Improved safety of timesheet assignment by adding an inner join.

[timetracker.git] / WEB-INF / lib / ttExpenseHelper.class.php

diff --git a/WEB-INF/lib/ttExpenseHelper.class.php b/WEB-INF/lib/ttExpenseHelper.class.php
index 9f5e838..40a3e88 100644 (file)
--- a/WEB-INF/lib/ttExpenseHelper.class.php
+++ b/WEB-INF/lib/ttExpenseHelper.class.php
@@ -60,12 +60,12 @@ class ttExpenseHelper {
     global $user;
     $mdb2 = getConnection();
 
+    $user_id = $user->getUser();
     $group_id = $user->getGroup();
     $org_id = $user->org_id;
 
     $id = (int) $fields['id'];
     $date = $fields['date'];
-    $user_id = (int) $fields['user_id'];
     $client_id = $fields['client_id'];
     $project_id = $fields['project_id'];
     $name = $fields['name'];
@@ -110,14 +110,14 @@ class ttExpenseHelper {
     $group_id = $user->getGroup();
     $org_id = $user->org_id;
 
-    $sql = "select sum(cost) as sm from tt_expense_items".
+    $sql = "select sum(cost) as total from tt_expense_items".
       " where user_id = $user_id and group_id = $group_id and org_id = $org_id".
       " and date = ".$mdb2->quote($date)." and status = 1";
     $res = $mdb2->query($sql);
     if (!is_a($res, 'PEAR_Error')) {
       $val = $res->fetchRow();
-      $val['sm'] = str_replace('.', $user->getDecimalMark(), $val['sm']);
-      return $val['sm'];
+      $val['total'] = str_replace('.', $user->getDecimalMark(), $val['total']);
+      return $val['total'];
     }
     return false;
   }