From a08292683b29da0946e2099e3fd94bc2d19688f3 Mon Sep 17 00:00:00 2001
From: Nik Okuntseff <support@anuko.com>
Date: Wed, 12 Dec 2018 19:55:03 +0000
Subject: [PATCH] Some more refactoring of reports for subgroups.

---
 WEB-INF/lib/ttReportHelper.class.php | 26 ++++++++++++++++++--------
 WEB-INF/templates/footer.tpl         |  2 +-
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/WEB-INF/lib/ttReportHelper.class.php b/WEB-INF/lib/ttReportHelper.class.php
index 13226ca4..38da9879 100644
--- a/WEB-INF/lib/ttReportHelper.class.php
+++ b/WEB-INF/lib/ttReportHelper.class.php
@@ -564,35 +564,45 @@ class ttReportHelper {
   }
 
   // The assignToInvoice assigns a set of records to a specific invoice.
-  static function assignToInvoice($invoice_id, $time_log_ids, $expense_item_ids)
-  {
+  static function assignToInvoice($invoice_id, $time_log_ids, $expense_item_ids) {
+    global $user;
     $mdb2 = getConnection();
+
+    $group_id = $user->getGroup();
+    $org_id = $user->org_id;
+
     if ($time_log_ids) {
       $sql = "update tt_log set invoice_id = ".$mdb2->quote($invoice_id).
-        " where id in(".join(', ', $time_log_ids).")";
+        " where id in(".join(', ', $time_log_ids).") and group_id = $group_id and org_id = $org_id";
       $affected = $mdb2->exec($sql);
       if (is_a($affected, 'PEAR_Error')) die($affected->getMessage());
     }
     if ($expense_item_ids) {
       $sql = "update tt_expense_items set invoice_id = ".$mdb2->quote($invoice_id).
-        " where id in(".join(', ', $expense_item_ids).")";
+        " where id in(".join(', ', $expense_item_ids).") and group_id = $group_id and org_id = $org_id";
       $affected = $mdb2->exec($sql);
       if (is_a($affected, 'PEAR_Error')) die($affected->getMessage());
     }
   }
 
   // The markPaid marks a set of records as either paid or unpaid.
-  static function markPaid($time_log_ids, $expense_item_ids, $paid = true)
-  {
+  static function markPaid($time_log_ids, $expense_item_ids, $paid = true) {
+    global $user;
     $mdb2 = getConnection();
+
+    $group_id = $user->getGroup();
+    $org_id = $user->org_id;
+
     $paid_val = (int) $paid;
     if ($time_log_ids) {
-      $sql = "update tt_log set paid = $paid_val where id in(".join(', ', $time_log_ids).")";
+      $sql = "update tt_log set paid = $paid_val".
+        " where id in(".join(', ', $time_log_ids).") and group_id = $group_id and org_id = $org_id";
       $affected = $mdb2->exec($sql);
       if (is_a($affected, 'PEAR_Error')) die($affected->getMessage());
     }
     if ($expense_item_ids) {
-      $sql = "update tt_expense_items set paid = $paid_val where id in(".join(', ', $expense_item_ids).")";
+      $sql = "update tt_expense_items set paid = $paid_val".
+        " where id in(".join(', ', $expense_item_ids).") and group_id = $group_id and org_id = $org_id";
       $affected = $mdb2->exec($sql);
       if (is_a($affected, 'PEAR_Error')) die($affected->getMessage());
     }
diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index 2a14a1fa..490d773c 100644
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
-          <td align="center">&nbsp;Anuko Time Tracker 1.18.29.4639 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.18.29.4640 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
-- 
2.20.1