false;
125                 commit_transaction();                   
126
127                 display_notification(_("A new customer has been added."));
128
129                 $Ajax->activate('_page_body');
130         }
131 }
132 //--------------------------------------------------------------------------------------------
133
134 if (isset($_POST['submit'])) 
135 {
136         handle_submit();
137 }
138 //-------------------------------------------------------------------------------------------- 
139
140 if (isset($_POST['delete'])) 
141 {
142
143         //the link to delete a selected record was clicked instead of the submit button
144
145         $cancel_delete = 0;
146
147         // PREVENT DELETES IF DEPENDENT RECORDS IN 'debtor_trans'
148         $sel_id = db_escape($_POST['customer_id']);
149         $sql= "SELECT COUNT(*) FROM ".TB_PREF."debtor_trans WHERE debtor_no=$sel_id";
150         $result = db_query($sql,"check failed");
151         $myrow = db_fetch_row($result);
152         if ($myrow[0] > 0) 
153         {
154                 $cancel_delete = 1;
155                 display_error(_("This customer cannot be deleted because there are transactions that refer to it."));
156         } 
157         else 
158         {
159                 $sql= "SELECT COUNT(*) FROM ".TB_PREF."sales_orders WHERE debtor_no=$sel_id";
160                 $result = db_query($sql,"check failed");
161                 $myrow = db_fetch_row($result);
162                 if ($myrow[0] > 0) 
163                 {
164                         $cancel_delete = 1;
165                         display_error(_("Cannot delete the customer record because orders have been created against it."));
166                 } 
167                 else 
168                 {
169                         $sql = "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE debtor_no=$sel_id";
170                         $result = db_query($sql,"check failed");
171                         $myrow = db_fetch_row($result);
172                         if ($myrow[0] > 0) 
173                         {
174                                 $cancel_delete = 1;
175                                 display_error(_("Cannot delete this customer because there are branch records set up against it."));
176                                 //echo "<br> There are " . $myrow[0] . " branch records relating to this customer";
177                         }
178                 }
179         }
180         
181         if ($cancel_delete == 0) 
182         {       //ie not cancelled the delete as a result of above tests
183                 $sql = "DELETE FROM ".TB_PREF."debtors_master WHERE debtor_no=$sel_id";
184                 db_query($sql,"cannot delete customer");
185
186                 display_notification(_("Selected customer has been deleted."));
187                 unset($_POST['customer_id']);
188                 $new_customer = true;
189                 $Ajax->activate('_page_body');
190         } //end if Delete Customer
191 }
192
193 check_db_has_sales_types(_("There are no sales types defined. Please define at least one sales type before adding a customer."));
194  
195 start_form();
196
197 if (db_has_customers()) 
198 {
199         start_table("class = 'tablestyle_noborder'");
200         start_row();
201         customer_list_cells(_("Select a customer: "), 'customer_id', null,
202                 _('New customer'), true, check_value('show_inactive'));
203         check_cells(_("Show inactive:"), 'show_inactive', null, true);
204         end_row();
205         end_table();
206         if (get_post('_show_inactive_update')) {
207                 $Ajax->activate('customer_id');
208                 set_focus('customer_id');
209         }
210
211 else 
212 {
213         hidden('customer_id');
214 }
215
216 if ($new_customer) 
217 {
218         $_POST['CustName'] = $_POST['cust_ref'] = $_POST['address'] = $_POST['tax_id']  = '';
219         $_POST['dimension_id'] = 0;
220         $_POST['dimension2_id'] = 0;
221         $_POST['sales_type'] = -1;
222         $_POST['email'] = '';
223         $_POST['curr_code']  = get_company_currency();
224         $_POST['credit_status']  = -1;
225         $_POST['payment_terms']  = $_POST['notes']  = '';
226
227         $_POST['discount']  = $_POST['pymt_discount'] = percent_format(0);
