From 78fe8cb8f56510ba3f6a1720b207a33b5828e071 Mon Sep 17 00:00:00 2001
From: Janusz Dobrowolski <janusz@frontaccouting.eu>
Date: Tue, 6 Sep 2011 10:47:39 +0200
Subject: [PATCH] Changes up to 2.3.7 merged into unstable branch.

---
 .hgtags                                |   2 +
 CHANGELOG.txt                          | 113 ++++++++++++++++++
 admin/backups.php                      |  57 ++++++----
 admin/change_current_user_password.php |   2 +-
 admin/create_coy.php                   |   8 +-
 admin/crm_categories.php               |   2 +-
 admin/db/company_db.inc                |   7 +-
 admin/db/fiscalyears_db.inc            |  29 ++++-
 admin/db/transactions_db.inc           |   5 +
 admin/db/users_db.inc                  |  23 +++-
 admin/db/voiding_db.inc                |  16 ++-
 admin/gl_setup.php                     |   2 +-
 admin/inst_module.php                  |   1 -
 admin/users.php                        |   4 +-
 admin/void_transaction.php             |  10 +-
 gl/bank_account_reconcile.php          |   2 +-
 gl/bank_transfer.php                   |  11 +-
 gl/gl_bank.php                         |  15 ++-
 gl/gl_journal.php                      |   4 +-
 gl/includes/db/gl_db_accounts.inc      |  97 +++++++++++++++-
 gl/includes/db/gl_db_bank_accounts.inc |  18 +++
 gl/includes/db/gl_db_bank_trans.inc    |  56 ++++++++-
 gl/includes/db/gl_db_banking.inc       | 152 +++++++++++++++++++------
 gl/includes/db/gl_db_rates.inc         |   3 +-
 gl/includes/db/gl_db_trans.inc         |   3 +-
 gl/includes/ui/gl_bank_ui.inc          |  26 +++--
 gl/inquiry/balance_sheet.php           |  43 ++++---
 gl/inquiry/gl_account_inquiry.php      |   3 +-
 gl/inquiry/gl_trial_balance.php        |   9 +-
 gl/inquiry/journal_inquiry.php         |  31 ++++-
 gl/manage/bank_accounts.php            |  12 +-
 gl/manage/gl_accounts.php              |  44 ++++---
 gl/manage/gl_quick_entries.php         |   4 +-
 gl/manage/revaluate_currencies.php     |   7 +-
 gl/view/gl_deposit_view.php            |   4 +-
 includes/current_user.inc              |  18 ++-
 includes/data_checks.inc               |   2 -
 includes/db/audit_trail_db.inc         |   4 +-
 includes/db/inventory_db.inc           |  96 +++-------------
 includes/errors.inc                    |   6 +-
 includes/hooks.inc                     |  36 ++++--
 includes/session.inc                   |  12 +-
 includes/ui/ui_controls.inc            |  29 ++++-
 includes/ui/ui_lists.inc               |  18 ++-
 includes/ui/ui_view.inc                |  49 +++++++-
 45 files changed, 811 insertions(+), 284 deletions(-)

diff --git a/.hgtags b/.hgtags
index ec8ed320..8c650902 100644
--- a/.hgtags
+++ b/.hgtags
@@ -51,3 +51,5 @@ e06cb52d1d84618b36ad0aaaa40781defecf002e version_2_2_9
 6345cd24d272070c42b91419962810f58bd06af0 version_2_3RC3
 074d18d3b920bdd41848a904b1a2af5aa40a3ab6 version_2_3_3
 dd39e5e145c73e6dcb62b87dc8b6b195116089a9 unstable_2_3_4
+b5cb2a38213b8638e6ece671e0c15796177ae3a9 version_2_3_4
+bbd75fe337d100a74505913140dd01a7bd925831 version_2_3_7
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 305329a7..91ba336d 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -10,6 +10,119 @@
 ------------
 This is a changelog for FrontAccounting All releases.
 
+2011-08-31 23:39 +0200 Joe Hunt
+(2874) 0001013: Bank Statement w/Reconcile for print incorporated in core.
+ reporting/rep602.php
+ reporting/reports_main.php
+
+2011-08-19 10:04 +0200 Janusz Dobrowolski
+(2868) Due date should be preserved on purchase invoice edition start.
+ purchasing/includes/db/invoice_db.inc
+
+2011-07-13 14:52 +0200 Joe Hunt
+(2841) Fixed print of taxes on documents
+ reporting/rep107.php
+ reporting/rep109.php
+ reporting/rep110.php
+ reporting/rep209.php
+
+2011-07-13 14:00 +0200 Joe Hunt
+(2840) Rerun of tax_groups.php
+ taxes/tax_groups.php
+
+2011-07-13 10:57 +0200 Joe Hunt
+(2839) Rerun of tax_groups_db.inc
+ taxes/db/tax_groups_db.inc
+
+2011-07-13 10:52 +0200 Joe Hunt
+(2838) Rerun of new tax group and shipping files
+ includes/ui/ui_view.inc
+ taxes/db/tax_groups_db.inc
+ taxes/tax_calc.inc
+ taxes/tax_groups.php
+
+2011-07-12 17:16 +0200 Joe Hunt
+(2837) Update of default COAs
+ sql/en_US-demo.sql
+ sql/en_US-new.sql
+
+2011-07-12 16:50 +0200 Joe Hunt
+(2836) 0000710: Shipping tax on all tax groups. And marking with tax type(s) it shall have.
+ sales/includes/cart_class.inc
+ sql/alter2.4.sql
+ taxes/db/tax_groups_db.inc
+ taxes/tax_calc.inc
+ taxes/tax_groups.php
+
+2011-07-10 23:01 +0200 Janusz Dobrowolski
+(2793) Implemented journal entries with multiply virtual AR/AP subaccounts.
+ admin/db/fiscalyears_db.inc
+ gl/bank_account_reconcile.php
+ gl/gl_journal.php
+ gl/includes/db/gl_db_accounts.inc
+ gl/includes/db/gl_db_trans.inc
+ gl/includes/ui/gl_journal_ui.inc
+ gl/inquiry/bank_inquiry.php
+ gl/view/gl_deposit_view.php
+ gl/view/gl_payment_view.php
+ gl/view/gl_trans_view.php
+ includes/types.inc
+ includes/ui/items_cart.inc
+ includes/ui/ui_lists.inc
+ purchasing/includes/db/invoice_items_db.inc
+ purchasing/includes/ui/invoice_ui.inc
+ reporting/rep601.php
+ reporting/rep702.php
+ sql/alter2.4.sql
+
+2011-05-06 14:07 +0200 Janusz Dobrowolski
+(2767) Added tag unstable_2_3_4 for changeset dd39e5e145c7
+ .hgtags
+
+2011-05-06 14:05 +0200 Janusz Dobrowolski
+(2758) Merged changes up to version 2.3.4 into unstable.
+ CHANGELOG.txt
+ access/login.php
+ access/logout.php
+ admin/create_coy.php
+ admin/db/maintenance_db.inc
+ admin/db/users_db.inc
+ admin/db/voiding_db.inc
+ admin/void_transaction.php
+ config.default.php
+ gl/accruals.php
+ gl/bank_transfer.php
+ gl/gl_bank.php
+ gl/includes/db/gl_db_bank_accounts.inc
+ gl/includes/db/gl_db_bank_trans.inc
+ gl/includes/db/gl_db_banking.inc
+ gl/includes/db/gl_db_rates.inc
+ gl/includes/db/gl_db_trans.inc
+ gl/includes/ui/gl_bank_ui.inc
+ gl/inquiry/bank_inquiry.php
+ gl/inquiry/gl_trial_balance.php
+ gl/manage/gl_account_types.php
+ gl/manage/gl_accounts.php
+ gl/view/gl_trans_view.php
+ includes/access_levels.inc
+ includes/data_checks.inc
+ includes/date_functions.inc
+ includes/db/connect_db.inc
+ includes/db/inventory_db.inc
+ includes/db/manufacturing_db.inc
+ includes/errors.inc
+ includes/hooks.inc
+ includes/lang/gettext.php
+ includes/packages.inc
+ includes/references.inc
+ includes/types.inc
+ includes/ui/items_cart.inc
+ includes/ui/ui_controls.inc
+ includes/ui/ui_input.inc
+ includes/ui/ui_msgs.inc
+ includes/ui/ui_view.inc
+ js/login.js
+
 2011-04-27 22:03 +0200 Janusz Dobrowolski
 (2743) Added Purchase Invice edition.
  includes/app_entries.inc
diff --git a/admin/backups.php b/admin/backups.php
index 2193486b..8d7bfbc0 100644
--- a/admin/backups.php
+++ b/admin/backups.php
@@ -33,8 +33,11 @@ if (get_post('view')) {
 	}
 };
 if (get_post('download')) {
-	download_file(BACKUP_PATH . clean_file_name(get_post('backups')));
-	exit;
+	if (get_post('backups')) {
+		download_file(BACKUP_PATH . clean_file_name(get_post('backups')));
+		exit;
+	} else
+		display_error(_("Select backup file first."));
 }
 
 page(_($help_context = "Backup and Restore Database"), false, false, '', '');
@@ -131,19 +134,25 @@ if (get_post('creat')) {
 };
 
 if (get_post('restore')) {
-	if (db_import($backup_path, $conn))
-		display_notification(_("Restore backup completed."));
-	refresh_sys_prefs(); // re-read system setup
+	if ($backup_name) {
+		if (db_import($backup_path, $conn))
+			display_notification(_("Restore backup completed."));
+		refresh_sys_prefs(); // re-read system setup
+	} else
+		display_error(_("Select backup file first."));
 }
 
 if (get_post('deldump')) {
-	if (unlink($backup_path)) {
-		display_notification(_("File successfully deleted.")." "
-				. _("Filename") . ": " . $backup_name);
-		$Ajax->activate('backups');
-	}
-	else
-		display_error(_("Can't delete backup file."));
+	if ($backup_name) {
+		if (unlink($backup_path)) {
+			display_notification(_("File successfully deleted.")." "
+					. _("Filename") . ": " . $backup_name);
+			$Ajax->activate('backups');
+		}
+		else
+			display_error(_("Can't delete backup file."));
+	} else
+		display_error(_("Select backup file first."));
 }
 
 if (get_post('upload'))
@@ -151,14 +160,18 @@ if (get_post('upload'))
 	$tmpname = $_FILES['uploadfile']['tmp_name'];
 	$fname = trim(basename($_FILES['uploadfile']['name']));
 
-	if (!preg_match("/\.sql(\.zip|\.gz)?$/", $fname))
-		display_error(_("You can only upload *.sql backup files"));
-	elseif (is_uploaded_file($tmpname)) {
-		rename($tmpname, BACKUP_PATH . $fname);
-		display_notification( "File uploaded to backup directory");
-		$Ajax->activate('backups');
+	if ($fname) {
+		if (!preg_match("/\.sql(\.zip|\.gz)?$/", $fname))
+			display_error(_("You can only upload *.sql backup files"));
+		elseif (is_uploaded_file($tmpname)) {
+			rename($tmpname, BACKUP_PATH . $fname);
+			display_notification( "File uploaded to backup directory");
+			$Ajax->activate('backups');
+		} else
+			display_error(_("File was not uploaded into the system."));
 	} else
-		display_error(_("File was not uploaded into the system."));
+		display_error(_("Select backup file first."));
+
 }
 //-------------------------------------------------------------------------------
 start_form(true, true);
@@ -173,8 +186,8 @@ table_section(2);
 table_section_title(_("Backup scripts maintenance"));
 
 	start_row();
-	echo "<td style='padding-left:20px'align='left'>".get_backup_file_combo()."</td>";
-	echo "<td valign='top'>";
+	echo "<td style='padding-left:20px' align='left'>".get_backup_file_combo()."</td>";
+	echo "<td style='padding-left:20px' valign='top'>";
 	start_table();
 	submit_row('view',_("View Backup"), false, '', '', false);
 	submit_row('download',_("Download Backup"), false, '', '', false);
@@ -189,7 +202,7 @@ table_section_title(_("Backup scripts maintenance"));
 	end_row();
 start_row();
 echo "<td style='padding-left:20px' align='left'><input name='uploadfile' type='file'></td>";
-	submit_cells('upload',_("Upload file"),'', '', true);
+	submit_cells('upload',_("Upload file"),"style='padding-left:20px'", '', true);
 end_row();
 end_outer_table();
 
diff --git a/admin/change_current_user_password.php b/admin/change_current_user_password.php
index 247517a2..4ed37fb0 100644
--- a/admin/change_current_user_password.php
+++ b/admin/change_current_user_password.php
@@ -47,7 +47,7 @@ function can_process()
 	return true;
 }
 
