Improved safety of timesheet assignment by adding an inner join.

[timetracker.git] / WEB-INF / lib / ttReportHelper.class.php

diff --git a/WEB-INF/lib/ttReportHelper.class.php b/WEB-INF/lib/ttReportHelper.class.php
index abb5ab9..a64bb87 100644 (file)
--- a/WEB-INF/lib/ttReportHelper.class.php
+++ b/WEB-INF/lib/ttReportHelper.class.php
@@ -629,6 +629,27 @@ class ttReportHelper {
     }
   }
 
+  // The assignToTimesheet assigns a set of tt_log records to a specific timesheet.
+  static function assignToTimesheet($timesheet_id, $time_log_ids) {
+    global $user;
+    $mdb2 = getConnection();
+
+    $user_id = $user->getUser();
+    $group_id = $user->getGroup();
+    $org_id = $user->org_id;
+
+    if ($time_log_ids) {
+      if ($timesheet_id)
+        $inner_join = " inner join tt_timesheets ts on (ts.id = $timesheet_id and ts.approve_status is null)";
+
+      $sql = "update tt_log l $inner_join".
+        " set l.timesheet_id = ".$mdb2->quote($timesheet_id).
+        " where l.id in(".join(', ', $time_log_ids).") and l.user_id = $user_id and l.group_id = $group_id and l.org_id = $org_id";
+      $affected = $mdb2->exec($sql);
+      if (is_a($affected, 'PEAR_Error')) die($affected->getMessage());
+    }
+  }
+
   // The markApproved marks a set of records as either approved or unapproved.
   static function markApproved($time_log_ids, $expense_item_ids, $approved = true) {
     global $user;