228         $_POST['credit_limit']  = price_format($SysPrefs->default_credit_limit());
229         $_POST['inactive'] = 0;
230
231 else 
232 {
233
234         $sql = "SELECT * FROM ".TB_PREF."debtors_master WHERE debtor_no = ".db_escape($_POST['customer_id']);
235         $result = db_query($sql,"check failed");
236
237         $myrow = db_fetch($result);
238
239         $_POST['CustName'] = $myrow["name"];
240         $_POST['cust_ref'] = $myrow["debtor_ref"];
241         $_POST['address']  = $myrow["address"];
242         $_POST['tax_id']  = $myrow["tax_id"];
243         $_POST['email']  = $myrow["email"];
244         $_POST['dimension_id']  = $myrow["dimension_id"];
245         $_POST['dimension2_id']  = $myrow["dimension2_id"];
246         $_POST['sales_type'] = $myrow["sales_type"];
247         $_POST['curr_code']  = $myrow["curr_code"];
248         $_POST['credit_status']  = $myrow["credit_status"];
249         $_POST['payment_terms']  = $myrow["payment_terms"];
250         $_POST['discount']  = percent_format($myrow["discount"] * 100);
251         $_POST['pymt_discount']  = percent_format($myrow["pymt_discount"] * 100);
252         $_POST['credit_limit']  = price_format($myrow["credit_limit"]);
253         $_POST['notes']  = $myrow["notes"];
254         $_POST['inactive'] = $myrow["inactive"];
255 }
256
257 start_outer_table($table_style2, 5);
258 table_section(1);
259 table_section_title(_("Name and Address"));
260
261 text_row(_("Customer Name:"), 'CustName', $_POST['CustName'], 40, 80);
262 text_row(_("Customer Short Name:"), 'cust_ref', null, 30, 30);
263 textarea_row(_("Address:"), 'address', $_POST['address'], 35, 5);
264
265 email_row(_("E-mail:"), 'email', null, 40, 40);
266 text_row(_("GSTNo:"), 'tax_id', null, 40, 40);
267
268
269 if ($new_customer) 
270 {
271         currencies_list_row(_("Customer's Currency:"), 'curr_code', $_POST['curr_code']);
272
273 else 
274 {
275         label_row(_("Customer's Currency:"), $_POST['curr_code']);
276         hidden('curr_code', $_POST['curr_code']);                               
277 }       
278 sales_types_list_row(_("Sales Type/Price List:"), 'sales_type', $_POST['sales_type']);
279
280 table_section(2);
281
282 table_section_title(_("Sales"));
283
284 percent_row(_("Discount Percent:"), 'discount', $_POST['discount']);
285 percent_row(_("Prompt Payment Discount Percent:"), 'pymt_discount', $_POST['pymt_discount']);
286 amount_row(_("Credit Limit:"), 'credit_limit', $_POST['credit_limit']);
287
288 payment_terms_list_row(_("Payment Terms:"), 'payment_terms', $_POST['payment_terms']);
289 credit_status_list_row(_("Credit Status:"), 'credit_status', $_POST['credit_status']); 
290 $dim = get_company_pref('use_dimension');
291 if ($dim >= 1)
292         dimensions_list_row(_("Dimension")." 1:", 'dimension_id', $_POST['dimension_id'], true, " ", false, 1);
293 if ($dim > 1)
294         dimensions_list_row(_("Dimension")." 2:", 'dimension2_id', $_POST['dimension2_id'], true, " ", false, 2);
295 if ($dim < 1)
296         hidden('dimension_id', 0);
297 if ($dim < 2)
298         hidden('dimension2_id', 0);
299
300 if (!$new_customer)  {
301         start_row();
302         echo '<td>'._('Customer branches').':</td>';
303         hyperlink_params_td($path_to_root . "/sales/manage/customer_branches.php",
304                 '<b>'. (@$_REQUEST['popup'] ?  _("Select or &Add") : _("&Add or Edit ")).'</b>', 
305                 "debtor_no=".$_POST['customer_id'].(@$_REQUEST['popup'] ? '&popup=1':''));
306         end_row();
307
308 }
309
310 textarea_row(_("General Notes:"), 'notes', null, 35, 5);
311 record_status_list_row(_("Customer status:"), 'inactive');
312 end_outer_table(1);
313
314 div_start('controls');
315 if ($new_customer)
316 {
317         submit_center('submit', _("Add New Customer"), true, '', 'default');
318
319 else 
320 {
321         submit_center_first('submit', _("Update Customer"), 
322           _('Update customer data'), @$_REQUEST['popup'] ? true : 'default');
323         submit_return('select', get_post('customer_id'), _("Select this customer and return to document entry."));
324         submit_center_last('delete', _("Delete Customer"), 
325           _('Delete customer data if have been never used'), true);
326 }
327 div_end();
328 hidden('popup', @$_REQUEST['popup']);
329 end_form();
330 end_page();
331
332 ?>