-if (isset($_POST['UPDATE_ITEM']))
+if (isset($_POST['UPDATE_ITEM']) && check_csrf_token())
 {
 
 	if (can_process())
diff --git a/admin/create_coy.php b/admin/create_coy.php
index 66d01d1d..afb02660 100644
--- a/admin/create_coy.php
+++ b/admin/create_coy.php
@@ -238,8 +238,8 @@ function display_companies()
 
 	echo "
 		<script language='javascript'>
-		function deleteCompany(id) {
-			if (!confirm('" . _("Are you sure you want to delete company no. ") . "'+id))
+		function deleteCompany(id, name) {
+			if (!confirm('" . _("Are you sure you want to delete company no. ") . "'+id+' '+name+'?'))
 				return
 			document.location.replace('create_coy.php?c=df&id='+id)
 		}
@@ -278,8 +278,9 @@ function display_companies()
 			$delete = set_icon(ICON_DELETE, $delete);
 		}
     	label_cell("<a href='" . $_SERVER['PHP_SELF']. "?selected_id=$i'>$edit</a>");
+    	$name = "\"".$conn[$i]['name']."\"";
 		label_cell( $i == $coyno ? '' :
-			"<a href='javascript:deleteCompany(" . $i . ")'>$delete</a>");
+			"<a href='javascript:deleteCompany($i, $name)'>$delete</a>");
 		end_row();
 	}
 
@@ -320,6 +321,7 @@ function display_company_edit($selected_id)
 		$_POST['tbpref'] = $tb_pref_counter."_";
 		// Insert the current settings as default
 		$conn = $db_connections[user_company()];
+		$_POST['name'] = '';
 		$_POST['host']  = $conn['host'];
 		$_POST['dbuser']  = $conn['dbuser'];
 		$_POST['dbpassword']  = $conn['dbpassword'];
diff --git a/admin/crm_categories.php b/admin/crm_categories.php
index bf24403e..b06c618a 100644
--- a/admin/crm_categories.php
+++ b/admin/crm_categories.php
@@ -101,7 +101,7 @@ while ($myrow = db_fetch($result))
 	label_cell($myrow["name"]);
 	label_cell($myrow["description"]);
 	
-	inactive_control_cell($myrow["id"], $myrow["inactive"], 'areas', 'id');
+	inactive_control_cell($myrow["id"], $myrow["inactive"], 'crm_categories', 'id');
 
  	edit_button_cell("Edit".$myrow["id"], _("Edit"));
  	if ($myrow["system"])
diff --git a/admin/db/company_db.inc b/admin/db/company_db.inc
index fdb14a63..1a01ec63 100644
--- a/admin/db/company_db.inc
+++ b/admin/db/company_db.inc
@@ -38,9 +38,6 @@ function get_company_pref($prefs = null)
 
 		$_SESSION['SysPrefs'] = new sys_prefs();
 
-		if (!isset($company))
-			$company = user_company();
-
 		$sql = "SELECT name, value FROM ".TB_PREF."sys_prefs";
 		$result = @db_query($sql); // supress errors before 2.3 db structure upgrade
 
@@ -71,7 +68,7 @@ function get_company_pref($prefs = null)
 		return $ret;
 }
 
-function get_company_prefs()
+function set_company_pref($pref, $category, $type, $length, $value)
 {
 	return get_company_pref(null);
 }
@@ -187,7 +184,7 @@ function key_in_foreign_table($id, $tables, $stdkey, $escaped=false)
 			$tbl = $key;
 			$key = $stdkey;
 		}
-		$sqls[] = "(SELECT COUNT(*) as cnt FROM ".TB_PREF."$tbl WHERE $key=$id)\n";
+		$sqls[] = "(SELECT COUNT(*) as cnt FROM `".TB_PREF."$tbl` WHERE `$key`=".db_escape($id).")\n";
 	}
 
 	$sql = "SELECT sum(cnt) FROM (". implode(' UNION ', $sqls).") as counts";
diff --git a/admin/db/fiscalyears_db.inc b/admin/db/fiscalyears_db.inc
index ec00e067..8cb84044 100644
--- a/admin/db/fiscalyears_db.inc
+++ b/admin/db/fiscalyears_db.inc
@@ -81,6 +81,18 @@ function is_date_in_fiscalyears($date, $closed=true)
 	return db_fetch($result) !== false;
 }
 
+function get_fiscalyear_begin_for_date($date)
+{
+ 	$date = date2sql($date);
+	$sql = "SELECT begin FROM ".TB_PREF."fiscal_year WHERE '$date' >= begin AND '$date' <= end";
+	$result = db_query($sql, "could not get begin date of the fiscal year");
+	$row = db_fetch_row($result);
+	if ($row != false)
+		return sql2date($row[0]);
+	else
+		return begin_fiscalyear();
+}
+
 function check_begin_end_date($date1, $date2)
 {
 	$sql = "SELECT MAX(end), MIN(begin) FROM ".TB_PREF."fiscal_year";
@@ -166,6 +178,10 @@ function open_year($year)
 {
 	$myrow = get_fiscalyear($year);
 	$from = sql2date($myrow['begin']);
+
+	begin_transaction();
+	close_transactions(add_days($from, -1));
+	commit_transaction();
 }
 
 //---------------------------------------------------------------------------------------------
@@ -324,10 +340,12 @@ function delete_this_fiscalyear($selected_id)
 	
 	$sql = "SELECT account, SUM(amount) AS amount, person_type_id, person_id FROM "
 		.TB_PREF."gl_trans WHERE tran_date <= '$to' GROUP by account, person_type_id, person_id";
+	$sql = "SELECT account, SUM(amount) AS amount FROM ".TB_PREF."gl_trans WHERE tran_date <= '$to' GROUP by account";
 	$result = db_query($sql, "Could not retrieve gl trans");
 	$trans_no = get_next_trans_no(ST_JOURNAL);
 
 	$last_account='';
+	$new = false;
 	while ($row = db_fetch($result))
 	{
 		if ($last_account != $row['account']) // deletes all subledgers postings, so do it once for account
@@ -344,7 +362,16 @@ function delete_this_fiscalyear($selected_id)
 			db_query($sql, "Could not insert gl trans");
 		}
 	}
-	
+	if ($new)
+	{
+		global $Refs;
+		$trans_type = ST_JOURNAL;
+		$reference = $Refs->get_next($trans_type);
+		$Refs->save($trans_type, $trans_no, $reference);
+		$date_ = sql2date($to);
+
+		add_audit_trail($trans_type, $trans_no, $date_);
+	}
 	$sql = "SELECT bank_act, SUM(amount) AS amount FROM ".TB_PREF."bank_trans WHERE trans_date <= '$to' GROUP BY bank_act";
 	$result = db_query($sql, "Could not retrieve bank trans");
 	while ($row = db_fetch($result))
diff --git a/admin/db/transactions_db.inc b/admin/db/transactions_db.inc
index 0233bc50..293e8f4d 100644
--- a/admin/db/transactions_db.inc
+++ b/admin/db/transactions_db.inc
@@ -50,6 +50,11 @@ function get_sql_for_view_transactions($filtertype, $from, $to, &$trans_ref)
 	elseif ($type_name != null)
 		$sql .= " AND t.`$type_name` = ".db_escape($filtertype);
 
+	// the ugly hack below is necessary to exclude old gl_trans records lasting after edition,
+	// otherwise old data transaction can be retrieved instead of current one.
+	if ($table_name==TB_PREF.'gl_trans')
+		$sql .= " AND t.`amount` <> 0";
+
 	$sql .= " GROUP BY ".($type_name ? "t.$type_name," : '')." t.$trans_no_name";
 	$sql .= " ORDER BY t.$trans_no_name";
 	return $sql;
diff --git a/admin/db/users_db.inc b/admin/db/users_db.inc
index 3d7645ce..3711066e 100644
--- a/admin/db/users_db.inc
+++ b/admin/db/users_db.inc
@@ -21,7 +21,7 @@ function add_user($user_id, $real_name, $password, $phone, $email, $role_id,
 		.", ".db_escape($pos).",".db_escape($profile).",".db_escape($rep_popup)
 		." )";
 
-	db_query($sql, "could not add user for $user_id");
+	return db_query($sql, "could not add user for $user_id");
 }
 
 //-----------------------------------------------------------------------------------------------
@@ -31,7 +31,7 @@ function update_user_password($id, $user_id, $password)
 	$sql = "UPDATE ".TB_PREF."users SET password=".db_escape($password) . ",
 		user_id = ".db_escape($user_id). " WHERE id=".db_escape($id);
 
-	db_query($sql, "could not update user password for $user_id");
+	return db_query($sql, "could not update user password for $user_id");
 }
 
 //-----------------------------------------------------------------------------------------------
@@ -49,7 +49,7 @@ function update_user($id, $user_id, $real_name, $phone, $email, $role_id,
 		pos=".db_escape($pos).",
 		user_id = " . db_escape($user_id)
 		. " WHERE id=" . db_escape($id);
-	db_query($sql, "could not update user for $user_id");
+	return db_query($sql, "could not update user for $user_id");
 }
 
 //-----------------------------------------------------------------------------------------------
@@ -110,7 +110,10 @@ function delete_user($id)
 }
 
 //-----------------------------------------------------------------------------------------------
-
+//
+//	Obsolete, to be removed in 2.4. This function as been spleet into get_user_auth/get_user_by_login
+//	in FA 2.3.6
+//
 function get_user_for_login($user_id, $password)
 {
 	set_global_connection();
@@ -125,6 +128,18 @@ function get_user_for_login($user_id, $password)
 
 //-----------------------------------------------------------------------------------------------
 
+function get_user_auth($user_id, $password)
+{
+	set_global_connection();
+
+	$sql = "SELECT * FROM ".TB_PREF."users WHERE user_id = ".db_escape($user_id)." AND"
+		." password=".db_escape($password);
+
+	return db_num_rows(db_query($sql, "could not get validate user login for $user_id")) != 0;
+}
+
+//-----------------------------------------------------------------------------------------------
+
 function update_user_visitdate($user_id)
 {
 	$sql = "UPDATE ".TB_PREF."users SET last_visit_date='". date("Y-m-d H:i:s") ."'
diff --git a/admin/db/voiding_db.inc b/admin/db/voiding_db.inc
index 00b3eb4d..faba6ea5 100644
--- a/admin/db/voiding_db.inc
+++ b/admin/db/voiding_db.inc
@@ -29,24 +29,27 @@ function void_transaction($type, $type_no, $date_, $memo_)
 			void_journal_trans($type, $type_no);
 			break;
 
