header('Location: feature_disabled.php');
exit();
}
-
-$cl_id = $request->getParameter('id');
-
+$cl_id = (int)$request->getParameter('id');
// Get the expense item we are editing.
$expense_item = ttExpenseHelper::getItem($cl_id, $user->getActiveUser());
-
-// Prohibit editing invoiced items.
-if ($expense_item['invoice_id']) die($i18n->get('error.sys'));
+if (!$expense_item || $expense_item['invoice_id']) {
+ // Prohibit editing not ours or invoiced items.
+ header('Location: access_denied.php');
+ exit();
+}
$item_date = new DateAndTime(DB_DATEFORMAT, $expense_item['date']);
// Dropdown for clients in MODE_TIME. Use all active clients.
if (MODE_TIME == $user->tracking_mode && $user->isPluginEnabled('cl')) {
- $active_clients = ttTeamHelper::getActiveClients($user->team_id, true);
+ $active_clients = ttTeamHelper::getActiveClients($user->group_id, true);
$form->addInput(array('type'=>'combobox',
'onchange'=>'fillProjectDropdown(this.value);',
'name'=>'client',
// Dropdown for clients if the clients plugin is enabled.
if ($user->isPluginEnabled('cl')) {
- $active_clients = ttTeamHelper::getActiveClients($user->team_id, true);
+ $active_clients = ttTeamHelper::getActiveClients($user->group_id, true);
// We need an array of assigned project ids to do some trimming.
foreach($project_list as $project)
$projects_assigned_to_user[] = $project['id'];
}
}
// If predefined expenses are configured, add controls to select an expense and quantity.
-$predefined_expenses = ttTeamHelper::getPredefinedExpenses($user->team_id);
+$predefined_expenses = ttTeamHelper::getPredefinedExpenses($user->group_id);
if ($predefined_expenses) {
$form->addInput(array('type'=>'combobox',
'onchange'=>'recalculateCost();',