$cl_id = (int)$request->getParameter('id');
// Get the expense item we are deleting.
$expense_item = ttExpenseHelper::getItem($cl_id);
-if (!$expense_item || $expense_item['invoice_id']) {
- // Prohibit deleting not ours or invoiced items.
+if (!$expense_item || $expense_item['approved'] || $expense_item['invoice_id']) {
+ // Prohibit deleting not ours, approved, or invoiced items.
header('Location: access_denied.php');
exit();
}
+// End of access checks.
if ($request->isPost()) {
if ($request->getParameter('delete_button')) { // Delete button pressed.
$form->addInput(array('type'=>'submit','name'=>'delete_button','value'=>$i18n->get('label.delete')));
$form->addInput(array('type'=>'submit','name'=>'cancel_button','value'=>$i18n->get('button.cancel')));
-$smarty->assign('expense_item', $expense_item);
+$show_project = MODE_PROJECTS == $user->getTrackingMode() || MODE_PROJECTS_AND_TASKS == $user->getTrackingMode();
+
$smarty->assign('forms', array($form->getName() => $form->toArray()));
+$smarty->assign('expense_item', $expense_item);
+$smarty->assign('show_project', $show_project);
$smarty->assign('title', $i18n->get('title.delete_expense'));
$smarty->assign('content_page_name', 'expense_delete.tpl');
$smarty->display('index.tpl');