-		case ST_BANKPAYMENT : // it's a payment
 		case ST_BANKDEPOSIT : // it's a deposit
 		case ST_BANKTRANSFER : // it's a transfer
+			if (!check_void_bank_trans($type, $type_no))
+				return false;
+		case ST_BANKPAYMENT : // it's a payment
 			if (!exists_bank_trans($type, $type_no))
 				return false;
 			void_bank_trans($type, $type_no);
 			break;
 
+		case ST_CUSTPAYMENT : // it's a customer payment
+			if (!check_void_bank_trans($type, $type_no))
+				return false;
 		case ST_SALESINVOICE : // it's a customer invoice
 		case ST_CUSTCREDIT : // it's a customer credit note
-		case ST_CUSTPAYMENT : // it's a customer payment
 		case ST_CUSTDELIVERY : // it's a customer dispatch
 			if (!exists_customer_trans($type, $type_no))
 				return false;
 			if ($type == ST_CUSTDELIVERY)	// added 04 Oct 2008 by Joe Hunt. If delivery note has a not voided invoice, then NO.
 			{
-				$childs = get_sales_child_lines($type, $type_no, false);
-
+				$childs = get_sales_child_lines($type, $type_no, false); // 2011-03-17 This had been changed. Joe
 				if ($childs && db_num_rows($childs))
 						return false;
 			}
@@ -66,8 +69,11 @@ function void_transaction($type, $type_no, $date_, $memo_)
 			break;
 
 		case ST_PURCHORDER : // it's a PO
-		case ST_SUPPRECEIVE : // it's a GRN
 			return false;
+
+		case ST_SUPPRECEIVE : // it's a GRN
+			if (exists_grn_on_invoices($type_no))
+				return false;
 		case ST_SUPPINVOICE : // it's a suppler invoice
 		case ST_SUPPCREDIT : // it's a supplier credit note
 		case ST_SUPPAYMENT : // it's a supplier payment
diff --git a/admin/gl_setup.php b/admin/gl_setup.php
index 49710317..1263be92 100644
--- a/admin/gl_setup.php
+++ b/admin/gl_setup.php
@@ -47,7 +47,7 @@ function can_process()
 	}
 
 	$grn_act = get_company_pref('grn_clearing_act');
-	if (get_post('grn_clearing_act') != $grn_act && db_num_rows(get_grn_items(0, '', true)))
+	if ((get_post('grn_clearing_act',0) != $grn_act) && db_num_rows(get_grn_items(0, '', true)))
 	{
 		display_error(_("Before GRN Clearing Account can be changed all GRNs have to be invoiced"));
 		$_POST['grn_clearing_act'] = $grn_act;
diff --git a/admin/inst_module.php b/admin/inst_module.php
index 0e7cb534..f467ce5f 100644
--- a/admin/inst_module.php
+++ b/admin/inst_module.php
@@ -154,7 +154,6 @@ function display_extensions()
 	end_table(1);
 
 	submit_center_first('Refresh', _("Update"), '', null);
-	submit_center_last('Add', _("Add third-party extension"), '', false);
 
 	div_end();
 }
diff --git a/admin/users.php b/admin/users.php
index 9fde1d93..c1de0027 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -55,7 +55,7 @@ function can_process()
 
 //-------------------------------------------------------------------------------------------------
 
-if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM') 
+if (($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM') && check_csrf_token())
 {
 
 	if (can_process())
@@ -91,7 +91,7 @@ if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
 
 //-------------------------------------------------------------------------------------------------
 
-if ($Mode == 'Delete')
+if ($Mode == 'Delete' && check_csrf_token())
 {
 	delete_user($selected_id);
 	display_notification_centered(_("User has been deleted."));
diff --git a/admin/void_transaction.php b/admin/void_transaction.php
index 6e84a17c..87d9a3b0 100644
--- a/admin/void_transaction.php
+++ b/admin/void_transaction.php
@@ -70,8 +70,13 @@ function exist_transaction($type, $type_no)
 			break;
 
 		case ST_PURCHORDER : // it's a PO
-		case ST_SUPPRECEIVE : // it's a GRN
 			return false;
+
+		case ST_SUPPRECEIVE : // it's a GRN
+			if (exists_grn_on_invoices($type_no))
+				return false;
+			break;
+
 		case ST_SUPPINVOICE : // it's a suppler invoice
 		case ST_SUPPCREDIT : // it's a supplier credit note
 		case ST_SUPPAYMENT : // it's a supplier payment
@@ -140,8 +145,7 @@ function voiding_controls()
 {
 	global $selected_id;
 
-	$not_implemented =  array(ST_PURCHORDER, ST_SUPPRECEIVE, ST_SALESORDER, 
-		ST_SALESQUOTE, ST_COSTUPDATE);
+	$not_implemented =  array(ST_PURCHORDER, ST_SALESORDER, ST_SALESQUOTE, ST_COSTUPDATE);
 
 	start_form();
 
diff --git a/gl/bank_account_reconcile.php b/gl/bank_account_reconcile.php
index b6a5355d..9a260037 100644
--- a/gl/bank_account_reconcile.php
+++ b/gl/bank_account_reconcile.php
@@ -86,7 +86,7 @@ function fmt_credit($row)
 	return $value>0 ? price_format($value) : '';
 }
 
-function fmt_person($row)
+function fmt_person($trans)
 {
 	return get_counterparty_name($trans["type"], $trans["trans_no"]);
 }
diff --git a/gl/bank_transfer.php b/gl/bank_transfer.php
index 14e49248..7e293af1 100644
--- a/gl/bank_transfer.php
+++ b/gl/bank_transfer.php
@@ -132,12 +132,21 @@ function check_valid_entries()
 
 	$limit = get_bank_account_limit($_POST['FromBankAccount'], $_POST['DatePaid']);
 
-	if ($limit != null && ($limit < (input_num('charge') + input_num('amount'))))
+	$amnt_tr = input_num('charge') + input_num('amount');
+
+	if ($limit != null && ($limit < $amnt_tr))
 	{
 		display_error(sprintf(_("The total bank amount exceeds allowed limit (%s) for source account."), price_format($limit)));
 		set_focus('amount');
 		return false;
 	}
+	if ($trans = check_bank_account_history(-$amnt_tr, $_POST['FromBankAccount'], $_POST['DatePaid'])) {
+
+		display_error(sprintf(_("The bank transaction would result in exceed of authorized overdraft limit for transaction: %s #%s on %s."),
+			$systypes_array[$trans['type']], $trans['trans_no'], sql2date($trans['trans_date'])));
+		set_focus('amount');
+		$input_error = 1;
+	}
 
 	if (isset($_POST['charge']) && !check_num('charge', 0)) 
 	{
diff --git a/gl/gl_bank.php b/gl/gl_bank.php
index 613e0362..9dc73c54 100644
--- a/gl/gl_bank.php
+++ b/gl/gl_bank.php
@@ -77,6 +77,8 @@ if (isset($_GET['AddedID']))
 
 	hyperlink_params($_SERVER['PHP_SELF'], _("Enter A &Deposit"), "NewDeposit=yes");
 
+	hyperlink_params("$path_to_root/admin/attachments.php", _("Add an Attachment"), "filterType=$trans_type&trans_no=$trans_no");
+
 	display_footer_exit();
 }
 
@@ -140,8 +142,9 @@ function create_cart($type, $trans_no)
 	{
 		unset ($_SESSION['pay_items']);
 	}
-	
+
 	check_is_closed($type, $trans_no);
+
 	$cart = new items_cart($type);
     $cart->order_id = $trans_no;
 
@@ -227,13 +230,21 @@ if (isset($_POST['Process']))
 
 	$limit = get_bank_account_limit($_POST['bank_account'], $_POST['date_']);
 
-	if ($limit != null && (($limit - $_SESSION['pay_items']->original_amount) < $_SESSION['pay_items']->gl_items_total()))
+	$amnt_chg = -$_SESSION['pay_items']->gl_items_total()-$_SESSION['pay_items']->original_amount;
+
+	if ($limit != null && ($limit + $amnt_chg < 0))
 	{
 		display_error(sprintf(_("The total bank amount exceeds allowed limit (%s)."), price_format($limit-$_SESSION['pay_items']->original_amount)));
 		set_focus('code_id');
 		$input_error = 1;
 	}
+	if ($trans = check_bank_account_history($amnt_chg, $_POST['bank_account'], $_POST['date_'])) {
 
+		display_error(sprintf(_("The bank transaction would result in exceed of authorized overdraft limit for transaction: %s #%s on %s."),
+			$systypes_array[$trans['type']], $trans['trans_no'], sql2date($trans['trans_date'])));
+		set_focus('amount');
+		$input_error = 1;
+	}
 	if (!$Refs->is_valid($_POST['ref']))
 	{
 		display_error( _("You must enter a reference."));
diff --git a/gl/gl_journal.php b/gl/gl_journal.php
index 5cc96652..107c6d63 100644
--- a/gl/gl_journal.php
+++ b/gl/gl_journal.php
@@ -59,6 +59,8 @@ if (isset($_GET['AddedID']))
 	reset_focus();
 	hyperlink_params($_SERVER['PHP_SELF'], _("Enter &New Journal Entry"), "NewJournal=Yes");
 
+	hyperlink_params("$path_to_root/admin/attachments.php", _("Add an Attachment"), "filterType=$trans_type&trans_no=$trans_no");
+
 	display_footer_exit();
 } elseif (isset($_GET['UpdatedID'])) 
 {
@@ -313,7 +315,7 @@ if (isset($_POST['CancelItemChanges']))
 
 if (isset($_POST['go']))
 {
-	display_quick_entries($_SESSION['journal_items'], $_POST['quick'], input_num('totamount'), QE_JOURNAL);
+	display_quick_entries($_SESSION['journal_items'], $_POST['person_id'], input_num('totamount'), QE_JOURNAL);
 	$_POST['totamount'] = price_format(0); $Ajax->activate('totamount');
 	line_start_focus();
 }	
diff --git a/gl/includes/db/gl_db_accounts.inc b/gl/includes/db/gl_db_accounts.inc
index 3ba13334..904d1e63 100644
--- a/gl/includes/db/gl_db_accounts.inc
+++ b/gl/includes/db/gl_db_accounts.inc
@@ -103,7 +103,7 @@ function gl_account_in_company_defaults($acc)
 		OR name='default_cogs_act'
 		OR name='default_adj_act'
 		OR name='default_inv_sales_act'
-		OR name='default_assembly_act') AND value=$acc";
+		OR name='default_assembly_act') AND value=".db_escape($acc);
 	$result = db_query($sql,"Couldn't test for default company GL codes");
 
 	$myrow = db_fetch_row($result);
@@ -205,4 +205,99 @@ function get_subaccount_name($code_id, $person_id)
 	return  $row ? $row['ref'] : '';
 }
 
