Improved access checks on client_delete.php.

[timetracker.git] / client_edit.php

diff --git a/client_edit.php b/client_edit.php
index c13d42e..0dc3bb6 100644 (file)
--- a/client_edit.php
+++ b/client_edit.php
@@ -30,18 +30,23 @@ require_once('initialize.php');
 import('form.Form');
 import('ttClientHelper');
 import('ttTeamHelper');
+import('ttGroupHelper');
 
-// Access check.
-if (!ttAccessCheck(right_manage_team)) {
+// Access checks.
+if (!ttAccessAllowed('manage_clients')) {
   header('Location: access_denied.php');
   exit();
 }
+if (!$user->isPluginEnabled('cl')) {
+  header('Location: feature_disabled.php');
+  exit();
+}
 
 $cl_id = (int) $request->getParameter('id');
 
-$projects = ttTeamHelper::getActiveProjects($user->team_id);
+$projects = ttGroupHelper::getActiveProjects();
 
-if ($request->getMethod() == 'POST') {
+if ($request->isPost()) {
   $cl_name = trim($request->getParameter('name'));
   $cl_address = trim($request->getParameter('address'));
   $cl_tax = trim($request->getParameter('tax'));
@@ -62,22 +67,23 @@ if ($request->getMethod() == 'POST') {
 $form = new Form('clientForm');
 $form->addInput(array('type'=>'hidden','name'=>'id','value'=>$cl_id));
 $form->addInput(array('type'=>'text','name'=>'name','maxlength'=>'100','style'=>'width: 350px;','value'=>$cl_name));
-$form->addInput(array('type'=>'textarea','name'=>'address','maxlength'=>'255','style'=>'width: 350px;','cols'=>'55','rows'=>'5','value'=>$cl_address));
+$form->addInput(array('type'=>'textarea','name'=>'address','maxlength'=>'255','style'=>'width: 350px; height: 80px;','value'=>$cl_address));
 $form->addInput(array('type'=>'floatfield','name'=>'tax','size'=>'10','format'=>'.2','value'=>$cl_tax));
 $form->addInput(array('type'=>'combobox','name'=>'status','value'=>$cl_status,
-  'data'=>array(ACTIVE=>$i18n->getKey('dropdown.status_active'),INACTIVE=>$i18n->getKey('dropdown.status_inactive'))));
-$form->addInput(array('type'=>'checkboxgroup','name'=>'projects','data'=>$projects,'datakeys'=>array('id','name'),'layout'=>'H','value'=>$cl_projects));
-$form->addInput(array('type'=>'submit','name'=>'btn_save','value'=>$i18n->getKey('button.save')));
-$form->addInput(array('type'=>'submit','name'=>'btn_copy','value'=>$i18n->getKey('button.copy')));
-       
-if ($request->getMethod() == 'POST') {
+  'data'=>array(ACTIVE=>$i18n->get('dropdown.status_active'),INACTIVE=>$i18n->get('dropdown.status_inactive'))));
+if (MODE_PROJECTS == $user->getTrackingMode() || MODE_PROJECTS_AND_TASKS == $user->getTrackingMode())
+  $form->addInput(array('type'=>'checkboxgroup','name'=>'projects','data'=>$projects,'datakeys'=>array('id','name'),'layout'=>'H','value'=>$cl_projects));
+$form->addInput(array('type'=>'submit','name'=>'btn_save','value'=>$i18n->get('button.save')));
+$form->addInput(array('type'=>'submit','name'=>'btn_copy','value'=>$i18n->get('button.copy')));
+
+if ($request->isPost()) {
   // Validate user input.
-  if (!ttValidString($cl_name)) $errors->add($i18n->getKey('error.field'), $i18n->getKey('label.client_name'));
-  if (!ttValidString($cl_address, true)) $errors->add($i18n->getKey('error.field'), $i18n->getKey('label.client_address'));
-  if (!ttValidFloat($cl_tax, true)) $errors->add($i18n->getKey('error.field'), $i18n->getKey('label.tax'));
-               
-  if ($errors->isEmpty()) {
-       if ($request->getParameter('btn_save')) {
+  if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.client_name'));
+  if (!ttValidString($cl_address, true)) $err->add($i18n->get('error.field'), $i18n->get('label.client_address'));
+  if (!ttValidFloat($cl_tax, true)) $err->add($i18n->get('error.field'), $i18n->get('label.tax'));
+
+  if ($err->no()) {
+    if ($request->getParameter('btn_save')) {
       $client = ttClientHelper::getClientByName($cl_name);
       if (($client && ($cl_id == $client['id'])) || !$client) {
         if (ttClientHelper::update(array(
@@ -90,15 +96,16 @@ if ($request->getMethod() == 'POST') {
           header('Location: clients.php');
           exit();
         } else
-          $errors->add($i18n->getKey('error.db'));     
+          $err->add($i18n->get('error.db'));
       } else
-        $errors->add($i18n->getKey('error.client_exists'));
-       }
-       
+        $err->add($i18n->get('error.object_exists'));
+    }
+
     if ($request->getParameter('btn_copy')) {
       if (!ttClientHelper::getClientByName($cl_name)) {
         if (ttClientHelper::insert(array(
-          'team_id' => $user->team_id,
+          'group_id' => $user->getGroup(),
+          'org_id' => $user->org_id,
           'name' => $cl_name,
           'address' => $cl_address,
           'tax' => $cl_tax,
@@ -107,14 +114,14 @@ if ($request->getMethod() == 'POST') {
           header('Location: clients.php');
           exit();
         } else
-          $errors->add($i18n->getKey('error.db'));
+          $err->add($i18n->get('error.db'));
       } else
-        $errors->add($i18n->getKey('error.client_exists'));
+        $err->add($i18n->get('error.object_exists'));
     }
   }
-} // post
-       
+} // isPost
+
 $smarty->assign('forms', array($form->getName()=>$form->toArray()));
-$smarty->assign('title', $i18n->getKey('title.edit_client'));
+$smarty->assign('title', $i18n->get('title.edit_client'));
 $smarty->assign('content_page_name', 'client_edit.tpl');
 $smarty->display('index.tpl');