Security fix for invoice view. Also paid status handler for invoice view.
[timetracker.git] / invoice_view.php
1 <?php
2 // +----------------------------------------------------------------------+
3 // | Anuko Time Tracker
4 // +----------------------------------------------------------------------+
5 // | Copyright (c) Anuko International Ltd. (https://www.anuko.com)
6 // +----------------------------------------------------------------------+
7 // | LIBERAL FREEWARE LICENSE: This source code document may be used
8 // | by anyone for any purpose, and freely redistributed alone or in
9 // | combination with other software, provided that the license is obeyed.
10 // |
11 // | There are only two ways to violate the license:
12 // |
13 // | 1. To redistribute this code in source form, with the copyright
14 // |    notice or license removed or altered. (Distributing in compiled
15 // |    forms without embedded copyright notices is permitted).
16 // |
17 // | 2. To redistribute modified versions of this code in *any* form
18 // |    that bears insufficient indications that the modifications are
19 // |    not the work of the original author(s).
20 // |
21 // | This license applies to this document only, not any other software
22 // | that it may be combined with.
23 // |
24 // +----------------------------------------------------------------------+
25 // | Contributors:
26 // | https://www.anuko.com/time_tracker/credits.htm
27 // +----------------------------------------------------------------------+
28
29 require_once('initialize.php');
30 import('DateAndTime');
31 import('ttInvoiceHelper');
32 import('ttClientHelper');
33 import('form.Form');
34
35 // Access check.
36 if (!ttAccessCheck(right_view_invoices) || !$user->isPluginEnabled('iv')) {
37   header('Location: access_denied.php');
38   exit();
39 }
40
41 $cl_id = (int)$request->getParameter('id');
42 $invoice = ttInvoiceHelper::getInvoice($cl_id);
43 // Temporary fix for invalid invoice id. TODO: implement properly and review security of other pages,
44 // where item id is passed (or posted) as parameter.
45 if (!$invoice) {
46   header('Location: access_denied.php');
47   exit();
48 }
49
50 $invoice_date = new DateAndTime(DB_DATEFORMAT, $invoice['date']);
51 $client = ttClientHelper::getClient($invoice['client_id'], true);
52 if (!$client) // In case client was deleted.
53   $client = ttClientHelper::getDeletedClient($invoice['client_id']);
54
55 $invoice_items = ttInvoiceHelper::getInvoiceItems($cl_id);
56 $tax_percent = $client['tax'];
57
58 $subtotal = 0;
59 $tax = 0;
60 foreach($invoice_items as $item)
61   $subtotal += $item['cost'];
62 if ($tax_percent) {
63   $tax_expenses = $user->isPluginEnabled('et');
64   foreach($invoice_items as $item) {
65     if ($item['type'] == 2 && !$tax_expenses)
66       continue;
67     $tax += round($item['cost'] * $tax_percent / 100, 2);
68   }
69 }
70 $total = $subtotal + $tax; 
71
72 $smarty->assign('subtotal', $user->currency.' '.str_replace('.', $user->decimal_mark, sprintf('%8.2f', round($subtotal, 2))));
73 if ($tax) $smarty->assign('tax', $user->currency.' '.str_replace('.', $user->decimal_mark, sprintf('%8.2f', round($tax, 2))));
74 $smarty->assign('total', $user->currency.' '.str_replace('.', $user->decimal_mark, sprintf('%8.2f', round($total, 2))));
75
76 if ('.' != $user->decimal_mark) {
77   foreach ($invoice_items as &$item)
78     $item['cost'] = str_replace('.', $user->decimal_mark, $item['cost']);
79 }
80
81 // Calculate colspan for invoice summary.
82 $colspan = 4;
83 if (MODE_PROJECTS == $user->tracking_mode)
84   $colspan++;
85 elseif (MODE_PROJECTS_AND_TASKS == $user->tracking_mode)
86   $colspan += 2;
87
88 $form = new Form('invoiceForm');
89 // Hidden control for invoice id.
90 $form->addInput(array('type'=>'hidden','name'=>'id','value'=>$cl_id));
91 // invoiceForm only contains controls for "Mark paid" block below invoice table.
92 if ($user->isPluginEnabled('ps')) {
93   $mark_paid_action_options = array('1'=>$i18n->getKey('dropdown.paid'),'2'=>$i18n->getKey('dropdown.not_paid'));
94   $form->addInput(array('type'=>'combobox',
95     'name'=>'mark_paid_action_options',
96     'data'=>$mark_paid_action_options,
97     'value'=>$cl_mark_paid_action_option));
98   $form->addInput(array('type'=>'submit','name'=>'btn_mark_paid','value'=>$i18n->getKey('button.submit')));
99 }
100
101 if ($request->isPost()) {
102   if ($request->getParameter('btn_mark_paid')) {
103     // User clicked the "Mark paid" button to mark all invoice items either paid or not paid.
104
105     // Determine user action.
106     $mark_paid = $request->getParameter('mark_paid_action_options') == 1 ? true : false;
107     ttInvoiceHelper::markPaid($cl_id, $mark_paid);
108
109     // Re-display this form.
110     header('Location: invoice_view.php?id='.$cl_id);
111     exit();
112   }
113 }
114
115 $smarty->assign('forms', array($form->getName()=>$form->toArray()));
116 $smarty->assign('invoice_id', $cl_id);
117 $smarty->assign('invoice_name', $invoice['name']);
118 $smarty->assign('invoice_date', $invoice_date->toString($user->date_format));
119 $smarty->assign('client_name', $client['name']);
120 $smarty->assign('client_address', $client['address']);
121 $smarty->assign('invoice_items', $invoice_items);
122 $smarty->assign('colspan', $colspan);
123 $smarty->assign('title', $i18n->getKey('title.view_invoice'));
124 $smarty->assign('content_page_name', 'invoice_view.tpl');
125 $smarty->display('index.tpl');