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_stock_category($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."stock_category WHERE 
+		dflt_inventory_act=$acc 
+		OR dflt_cogs_act=$acc
+		OR dflt_adjustment_act=$acc 
+		OR dflt_sales_act=$acc";
+	$result = db_query($sql,"Couldn't test for existing stock category GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_stock_master($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."stock_master WHERE 
+		inventory_account=$acc 
+		OR cogs_account=$acc
+		OR adjustment_account=$acc 
+		OR sales_account=$acc";
+	$result = db_query($sql,"Couldn't test for existing stock GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_tax_types($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."tax_types WHERE sales_gl_code=$acc OR purchasing_gl_code=$acc";
+	$result = db_query($sql,"Couldn't test for existing tax GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_cust_branch($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."cust_branch WHERE 
+		sales_account=$acc 
+		OR sales_discount_account=$acc
+		OR receivables_account=$acc
+		OR payment_discount_account=$acc";
+	$result = db_query($sql,"Couldn't test for existing cust branch GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_suppliers($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."suppliers WHERE 
+		purchase_account=$acc
+		OR payment_discount_account=$acc
+		OR payable_account=$acc";
+	$result = db_query($sql,"Couldn't test for existing suppliers GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_quick_entry_lines($acc)
+{
+	$acc = db_escape($acc);
+
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."quick_entry_lines WHERE 
+		dest_id=$acc AND UPPER(LEFT(action, 1)) <> 'T'";
+	$result = db_query($sql,"Couldn't test for existing Quick Entry Line GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
+
+function gl_account_in_bank_accounts($acc)
+{
+	$sql= "SELECT COUNT(*) FROM ".TB_PREF."bank_accounts WHERE 
+		account_code=".db_escape($acc);
+	$result = db_query($sql,"Couldn't test bank account GL codes");
+
+	$myrow = db_fetch_row($result);
+	return ($myrow[0] > 0); 
+}
 ?>
\ No newline at end of file
diff --git a/gl/includes/db/gl_db_bank_accounts.inc b/gl/includes/db/gl_db_bank_accounts.inc
index 0850dfe0..1669d200 100644
--- a/gl/includes/db/gl_db_bank_accounts.inc
+++ b/gl/includes/db/gl_db_bank_accounts.inc
@@ -315,6 +315,24 @@ function get_default_bank_account($curr)
 
 	return db_fetch($result);
 }
+
+function get_default_customer_bank_account($cust_id)
+{
+	$sql = "SELECT curr_code FROM ".TB_PREF."debtors_master WHERE debtor_no=".db_escape($cust_id);
+	$result = db_query($sql, "could not retreive default customer currency code");
+	$row = db_fetch_row($result);
+	$ba = get_default_bank_account($row[0]);
+	return $ba['id'];
+}
+
+function get_default_supplier_bank_account($supplier_id)
+{
+	$sql = "SELECT curr_code FROM ".TB_PREF."suppliers WHERE supplier_id=".db_escape($supplier_id);
+	$result = db_query($sql, "could not retreive default supplier currency code");
+	$row = db_fetch_row($result);
+	$ba = get_default_bank_account($row[0]);
+	return $ba['id'];
+}
 //---------------------------------------------------------------------------------------------
 //
 //	This function returns current allowed bank payment limit, or null if limit is not set.
diff --git a/gl/includes/db/gl_db_bank_trans.inc b/gl/includes/db/gl_db_bank_trans.inc
index a0aab62e..f11a5698 100644
--- a/gl/includes/db/gl_db_bank_trans.inc
+++ b/gl/includes/db/gl_db_bank_trans.inc
@@ -87,11 +87,13 @@ function get_bank_trans_for_bank_account($bank_account, $from, $to)
 {
 	$from = date2sql($from);
 	$to = date2sql($to);
-	$sql = "SELECT ".TB_PREF."bank_trans.* FROM ".TB_PREF."bank_trans
-		WHERE ".TB_PREF."bank_trans.bank_act = ".db_escape($bank_account) . "
+	$sql = "SELECT t.* FROM "
+		.TB_PREF."bank_trans t LEFT JOIN ".TB_PREF."voided v ON t.type=v.type AND t.trans_no=v.id
+		WHERE t.bank_act = ".db_escape($bank_account) . "
+		AND ISNULL(v.date_)
 		AND trans_date >= '$from'
 		AND trans_date <= '$to'
-		ORDER BY trans_date,".TB_PREF."bank_trans.id";
+		ORDER BY trans_date, t.id";
 
 	return db_query($sql,"The transactions for '" . $bank_account . "' could not be retrieved");
 }
@@ -126,6 +128,7 @@ function get_gl_trans_value($account, $type, $trans_no)
 
 function void_bank_trans($type, $type_no, $nested=false)
 {
+
 	if (!$nested)
 		begin_transaction();
 
@@ -150,4 +153,49 @@ function void_bank_trans($type, $type_no, $nested=false)
 		commit_transaction();
 }
 
-?>
\ No newline at end of file
+/**
+*	Check account history to find transaction which would exceed authorized overdraft for given account.
+*	Returns null or transaction in conflict.
+*	$delta_amount - tested change in bank balance at $date.
+**/
+function check_bank_account_history($delta_amount, $bank_account, $date, $user=null)
+{
+	if ($delta_amount >= 0)
+		 return null;	// amount increese is always safe
+
+	$balance = get_bank_account_limit($bank_account, $date, $user);
+
+	if (!isset($balance))
+		return null;	// unlimited account
+
+	$date = date2sql($date);
+	$balance+= $delta_amount;
+
+	$sql = "SELECT * FROM ".TB_PREF."bank_trans WHERE bank_act=".db_escape($bank_account)." AND trans_date > '$date' ORDER BY trans_date ASC, id ASC";
+
+	$history = db_query($sql, "cannot retrieve cash account history");
+
+	while ($trans = db_fetch($history)) {
+		$balance += $trans['amount'];
+		if ($balance < 0)
+			return $trans;
+	}
+
+	return null;
+}
+
+/**
+*	Check bank transfer, deposit or customer deposit before voiding.
+**/
+function check_void_bank_trans($type, $type_no)
+{
+	$moves = get_bank_trans($type, $type_no);
+	while ($trans = db_fetch($moves)) {
+		if ($trans['amount'] > 0) { // skip transfer input part
+			return check_bank_account_history(-$trans['amount'], $trans['bank_act'], sql2date($trans['trans_date'])) == null;
+		}
+	}
+	return true;
+}
+
+?>
diff --git a/gl/includes/db/gl_db_banking.inc b/gl/includes/db/gl_db_banking.inc
index 25fc491f..2bb5a1c8 100644
--- a/gl/includes/db/gl_db_banking.inc
+++ b/gl/includes/db/gl_db_banking.inc
@@ -49,6 +49,73 @@ function add_exchange_variation($trans_no, $date_, $acc_id, $account,
 	return ($diff != 0);
 }
 
+//------------- New helper functions for revaluation of customer/supplier currencies 2011-05-08 Joe Hunt.
+function add_cust_supp_revaluation($ledger_act, $ex_act, $date, $amount, $person_type_id, $person_id, $memo)
+{
+	global $Refs;
+	if ($amount == 0)
+		return;
+	$trans_no = get_next_trans_no(ST_JOURNAL);
+	add_gl_trans(ST_JOURNAL, $trans_no, $date, $ledger_act, 0, 0, _("Exchange Variance"),
+		$amount, null, $person_type_id, $person_id);
+	add_gl_trans(ST_JOURNAL, $trans_no, $date, $ex_act, 0, 0, 
+		_("Exchange Variance"),	-$amount, null, $person_type_id, $person_id);
+	add_comments(ST_JOURNAL, $trans_no, $date, $memo);
+	$ref = $Refs->get_next(ST_JOURNAL);
+	$Refs->save(ST_JOURNAL, $trans_no, $ref);
+	add_audit_trail(ST_JOURNAL, $trans_no, $date);
+}
+
+function get_cust_account_curr_balances($date)
+{
+	$to = date2sql($date);
+
+    $sql = "SELECT SUM(IF(t.type =".ST_CUSTCREDIT." OR t.type = ".ST_CUSTPAYMENT." OR t.type = ".ST_BANKDEPOSIT.",
+			-(t.ov_amount + t.ov_gst + t.ov_freight + t.ov_freight_tax + t.ov_discount), 
+	    	(t.ov_amount + t.ov_gst + t.ov_freight + t.ov_freight_tax + t.ov_discount))) AS amount,
+	    	dt.debtor_no, dt.name, dt.curr_code, b.receivables_account
+		FROM ".TB_PREF."debtor_trans t 
+			LEFT JOIN ".TB_PREF."debtors_master dt ON t.debtor_no = dt.debtor_no
+			LEFT JOIN ".TB_PREF."cust_branch b ON t.debtor_no = b.debtor_no
+			LEFT JOIN ".TB_PREF."voided as v ON v.type = t.type and v.id=t.trans_no
+    	WHERE ISNULL(v.date_) AND t.type <> ".ST_CUSTDELIVERY." AND t.tran_date <= '$to' 
+    		AND t.branch_code=b.branch_code AND dt.curr_code<>'".get_company_pref('curr_default')."' 
+    		GROUP BY t.debtor_no, b.receivables_account";
+
+    $result = db_query($sql,"Open balances in foreign currency for cannot be retrieved");
+	return  $result;
+}
+
+function get_supp_account_curr_balances($date)
+{
+	$to = date2sql($date);
+
+    $sql = "SELECT SUM(-(t.ov_amount + t.ov_gst + t.ov_discount)) AS amount,
+	    	supp.supplier_id, supp.supp_name, supp.curr_code, supp.payable_account
+		FROM ".TB_PREF."supp_trans t 
+			LEFT JOIN ".TB_PREF."suppliers supp ON t.supplier_id = supp.supplier_id
+			LEFT JOIN ".TB_PREF."voided as v ON v.type = t.type and v.id=t.trans_no
+    	WHERE ISNULL(v.date_) AND t.tran_date <= '$to' 
+    		AND supp.curr_code<>'".get_company_pref('curr_default')."' 
+    		GROUP BY t.supplier_id";
+
+    $result = db_query($sql,"Open balances in foreign currency for cannot be retrieved");
+	return  $result;
+}
+
+function get_account_home_balance($person_id, $person_type, $rec_account, $to_date)
+{
+	$to = date2sql($to_date);
+
+    $sql = "SELECT SUM(amount) FROM ".TB_PREF."gl_trans  
+			WHERE person_id=".db_escape($person_id)." AND account='$rec_account' 
+			AND person_type_id=$person_type AND tran_date <= '$to'";
+	$result = db_query($sql, "The AR/AP balance for customer $person_id could not be calculated");
+	$row = db_fetch_row($result);
+	return $row[0];
+}
+//------------- New helper functions for revaluation of customer/supplier currencies 2011-05-08 Joe Hunt.
+
 function add_exchange_variation_all($date=null, $ref="", $memo)
 {
 	global $Refs;
@@ -71,8 +138,48 @@ function add_exchange_variation_all($date=null, $ref="", $memo)
 		$Refs->save(ST_JOURNAL, $trans_no, $ref);
 		add_audit_trail(ST_JOURNAL, $trans_no, $date);
 	}	
+
+	//------------- BEGIN inserted for revaluation of customer/supplier currencies 2011-05-08 Joe Hunt.
+	if ($date == null)
+		$date = Today();
+	$exchange_act = get_company_pref('exchange_diff_act');
+	$je = 0;
+	// debtors
+	$res = get_cust_account_curr_balances($date);
+	
+	while($row = db_fetch($res)) 
+	{
+		$exrate = get_exchange_rate_from_home_currency($row['curr_code'], $date);
+		$foreign = round2($row['amount']*$exrate, user_price_dec());
+		$home = round2(get_account_home_balance($row['debtor_no'], PT_CUSTOMER, $row['receivables_account'], $date), user_price_dec());
+		if ($foreign != $home) 
+		{
+			$amount = $foreign - $home;	
+			add_cust_supp_revaluation($row['receivables_account'], $exchange_act, $date, $amount, PT_CUSTOMER, 
+				$row['debtor_no'], $memo);
+			$je++;	
+		}
+	}
+	// creditors
+	$res = get_supp_account_curr_balances($date);
+	
+	while($row = db_fetch($res)) 
+	{
+		$exrate = get_exchange_rate_from_home_currency($row['curr_code'], $date);
+		$foreign = round2($row['amount']*$exrate, user_price_dec());
+		$home = round2(get_account_home_balance($row['supplier_id'], PT_SUPPLIER, $row['payable_account'], $date), user_price_dec());
+		if ($foreign != $home) 
+		{
+			$amount = $foreign - $home;	
+			add_cust_supp_revaluation($row['payable_account'], $exchange_act, $date, $amount, PT_SUPPLIER, 
+				$row['supplier_id'], $memo);
+			$je++;	
+		}
+	}
+	//------------- END
+
 	commit_transaction();
-	return ($exchanged ? $trans_no : 0);
+	return array(($exchanged ? $trans_no : 0), $je);
 }
 //----------------------------------------------------------------------------------
 //	Add bank tranfer to database.
@@ -144,7 +251,7 @@ function add_bank_transfer($from_account, $to_account, $date_,
 	if ($SysPrefs->auto_currency_revaluation())
 	{
 		$currency = get_bank_account_currency($to_account);
-	
+
 		if ($exchanged || add_exchange_variation($trans_no1, $date_, $to_account, $to_gl_account,
 			$currency, PT_MISC, $person_id))
 			$exchanged = true;
@@ -199,8 +306,10 @@ function write_bank_transaction($trans_type, $trans_no, $from_account, $items, $
 		$args);
 	hook_db_prewrite($args, $trans_type);
 
-	if ($trans_no)
-		clear_bank_transaction($_SESSION['pay_items']->trans_type, $_SESSION['pay_items']->order_id);
+	if ($trans_no) {
+		void_transaction($trans_type, $trans_no, Today(), _("Document reentered."));
+		$Refs->restore_last($trans_type, $trans_no);
+	}
 
 	$currency = get_bank_account_currency($from_account);
 	$bank_gl_account = get_bank_gl_account($from_account);
@@ -276,13 +385,13 @@ function write_bank_transaction($trans_type, $trans_no, $from_account, $items, $
     		{
     			add_exchange_variation($trans_no1, $date_, $is_bank_to, $gl_item->code_id, 
     				$currency, $person_type_id, $person_id);
-    		}		
+    		}
     	}
 		// store tax details if the gl account is a tax account
 
 		$amount = $gl_item->amount;
 		$ex_rate = get_exchange_rate_from_home_currency($currency, $date_);
-			
+
 		add_gl_tax_details($gl_item->code_id, $trans_type, $trans_no, -$amount,
 			$ex_rate, $date_, $memo_);
 	}
@@ -295,11 +404,11 @@ function write_bank_transaction($trans_type, $trans_no, $from_account, $items, $
     {
     	if ($exchanged || add_exchange_variation($trans_no1, $date_, $from_account, $bank_gl_account, 
     		$currency, $person_type_id, $person_id))
-    	{	
+    	{
    			$ref1 = $Refs->get_next(ST_JOURNAL);
 			$Refs->save(ST_JOURNAL, $trans_no1, $ref1);
 			add_audit_trail(ST_JOURNAL, $trans_no1, $date_);
-		}	
+		}
 	}
 
 	add_comments($trans_type, $trans_no, $date_, $memo_);
@@ -314,30 +423,3 @@ function write_bank_transaction($trans_type, $trans_no, $from_account, $items, $
 
 	return array($trans_type, $trans_no);
 }
-//----------------------------------------------------------------------------------------
-
-function clear_bank_transaction($type, $type_no)
-{
-
-	hook_db_prevoid($type, $type_no);
-
-	$sql = "DELETE FROM ".TB_PREF."bank_trans 
-		WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
-
-	$result = db_query($sql, "could not clear bank transactions for type=$type and trans_no=$type_no");
-
-	clear_gl_trans($type, $type_no, true);
-
-	// in case it's a customer trans - probably better to check first
-	void_cust_allocations($type, $type_no);
-
-	// in case it's a supplier trans - probably better to check first
-	void_supp_allocations($type, $type_no);
-	clear_supp_trans($type, $type_no);
-
-	clear_trans_tax_details($type, $type_no);
-
-	delete_comments($type, $type_no);
-}
-
-?>
\ No newline at end of file
diff --git a/gl/includes/db/gl_db_rates.inc b/gl/includes/db/gl_db_rates.inc
index 88167b2c..5d98dcb7 100644
--- a/gl/includes/db/gl_db_rates.inc
+++ b/gl/includes/db/gl_db_rates.inc
@@ -113,7 +113,8 @@ function get_extern_rate($curr_b, $provider = 'ECB', $date)
     	   curl_setopt ($ch, CURLOPT_HEADER, 0);
 	       curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
 	       // prevent warning while save_mode/open_basedir on (redireciton doesn't occur at least on ECB page)
-    	   @curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
+		   if (!ini_get('save_mode') && !ini_get('open_basedir'))
+    	   	curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
 	       curl_setopt ($ch, CURLOPT_TIMEOUT, 3);
     	   $contents = curl_exec ($ch);
 	       curl_close($ch);
diff --git a/gl/includes/db/gl_db_trans.inc b/gl/includes/db/gl_db_trans.inc
index 078d3446..536143a3 100644
--- a/gl/includes/db/gl_db_trans.inc
+++ b/gl/includes/db/gl_db_trans.inc
@@ -157,6 +157,7 @@ function get_gl_trans($type, $trans_id)
 		LEFT JOIN ".TB_PREF."refs as refs ON (gl.type=refs.type AND gl.type_no=refs.id)"
 		." WHERE gl.type= ".db_escape($type) 
 		." AND gl.type_no = ".db_escape($trans_id)
+		." AND gl.amount <> 0"
 		." ORDER BY counter";
 	return db_query($sql, "The gl transactions could not be retrieved");
 }
@@ -594,7 +595,7 @@ function void_gl_trans($type, $trans_id, $nested=false)
 		commit_transaction();
 }
 
-//--------------------------------------------------------------------------------------------------
+//----------------------------------------------------------------------------------------
 
 function clear_gl_trans($type, $trans_id, $nested=false)
 {
diff --git a/gl/includes/ui/gl_bank_ui.inc b/gl/includes/ui/gl_bank_ui.inc
index af91cef3..1ac37eb7 100644
--- a/gl/includes/ui/gl_bank_ui.inc
+++ b/gl/includes/ui/gl_bank_ui.inc
@@ -20,13 +20,10 @@ function display_bank_header(&$order)
 
 	table_section(1);
 	
-    bank_accounts_list_row( $payment ? _("From:") : _("To:"), 'bank_account', null, true);
-
-    if ($payment)
-		bank_balance_row($_POST['bank_account']);
-
     date_row(_("Date:"), 'date_', '', true, 0, 0, 0, null, true);
 
+	ref_row(_("Reference:"), 'ref', '');
+
 	table_section(2, "33%");
 
 	if (!isset($_POST['PayType']))
@@ -94,15 +91,26 @@ function display_bank_header(&$order)
     	//	break;
     }
 
+	table_section(3, "33%");
+
+	if (!$order->order_id && !list_updated('bank_account'))
+	{
+		if ($_POST['PayType'] == PT_CUSTOMER)
+			$_POST['bank_account'] = get_default_customer_bank_account($_POST['person_id']);
+		elseif ($_POST['PayType'] == PT_SUPPLIER)	
+			$_POST['bank_account'] = get_default_supplier_bank_account($_POST['person_id']);
+		else
+			unset($_POST['bank_account']);
+	}		
+    bank_accounts_list_row( $payment ? _("From:") : _("To:"), 'bank_account', null, true);
+    if ($payment)
+		bank_balance_row($_POST['bank_account']);
+    	
 	$person_currency = payment_person_currency($_POST['PayType'], $_POST['person_id']);
 	$bank_currency = get_bank_account_currency($_POST['bank_account']);
 
 	exchange_rate_display($bank_currency, $person_currency, $_POST['date_']);
 
-	table_section(3, "33%");
-
-	ref_row(_("Reference:"), 'ref', '');
-
 	end_outer_table(1); // outer table
 
 	div_end();
diff --git a/gl/inquiry/balance_sheet.php b/gl/inquiry/balance_sheet.php
index 8bf52757..01dc3c1e 100644
--- a/gl/inquiry/balance_sheet.php
+++ b/gl/inquiry/balance_sheet.php
@@ -57,28 +57,27 @@ function display_type ($type, $typename, $from, $to, $convert, $dimension, $dime
 	//Get Accounts directly under this group/type
 	$result = get_gl_accounts(null, null, $type);	
 		
-	while ($account=db_fetch($result))
-	{
-		$prev_balance = get_gl_balance_from_to("", $from, $account["account_code"], $dimension, $dimension2);
-		$curr_balance = get_gl_trans_from_to($from, $to, $account["account_code"], $dimension, $dimension2);
-		if (!$prev_balance && !$curr_balance)
-			continue;
-		
-		if ($drilldown && $levelptr == 0)
-		{
-			$url = "<a href='$path_to_root/gl/inquiry/gl_account_inquiry.php?TransFromDate=" 
-				. $from . "&TransToDate=" . $to . "&Dimension=" . $dimension . "&Dimension2=" . $dimension2 
-				. "&account=" . $account['account_code'] . "'>" . $account['account_code'] 
-				." ". $account['account_name'] ."</a>";				
-				
-			start_row("class='stockmankobg'");
-			label_cell($url);
-			amount_cell(($curr_balance + $prev_balance) * $convert);
-			end_row();
-		}
-		
-		$acctstotal += $curr_balance + $prev_balance;
-	}
+ 	while ($account=db_fetch($result))
+    {
+        $net_balance = get_gl_trans_from_to("", $to, $account["account_code"], $dimension, $dimension2);
+        if (!$net_balance)
+            continue;
+        
+        if ($drilldown && $levelptr == 0)
+        {
+            $url = "<a href='$path_to_root/gl/inquiry/gl_account_inquiry.php?TransFromDate=" 
+                . $from . "&TransToDate=" . $to . "&Dimension=" . $dimension . "&Dimension2=" . $dimension2 
+                . "&account=" . $account['account_code'] . "'>" . $account['account_code'] 
+                ." ". $account['account_name'] ."</a>";                
+                
+            start_row("class='stockmankobg'");
+            label_cell($url);
+            amount_cell(($net_balance) * $convert);
+            end_row();
+        }
+        
+        $acctstotal += $net_balance;
+    }	
 	
 	$levelptr = 1;
 
diff --git a/gl/inquiry/gl_account_inquiry.php b/gl/inquiry/gl_account_inquiry.php
index 5bef33f9..9aff2365 100644
--- a/gl/inquiry/gl_account_inquiry.php
+++ b/gl/inquiry/gl_account_inquiry.php
@@ -14,6 +14,7 @@ $path_to_root = "../..";
 include_once($path_to_root . "/includes/session.inc");
 
 
+include_once($path_to_root . "/admin/db/fiscalyears_db.inc");
 include_once($path_to_root . "/includes/date_functions.inc");
 include_once($path_to_root . "/includes/ui.inc");
 include_once($path_to_root . "/includes/data_checks.inc");
@@ -148,7 +149,7 @@ function show_results()
 		$begin = "";
 	else
 	{
-		$begin = begin_fiscalyear();
+		$begin = get_fiscalyear_begin_for_date($_POST['TransFromDate']);
 		if (date1_greater_date2($begin, $_POST['TransFromDate']))
 			$begin = $_POST['TransFromDate'];
 		$begin = add_days($begin, -1);
diff --git a/gl/inquiry/gl_trial_balance.php b/gl/inquiry/gl_trial_balance.php
index 62f8db17..1f6545c9 100644
--- a/gl/inquiry/gl_trial_balance.php
+++ b/gl/inquiry/gl_trial_balance.php
@@ -74,7 +74,7 @@ function display_trial_balance($type, $typename)
 	//Get Accounts directly under this group/type
 	$accounts = get_gl_accounts(null, null, $type);
 
-	$begin = begin_fiscalyear();
+	$begin = get_fiscalyear_begin_for_date($_POST['TransFromDate']);
 	if (date1_greater_date2($begin, $_POST['TransFromDate']))
 		$begin = $_POST['TransFromDate'];
 	$begin = add_days($begin, -1);
@@ -85,7 +85,7 @@ function display_trial_balance($type, $typename)
 		if (!$printtitle)
 		{
 			start_row("class='inquirybg' style='font-weight:bold'");
-			label_cell("Group - ".$type ." - ".$typename, "colspan=8");
+			label_cell(_("Group")." - ".$type ." - ".$typename, "colspan=8");
 			end_row();
 			$printtitle = 1;
 		}
@@ -137,9 +137,10 @@ function display_trial_balance($type, $typename)
 		if (!$printtitle)
 		{
 			start_row("class='inquirybg' style='font-weight:bold'");
-			label_cell("Group - ".$type ." - ".$typename, "colspan=8");
+			label_cell(_("Group")." - ".$type ." - ".$typename, "colspan=8");
 			end_row();
 			$printtitle = 1;
+
 		}
 		display_trial_balance($accounttype["id"], $accounttype["name"].' ('.$typename.')');
 	}
@@ -188,7 +189,7 @@ $classresult = get_account_classes(false);
 while ($class = db_fetch($classresult))
 {
 	start_row("class='inquirybg' style='font-weight:bold'");
-	label_cell("Class - ".$class['cid'] ." - ".$class['class_name'], "colspan=8");
+	label_cell(_("Class")." - ".$class['cid'] ." - ".$class['class_name'], "colspan=8");
 	end_row();
 
 	//Get Account groups/types under this group/type with no parents
diff --git a/gl/inquiry/journal_inquiry.php b/gl/inquiry/journal_inquiry.php
index 3fd59521..0297073c 100644
--- a/gl/inquiry/journal_inquiry.php
+++ b/gl/inquiry/journal_inquiry.php
@@ -79,9 +79,38 @@ function gl_link($row)
 	return get_gl_view_str($row["type"], $row["type_no"]);
 }
 
+$editors = array(
+	ST_JOURNAL => "/gl/gl_journal.php?ModifyGL=Yes&trans_no=%d&trans_type=%d",
+	ST_BANKPAYMENT => "/gl/gl_bank.php?ModifyPayment=Yes&trans_no=%d&trans_type=%d",
+	ST_BANKDEPOSIT => "/gl/gl_bank.php?ModifyDeposit=Yes&trans_no=%d&trans_type=%d",
+//	4=> Funds Transfer,
+   ST_SALESINVOICE => "/sales/customer_invoice.php?ModifyInvoice=%d",
+//   11=>
+// free hand (debtors_trans.order_==0)
+//	"/sales/credit_note_entry.php?ModifyCredit=%d"
+// credit invoice
+//	"/sales/customer_credit_invoice.php?ModifyCredit=%d"
+//	 12=> Customer Payment,
+   ST_CUSTDELIVERY => "/sales/customer_delivery.php?ModifyDelivery=%d",
+//   16=> Location Transfer,
+//   17=> Inventory Adjustment,
+//   20=> Supplier Invoice,
+//   21=> Supplier Credit Note,
+//   22=> Supplier Payment,
+//   25=> Purchase Order Delivery,
+//   28=> Work Order Issue,
+//   29=> Work Order Production",
+//   35=> Cost Update,
+);
+
 function edit_link($row)
 {
-	return edit_trans_link($row["type"], $row["type_no"]);
+	global $editors;
+
+	return isset($editors[$row["type"]]) && !is_closed_trans($row["type"], $row["type_no"]) ? 
+		pager_link(_("Edit"), 
+			sprintf($editors[$row["type"]], $row["type_no"], $row["type"]),
+			ICON_EDIT) : '';
 }
 
 $sql = get_sql_for_journal_inquiry(get_post('filterType', -1), get_post('FromDate'),
diff --git a/gl/manage/bank_accounts.php b/gl/manage/bank_accounts.php
index 634283b4..c494247b 100644
--- a/gl/manage/bank_accounts.php
+++ b/gl/manage/bank_accounts.php
@@ -33,7 +33,12 @@ if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
 		display_error(_("The bank account name cannot be empty."));
 		set_focus('bank_account_name');
 	} 
-	
+	if ($Mode=='ADD_ITEM' && (gl_account_in_bank_accounts(get_post('account_code')) 
+			|| key_in_foreign_table(get_post('account_code'), 'gl_trans', 'account', true))) {
+		$input_error = 1;
+		display_error(_("The GL account selected is already in use. Select another GL account."));
+		set_focus('account_code');
+	}
 	if ($input_error != 1)
 	{
     	if ($selected_id != -1) 
@@ -63,16 +68,15 @@ elseif( $Mode == 'Delete')
 	//the link to delete a selected record was clicked instead of the submit button
 
 	$cancel_delete = 0;
-	$acc = db_escape($selected_id);
 	// PREVENT DELETES IF DEPENDENT RECORDS IN 'bank_trans'
 
-	if (key_in_foreign_table($acc, 'bank_trans', 'bank_act', true))
+	if (key_in_foreign_table($selected_id, 'bank_trans', 'bank_act', true) || key_in_foreign_table(get_post('account_code'), 'gl_trans', 'account', true))
 	{
 		$cancel_delete = 1;
 		display_error(_("Cannot delete this bank account because transactions have been created using this account."));
 	}
 
-	if (key_in_foreign_table($acc, 'sales_pos', 'pos_account', true))
+	if (key_in_foreign_table($selected_id, 'sales_pos', 'pos_account', true))
 	{
 		$cancel_delete = 1;
 		display_error(_("Cannot delete this bank account because POS definitions have been created using this account."));
diff --git a/gl/manage/gl_accounts.php b/gl/manage/gl_accounts.php
index 9e510680..c47abcc8 100644
--- a/gl/manage/gl_accounts.php
+++ b/gl/manage/gl_accounts.php
@@ -76,7 +76,7 @@ if (isset($_POST['add']) || isset($_POST['update']))
 
     	if ($selected_account) 
 		{
-			if (check_value('inactive') && is_bank_account($_POST['account_code']))
+			if (get_post('inactive') == 1 && is_bank_account($_POST['account_code']))
 			{
 				display_error(_("The account belongs to a bank account and cannot be inactivated."));
 			}
@@ -110,61 +110,59 @@ function can_delete($selected_account)
 {
 	if ($selected_account == "")
 		return false;
-	$acc = db_escape($selected_account);
 
-	if (key_in_foreign_table($acc, 'gl_trans', 'account', true))
+	if (key_in_foreign_table($selected_account, 'gl_trans', 'account', true))
 	{
 		display_error(_("Cannot delete this account because transactions have been created using this account."));
 		return false;
 	}
 
-	if (gl_account_in_company_defaults($acc))
+	if (gl_account_in_company_defaults($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used as one of the company default GL accounts."));
 		return false;
 	}
 
-	if (key_in_foreign_table($acc, 'bank_accounts', 'account_code', true))	
+	if (key_in_foreign_table($selected_account, 'bank_accounts', 'account_code', true))	
 	{
 		display_error(_("Cannot delete this account because it is used by a bank account."));
 		return false;
-	}	
+	}
 
-	if (gl_account_in_stock_category($acc))
+	if (gl_account_in_stock_category($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more Item Categories."));
 		return false;
-	}	
-	
-	if (gl_account_in_stock_master($acc))
+	}
+
+	if (gl_account_in_stock_master($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more Items."));
 		return false;
-	}	
-	
-	if (gl_account_in_tax_types($acc))
+	}
+
+	if (gl_account_in_tax_types($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more Taxes."));
 		return false;
-	}	
-	
-	if (gl_account_in_cust_branch($acc))
+	}
+
+	if (gl_account_in_cust_branch($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more Customer Branches."));
 		return false;
-	}		
-	
-	if (gl_account_in_suppliers($acc))
+	}
+	if (gl_account_in_suppliers($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more suppliers."));
 		return false;
-	}									
-	
-	if (gl_account_in_quick_entry_lines($acc))
+	}
+
+	if (gl_account_in_quick_entry_lines($selected_account))
 	{
 		display_error(_("Cannot delete this account because it is used by one or more Quick Entry Lines."));
 		return false;
-	}									
+	}
 
 	return true;
 }
diff --git a/gl/manage/gl_quick_entries.php b/gl/manage/gl_quick_entries.php
index 6bd142f6..c149c70b 100644
--- a/gl/manage/gl_quick_entries.php
+++ b/gl/manage/gl_quick_entries.php
@@ -102,13 +102,13 @@ if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
 		if ($selected_id != -1) 
 		{
 			update_quick_entry($selected_id, $_POST['description'], $_POST['type'],
-				 input_num('base_amount'), $_POST['base_desc'], get_post('bal_type'));
+				 input_num('base_amount'), $_POST['base_desc'], get_post('bal_type', 0));
 			display_notification(_('Selected quick entry has been updated'));
 		} 
 		else 
 		{
 			add_quick_entry($_POST['description'], $_POST['type'], 
-				input_num('base_amount'), $_POST['base_desc'], get_post('bal_type'));
+				input_num('base_amount'), $_POST['base_desc'], get_post('bal_type', 0));
 			display_notification(_('New quick entry has been added'));
 		}
 		$Mode = 'RESET';
diff --git a/gl/manage/revaluate_currencies.php b/gl/manage/revaluate_currencies.php
index d0050d41..050637d5 100644
--- a/gl/manage/revaluate_currencies.php
+++ b/gl/manage/revaluate_currencies.php
@@ -25,6 +25,7 @@ page(_($help_context = "Revaluation of Currency Accounts"), false, false, "", $j
 if (isset($_GET['AddedID'])) 
 {
 	$trans_no = $_GET['AddedID'];
+	$JE = $_GET['JE'];
 	$trans_type = ST_JOURNAL;
 
 	if ($trans_no == 0)
@@ -35,6 +36,8 @@ if (isset($_GET['AddedID']))
 
 		display_note(get_gl_view_str($trans_type, $trans_no, _("&View the GL Journal Entries for this Transfer")));
 	}
+	if ($JE > 0)
+   		display_notification_centered(sprintf(_("%d Journal Entries for AR/AP accounts have been added"), $JE));
 
 	//display_footer_exit();
 }
@@ -81,9 +84,9 @@ function handle_submit()
 	if (!check_data())
 		return;
 
-	$trans_no = add_exchange_variation_all($_POST['date'], $_POST['ref'], $_POST['memo_']);
+	$trans = add_exchange_variation_all($_POST['date'], $_POST['ref'], $_POST['memo_']);
 
-	meta_forward($_SERVER['PHP_SELF'], "AddedID=$trans_no");
+	meta_forward($_SERVER['PHP_SELF'], "AddedID=".$trans[0]."&JE=".$trans[1]);
 	//clear_data();
 }
 
diff --git a/gl/view/gl_deposit_view.php b/gl/view/gl_deposit_view.php
index bd231d93..88b9a2f2 100644
--- a/gl/view/gl_deposit_view.php
+++ b/gl/view/gl_deposit_view.php
@@ -122,14 +122,14 @@ else
                 label_cell(get_dimension_string($item['dimension_id'], true));
             if ($dim > 1)
                 label_cell(get_dimension_string($item['dimension2_id'], true));
-            amount_cell($item["amount"]);
+            amount_cell(-$item["amount"]);
     		label_cell($item["memo_"]);
     		end_row();
     		$total_amount += $item["amount"];
 		}
 	}
 
-	label_row(_("Total"), number_format2($total_amount, user_price_dec()),"colspan=".(2+$dim)." align=right", "align=right");
+	label_row(_("Total"), number_format2(-$total_amount, user_price_dec()),"colspan=".(2+$dim)." align=right", "align=right");
 
 	end_table(1);
 
diff --git a/includes/current_user.inc b/includes/current_user.inc
index 1c7d1611..591524f4 100644
--- a/includes/current_user.inc
+++ b/includes/current_user.inc
@@ -63,11 +63,20 @@ class current_user
 		$this->set_company($company);
 	    $this->logged = false;
 
-		$Auth_Result = get_user_for_login($loginname, $password);
+		set_global_connection();
 
-		if (db_num_rows($Auth_Result) > 0)
+		// Use external authentication source if any.
+		// Keep in mind you need to have user data set for $loginname
+		// in FA users table anyway to successfully log in.
+		$Auth_Result = hook_authenticate($loginname, $password);
+
+		if (!isset($Auth_Result))	// if not used: standard method
+			$Auth_Result = get_user_auth($loginname, md5($password));
+
+		if ($Auth_Result)
 		{
-			$myrow = db_fetch($Auth_Result);
+			$myrow = get_user_by_login($loginname);
+
 			$this->old_db = isset($myrow["full_access"]);
 			if (! @$myrow["inactive"]) {
 				if ($this->old_db) { 
@@ -525,6 +534,9 @@ function array_search_key($needle, $haystack, $valuekey=null)
 function flush_dir($path, $wipe = false) 
 {
 	$dir = opendir($path);
+	if(!$dir)
+		return;
+
 	while(false !== ($fname = readdir($dir))) {
 		if($fname=='.' || $fname=='..' || $fname=='CVS' || (!$wipe && $fname=='index.php')) continue;
   		if(is_dir($path.'/'.$fname)) {
diff --git a/includes/data_checks.inc b/includes/data_checks.inc
index ee5984a2..543a7d59 100644
--- a/includes/data_checks.inc
+++ b/includes/data_checks.inc
@@ -499,5 +499,3 @@ function check_is_closed($type, $type_no, $msg=null)
     }
 }
 
-
-?>
\ No newline at end of file
diff --git a/includes/db/audit_trail_db.inc b/includes/db/audit_trail_db.inc
index 49abe1ca..e19a659e 100644
--- a/includes/db/audit_trail_db.inc
+++ b/includes/db/audit_trail_db.inc
@@ -76,12 +76,11 @@ function close_transactions($todate) {
 
 	if (db_num_rows($result)) {
 		$last_year = 0;
-		while ($row = db_fetch($result)) {
 
+		while ($row = db_fetch($result)) {
 			if ($row['fiscal_year'] == null) {
 				$errors = 1; continue;
 			}
-
 			if ($last_year != $row['fiscal_year']) {
 				$last_year = $row['fiscal_year'];
 				$counter = 0; // reset counter on fiscal year change
@@ -123,6 +122,7 @@ function is_closed_trans($type, $trans_no) {
 //		." OR gl_seq>0)";
 
 	$res = db_query($sql, "Cannot check transaction");
+
 	return db_num_rows($res);
 
 }
diff --git a/includes/db/inventory_db.inc b/includes/db/inventory_db.inc
index 83405431..6cf96961 100644
--- a/includes/db/inventory_db.inc
+++ b/includes/db/inventory_db.inc
@@ -65,7 +65,6 @@ function get_item_edit_info($stock_id)
 
 function get_standard_cost($stock_id)
 {
-	//Chaitanya : Compatibility with service items
 	$sql = "SELECT (material_cost + labour_cost + overhead_cost) AS std_cost
 		FROM ".TB_PREF."stock_master s WHERE stock_id=".db_escape($stock_id);
 	$result = db_query($sql, "The standard cost cannot be retrieved");
@@ -130,7 +129,7 @@ function last_negative_stock_trans_id($stock_id, $to)
 	
 	$qty = 0;
 	$flag = 0;
-	$negative_trans_id = 1;
+	$negative_trans_id = -1;
 	
 	while ($myrow = db_fetch($result))
 	{
@@ -144,7 +143,10 @@ function last_negative_stock_trans_id($stock_id, $to)
 			$flag = 0;
 	}
 
-	return $negative_trans_id;
+	if ($flag == 1)
+		return $negative_trans_id;
+	else 
+		return false;
 }
 
 //-------------------------------------------------------------------
@@ -170,30 +172,12 @@ function get_deliveries_from_trans($stock_id, $from)
 	$result = db_query($sql, "The deliveries could not be updated");
 	$row = db_fetch_row($result);
 	
-//	display_notification('Row0 - '.$row[0].' Row1- '.$row[1]);
-	
-	//return $row;
-	
-	// Get Std cost of previsous transaction before the cut-over delivery
-	// This is useful to get inventory valuation
-	//Chaitanya : Corrected
-	/*$sql = "SELECT max( `trans_id` )
-			FROM ".TB_PREF."stock_moves
-			WHERE stock_id = ".db_escape($stock_id)."
-			AND trans_id<'$from'";
-	$result = db_query($sql, "The deliveries could not be updated");
-	$trans = db_fetch_row($result);
-	$prev_trans = $trans[0];*/
-	
-//	display_notification('From - '.$from);
 	$sql = "SELECT standard_cost FROM ".TB_PREF."stock_moves
 		WHERE stock_id=".db_escape($stock_id)
 			." AND trans_id ='$from'";
 	$result = db_query($sql, "The deliveries could not be updated");
 	$cost = db_fetch_row($result);	
 	
-//	display_notification('Last Delivery Cost - '.$cost[0]);
-	
 	// Adjusting QOH valuation 
 	$sql = "SELECT SUM(qty) FROM ".TB_PREF."stock_moves
 		WHERE stock_id=".db_escape($stock_id)." AND
@@ -201,17 +185,12 @@ function get_deliveries_from_trans($stock_id, $from)
 	$result = db_query($sql, "The deliveries could not be updated");
 	$qoh = db_fetch_row($result);
 	
-//	display_notification('QOH before last delivery - '.$qoh[0]);
-	
-	$qty = $row[0] - $qoh[0]; //Qoh is minus from delivered in -ve
+	$qty = $row[0] - $qoh[0]; //QOH prior to -ve stock is subtracted
 	$final_cost = $row[1] - $qoh[0]*$cost[0];
 	
-//	display_notification('Qty - '.$qty.' cost- '.$final_cost);
-	
 	return array($qty,$final_cost); 
 }
 
-//Newly written
 function get_purchases_from_trans($stock_id, $from)
 {
 	// Calculate All inward stock moves i.e. qty > 0
@@ -221,54 +200,18 @@ function get_purchases_from_trans($stock_id, $from)
 	$result = db_query($sql, "Could not get get_purchases_from_trans");
 	$row = db_fetch_row($result);
 	
-//	display_notification('Purchase Qty - '.$row[0].' Cost- '.$row[1]);
-	
 	return $row;
 }
 
 //-------------------------------------------------------------------
-/* Original Code V0 Leave as is a while
-function adjust_deliveries_v0($stock_id, $material_cost, $to)
-{
-	if (!is_inventory_item($stock_id))
-		return;
-	$from = last_negative_stock_begin_date($stock_id, $to);
-	if ($from == false || $from == "")
-		return;
-	$from = sql2date($from);
-	$row = get_deliveries_between($stock_id, $from, $to);
-	if ($row == false)
-		return;	
-	$old_cost = $row[1];
-	$new_cost = $row[0] * $material_cost;
-	$diff = $new_cost - $old_cost;
-	if ($diff != 0)
-	{
-	   	$update_no = get_next_trans_no(ST_COSTUPDATE);
-		if (!is_date_in_fiscalyear($to))
-			$to = end_fiscalyear();
-	   
-		$stock_gl_code = get_stock_gl_code($stock_id);
-
-		$memo_ = sprintf(_("Cost was %s changed to %s for item '%s'"),
-			$old_cost, $new_cost, $stock_id);
-		add_gl_trans_std_cost(ST_COSTUPDATE, $update_no, $to, $stock_gl_code["cogs_account"], 
-			$stock_gl_code["dimension_id"], $stock_gl_code["dimension2_id"], $memo_, $diff);
 
-		add_gl_trans_std_cost(ST_COSTUPDATE, $update_no, $to, $stock_gl_code["inventory_account"], 
-			0, 0, $memo_, -$diff);
-		add_audit_trail(ST_COSTUPDATE, $update_no, $to);
-   	}
-}
-*/
-//New written function
 function adjust_deliveries($stock_id, $material_cost, $to)
 {
 	if (!is_inventory_item($stock_id))
 		return;
 	
 	$from = last_negative_stock_trans_id($stock_id, $to);
-	if ($from == false || $from == "")
+	if ($from == false || $from == -1)
 		return;
 
 	$row = get_deliveries_from_trans($stock_id, $from);
@@ -325,11 +268,10 @@ function get_stock_gl_code($stock_id)
 }
 
 //-----------------------------------------------------------------------------------------
-//Chaitanya : New Function handle negative stock effect
-//Called in add_stock_move
+
 function handle_negative_inventory($stock_id, $quantity, $standard_cost, $date_)
 {
-	//Chaitanya : If negative adjustment result in negative or zero inventory 
+	//If negative adjustment result in negative or zero inventory 
 	//then difference should be adjusted
 	$qoh = get_qoh_on_date($stock_id);
 
@@ -374,11 +316,6 @@ function add_stock_move($type, $stock_id, $trans_no, $location,
     $date_, $reference, $quantity, $std_cost, $person_id=0, $show_or_hide=1,
     $price=0, $discount_percent=0, $error_msg="")
 {
-	// Chaitanya : Removed following restriction considering WO issues
-	// Voiding issues and productions with Service items can not get the 
-	// Service items compatibility
-	// do not add a stock move if it's a non-inventory item
-
 	$date = date2sql($date_);
 
 	$sql = "INSERT INTO ".TB_PREF."stock_moves (stock_id, trans_no, type, loc_code,
@@ -388,8 +325,8 @@ function add_stock_move($type, $stock_id, $trans_no, $location,
 		.",	".db_escape($location).", '$date', "
 		.db_escape($person_id).", ".db_escape($reference).", "
 		.db_escape($quantity).", ".db_escape($std_cost).","
-		.db_escape($show_or_hide).", ".db_escape($price).", "
-		.db_escape($discount_percent).")";
+		.db_escape($show_or_hide).", "
+		.db_escape($price).", ".db_escape($discount_percent).")";
 
 	if ($error_msg == "")
 		$error_msg = "The stock movement record cannot be inserted";
@@ -399,7 +336,6 @@ function add_stock_move($type, $stock_id, $trans_no, $location,
 	return db_insert_id();
 }
 
-//Chaitanya : Added function
 function update_stock_move($type, $trans_no, $stock_id, $cost)
 {
 	$sql = "UPDATE ".TB_PREF."stock_moves SET standard_cost=".db_escape($cost)
@@ -442,12 +378,7 @@ function get_stock_moves($type, $type_no, $visible=false)
 
 function void_stock_move($type, $type_no)
 {
-    //Chaitanya : Reversing stock move rather than voiding as it is hazardous to lose stock movement trail with respect to costing
-    /*$sql = "UPDATE ".TB_PREF."stock_moves SET qty=0, price=0, discount_percent=0,
-        standard_cost=0 WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
-        
-    db_query($sql, "Could not void stock moves"); */
-    
+
     $sql = "SELECT * from ".TB_PREF."stock_moves WHERE type=".db_escape($type)." AND trans_no=".db_escape($type_no);
     $result = db_query($sql, "Could not void stock moves");
     while ($row = db_fetch($result))
@@ -456,8 +387,7 @@ function void_stock_move($type, $type_no)
 		if (is_inventory_item($row["stock_id"]))
 		{
 			// The cost has to be adjusted.
-			//Chaitanya : Transaction rates are stored either as price or standard_cost depending
-			//on types
+			// Transaction rates are stored either as price or standard_cost depending on types
 			$types = array(ST_SUPPCREDIT);
 			if (in_array($type,$types))
 				$trans_rate = $row["price"];
diff --git a/includes/errors.inc b/includes/errors.inc
index 9a5af3b8..89aae72f 100644
--- a/includes/errors.inc
+++ b/includes/errors.inc
@@ -102,6 +102,9 @@ function fmt_errors($center=false) {
 //  $class = 'no_msg';
   if (count($messages)) {
 	foreach($messages as $cnt=>$msg) {
+		if ($go_debug && $msg[0]>E_USER_NOTICE)
+		 	$msg[0] = E_ERROR;
+
 		if ($msg[0]>$type) continue;
 
 		if ($msg[0]<$type) { 
@@ -115,8 +118,9 @@ function fmt_errors($center=false) {
 			}
 		}
 	    $str = $msg[1];
-		if ($msg[0] < E_USER_ERROR && $msg[2] != null)
+		if (!in_array($msg[0], array(E_USER_NOTICE, E_USER_ERROR, E_USER_WARNING)) && $msg[2] != null)
 		  $str .= ' '._('in file').': '.$msg[2].' '._('at line ').$msg[3];
+
 		if ($go_debug>1 && $type!=E_USER_NOTICE && $type!=E_USER_WARNING)
 		  $str .= '<br>'.$msg[4];
 		$content .= ($cnt ? '<hr>' : '').$str;
diff --git a/includes/hooks.inc b/includes/hooks.inc
index 81e1a17a..080798c2 100644
--- a/includes/hooks.inc
+++ b/includes/hooks.inc
@@ -118,6 +118,12 @@ class hooks {
 		return null;
 	}
 
+	// External authentication
+	// If used should return true after successfull athentication, false otherwise.
+	function authenticate($login, $password)
+	{
+		return null;
+	}
 	// Generic function called at the end of Tax Report (report 709)
 	// Can be used e.g. for special database updates on every report printing
 	// or to print special tax report footer 
@@ -281,28 +287,26 @@ function hook_invoke_first($method, &$data, $opts=null)
 	return $result;
 }
 /*
-	Returns result of last hook installed. Helps implement hooks overriding by 
+	Returns last non-null result returned from modules method. Helps implement hooks overriding by 
 	extensions installed later.
-	
 */
 function hook_invoke_last($method, &$data, $opts=null)
 {
 
 	global $Hooks;
 
-	$found = false;
-	foreach($Hooks as $ext => $hook) {
+	$result = null;
+	$Reverse = array_reverse($Hooks);
+	foreach($Reverse as $ext => $hook) {
 		if (method_exists($hook, $method)) {
-			$found = $ext;
+			set_ext_domain('modules/'.$ext);
+			$result = $hook->$method($data, $opts);
+			if (isset($result))
+				break;
 		}
 	}
-	$ret = null;
-	if ($found) {
-		set_ext_domain('modules/'.$found);
-		$ret = $Hooks[$found]->$method($data, $opts);
-		set_ext_domain();
-	}
-	return $ret;
+	set_ext_domain();
+	return $result;
 }
 //------------------------------------------------------------------------------------------
 //	Database transaction hooks.
@@ -388,3 +392,11 @@ function hook_session_start($company)
 	}
 	return false;
 }
+//
+//	Third party authentication modules.
+//	Returns true after successfull authentication, false otherwise, null if no login hook is defined.
+//
+function hook_authenticate($login, $password)
+{
+	return hook_invoke_last('authenticate', $login, $password);
+}
diff --git a/includes/session.inc b/includes/session.inc
index c761660b..1208cf35 100644
--- a/includes/session.inc
+++ b/includes/session.inc
@@ -260,6 +260,11 @@ if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
 
 	login_timeout();
 
+	if (!$_SESSION["wa_current_user"]->old_db)
+		include_once($path_to_root . '/company/'.user_company().'/installed_extensions.php');
+
+	install_hooks();
+
 	if (!$_SESSION["wa_current_user"]->logged_in())
 	{
 		// Show login screen
@@ -278,7 +283,7 @@ if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
 
 			$succeed = isset($db_connections[$_POST["company_login_name"]]) &&
 				$_SESSION["wa_current_user"]->login($_POST["company_login_name"],
-				$_POST["user_name_entry_field"], md5($_POST["password"]));
+				$_POST["user_name_entry_field"], $_POST["password"]);
 			// select full vs fallback ui mode on login
 			$_SESSION["wa_current_user"]->ui_mode = $_POST['ui_mode'];
 			if (!$succeed)
@@ -292,11 +297,6 @@ if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
 	} else
 		set_global_connection();
 
-	if (!$_SESSION["wa_current_user"]->old_db)
-		include_once($path_to_root . '/company/'.user_company().'/installed_extensions.php');
-
-	install_hooks();
-
 	if (!isset($_SESSION["App"])) {
 		$_SESSION["App"] = new front_accounting();
 		$_SESSION["App"]->init();
diff --git a/includes/ui/ui_controls.inc b/includes/ui/ui_controls.inc
index 6965b216..fa4f62d7 100644
--- a/includes/ui/ui_controls.inc
+++ b/includes/ui/ui_controls.inc
@@ -53,11 +53,27 @@ function start_form($multi=false, $dummy=false, $action="", $name="")
 
 function end_form($breaks=0)
 {
+	global $Ajax;
+
+	$_SESSION['csrf_token'] = hash('sha256', uniqid(mt_rand(), true));
 	if ($breaks)
 		br($breaks);
-	echo "<input type=\"hidden\" name=\"_focus\" value=\"".get_post('_focus')."\">\n";
-	echo "<input type=\"hidden\" name=\"_modified\" value=\"".get_post('_modified', 0)."\">\n";
+	hidden('_focus');
+	hidden('_modified', get_post('_modified', 0));
+	hidden('_token', $_SESSION['csrf_token']);
 	echo "</form>\n";
+	$Ajax->activate('token');
+}
+
+function check_csrf_token()
+{
+	if ($_SESSION['csrf_token'] != @$_POST['_token'])
+	{
+		display_error(_("Request from outside of this page is forbidden."));
+		error_log(_("CSRF attack detected from: ").@$_SERVER['HTTP_HOST'].' ('.@$_SERVER['HTTP_REFERER'].')');
+		return false;
+	}
+	return true;
 }
 
 function start_table($class=false, $extra="", $padding='2', $spacing='0')
@@ -415,6 +431,15 @@ function tabbed_content_end() {
 	div_end(); // tabs widget
 }
 
+function tab_changed($name)
+{
+	$to = find_submit("{$name}_", false);
+	if (!$to) return null;
+
+	return array('from' => $from = get_post("_{$name}_sel"),
+		'to' => $to);
+}
+
 /* Table editor interfaces. Key is editor type
 	0 => url of editor page
 	1 => hotkey code
diff --git a/includes/ui/ui_lists.inc b/includes/ui/ui_lists.inc
index 24939a1a..12926903 100644
--- a/includes/ui/ui_lists.inc
+++ b/includes/ui/ui_lists.inc
@@ -477,7 +477,7 @@ function customer_list($name, $selected_id=null, $spec_option=false, $submit_on_
 	if ($editkey)
 		set_editor('customer', $name, $editkey);
 
-	return combo_input($name, $selected_id, $sql, 'debtor_no', 'name',
+	return combo_input($name, $selected_id, $sql, 'debtor_no', 'debtor_ref',
 	array(
 	    'format' => '_format_add_curr',
 	    'order' => array('debtor_ref'),
@@ -528,7 +528,7 @@ function customer_branches_list($customer_id, $name, $selected_id=null,
 		set_editor('branch', $name, $editkey);
 
 	$where = $enabled ? array("disable_trans = 0") : array();
-	return  combo_input($name, $selected_id, $sql, 'branch_code', 'br_name',
+	return  combo_input($name, $selected_id, $sql, 'branch_code', 'branch_ref',
 	array(
 		'where' => $where,
 		'order' => array('branch_ref'),
@@ -2332,6 +2332,18 @@ function coa_list_row($label, $name, $value=null)
 	echo "</td></tr>\n";
 }
 
+function payment_services($name)
+{
+	global $payment_services;
+
+	$services = array_combine(array_keys($payment_services), array_keys($payment_services));
+
+	return array_selector($name, null, $services, array(
+			'spec_option'=> _("No payment Link"),
+			'spec_id' => '',
+		));
+}
+
 function tax_algorithm_list($name, $value=null, $submit_on_change = false)
 {
 	global $tax_algorithms;
@@ -2408,5 +2420,3 @@ function subledger_list_row($label, $name, $selected_id=null, $all_option = fals
 	echo "</td>\n</tr>\n";
 }
 
-
-?>
\ No newline at end of file
diff --git a/includes/ui/ui_view.inc b/includes/ui/ui_view.inc
index eb7e7713..3f27641b 100644
--- a/includes/ui/ui_view.inc
+++ b/includes/ui/ui_view.inc
@@ -474,14 +474,14 @@ function display_footer_exit()
 
 //--------------------------------------------------------------------------------------
 
-function display_allocations($alloc_result, $total)
+function display_allocations($alloc_result, $total, $payments=false)
 {
 	global $systypes_array;
 
 	if (!$alloc_result || db_num_rows($alloc_result) == 0)
 		return;
 
-    display_heading2(_("Allocations"));
+    display_heading2(($payments ? _("Payments") : _("Allocations")));
 
     start_table(TABLESTYLE, "width=80%");
 
@@ -538,6 +538,23 @@ function display_allocations_from($person_type, $person_id, $type, $type_no, $to
 	}
 }
 
+//--------------------------------------------------------------------------------------
+
+function display_allocations_to($person_type, $person_id, $type, $type_no, $total)
+{
+	switch ($person_type)
+	{
+		case PT_CUSTOMER :
+			$alloc_result = get_allocatable_from_cust_transactions($person_id, $type_no, $type);
+			display_allocations($alloc_result, $total, true);
+			return;
+		case PT_SUPPLIER :
+			$alloc_result = get_allocatable_from_supp_transactions($person_id, $type_no, $type);
+			display_allocations($alloc_result, $total, true);
+			return;
+	}
+}
+
 //--------------------------------------------------------------------------------------
 //
 //	Expands selected quick entry $id into GL posings and adds to cart.
@@ -1300,4 +1317,30 @@ function display_backtrace($cond=true, $msg='') {
 	}
 }
 
-?>
\ No newline at end of file
+//
+// FIXME: $payment_services array will be moved to bank_accounts in 2.4.x
+//
+if (!isset($payment_services))
+{
+	$payment_services = array(
+		'PayPal' => "https://www.paypal.com/xclick/business=<company_email>&item_name=<comment>&amount=<amount>&currency_code=<currency>",
+	);
+}
+/*
+*	Payment link generation. Options provided during invoice generation:
+*	company_email, comment, amount, currency
+*/
+function payment_link($name, $options)
+{
+	global $payment_services;
+
+	$link = @$payment_services[$name];
+
+	if (!$link) return null;
+
+	$patterns = array();
+	foreach ($options as $id => $option)
+		$patterns['<'.$id.'>'] = urlencode($options[$id]);
+
+	return strtr($link, $patterns);
+}
-- 
2.30.2