A bit of refactoring.

diff --git a/WEB-INF/lib/ttTimeHelper.class.php b/WEB-INF/lib/ttTimeHelper.class.php
index bdec1a5..d2a3564 100644 (file)
--- a/WEB-INF/lib/ttTimeHelper.class.php
+++ b/WEB-INF/lib/ttTimeHelper.class.php
@@ -659,8 +659,13 @@ class ttTimeHelper {
   }
 
   // getRecord - retrieves a time record identified by its id.
-  static function getRecord($id, $user_id) {
+  static function getRecord($id) {
     global $user;
+
+    $user_id = $user->getUser();
+    $group_id = $user->getGroup();
+    $org_id = $user->org_id;
+
     $sql_time_format = "'%k:%i'"; //  24 hour format.
     if ('%I:%M %p' == $user->time_format)
       $sql_time_format = "'%h:%i %p'"; // 12 hour format for MySQL TIME_FORMAT function.
@@ -674,7 +679,7 @@ class ttTimeHelper {
       " l.timesheet_id, l.invoice_id, l.billable, l.paid, l.date from tt_log l".
       " left join tt_projects p on (p.id = l.project_id)".
       " left join tt_tasks t on (t.id = l.task_id)".
-      " where l.id = $id and l.user_id = $user_id and l.status = 1";
+      " where l.id = $id and l.user_id = $user_id and l.group_id = $group_id and l.org_id = $org_id and l.status = 1";
     $res = $mdb2->query($sql);
     if (!is_a($res, 'PEAR_Error')) {
       if (!$res->numRows()) {

diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index b5578c4..eb0fd59 100644 (file)
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
-          <td align="center">&nbsp;Anuko Time Tracker 1.18.46.4796 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.18.46.4797 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>

diff --git a/mobile/time_delete.php b/mobile/time_delete.php
index 8ebb98a..1b122fb 100644 (file)
--- a/mobile/time_delete.php
+++ b/mobile/time_delete.php
@@ -38,8 +38,7 @@ if (!ttAccessAllowed('track_own_time')) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-$user_id = $user->getUser();
-$time_rec = ttTimeHelper::getRecord($cl_id, $user_id);
+$time_rec = ttTimeHelper::getRecord($cl_id);
 if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
   // Prohibit deleting not ours, or assigned to timesheet, or invoiced records.
   header('Location: access_denied.php');

diff --git a/mobile/time_edit.php b/mobile/time_edit.php
index 0b5b090..1f8f7de 100644 (file)
--- a/mobile/time_edit.php
+++ b/mobile/time_edit.php
@@ -40,8 +40,7 @@ if (!ttAccessAllowed('track_own_time')) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-$user_id = $user->getUser();
-$time_rec = ttTimeHelper::getRecord($cl_id, $user_id);
+$time_rec = ttTimeHelper::getRecord($cl_id);
 if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
   // Prohibit editing not ours, or assigned to timesheet, or invoiced records.
   header('Location: access_denied.php');
@@ -49,6 +48,8 @@ if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
 }
 // End of access checks.
 
+$user_id = $user->getUser();
+
 // Use custom fields plugin if it is enabled.
 if ($user->isPluginEnabled('cf')) {
   require_once('../plugins/CustomFields.class.php');

diff --git a/mobile/timer.php b/mobile/timer.php
index c754740..d3a0d0f 100644 (file)
--- a/mobile/timer.php
+++ b/mobile/timer.php
@@ -254,7 +254,7 @@ if ($request->isPost()) {
   }
   if ($request->getParameter('btn_stop')) {
     // Stop button clicked. We need to finish an uncompleted record in progress.
-    $record = ttTimeHelper::getRecord($uncompleted['id'], $user->getUser());
+    $record = ttTimeHelper::getRecord($uncompleted['id']);
 
     // Can we complete this record?
     if (ttTimeHelper::isValidInterval($record['start'], $cl_finish) // finish time is greater than start time

diff --git a/time.php b/time.php
index e4547a9..f7b1c12 100644 (file)
--- a/time.php
+++ b/time.php
@@ -56,7 +56,7 @@ if ($request->isPost()) {
 }
 // End of access checks.
 
-// Determine user for which we display this page.
+// Determine user for whom we display this page.
 if ($request->isPost() && $userChanged) {
   $user_id = $request->getParameter('user');
   $user->setOnBehalfUser($user_id);
@@ -347,7 +347,7 @@ if ($request->isPost()) {
   } elseif ($request->getParameter('btn_stop')) {
     // Stop button pressed to finish an uncompleted record.
     $record_id = $request->getParameter('record_id');
-    $record = ttTimeHelper::getRecord($record_id, $user_id);
+    $record = ttTimeHelper::getRecord($record_id);
     $browser_date = $request->getParameter('browser_date');
     $browser_time = $request->getParameter('browser_time');
 

diff --git a/time_delete.php b/time_delete.php
index 1b6f5c2..e83630e 100644 (file)
--- a/time_delete.php
+++ b/time_delete.php
@@ -38,8 +38,7 @@ if (!(ttAccessAllowed('track_own_time') || ttAccessAllowed('track_time'))) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-$user_id = $user->getUser();
-$time_rec = ttTimeHelper::getRecord($cl_id, $user_id);
+$time_rec = ttTimeHelper::getRecord($cl_id);
 if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
   // Prohibit deleting not ours, or assigned to timesheet, or invoiced records.
   header('Location: access_denied.php');

diff --git a/time_edit.php b/time_edit.php
index 48db27e..23cc63d 100644 (file)
--- a/time_edit.php
+++ b/time_edit.php
@@ -40,8 +40,7 @@ if (!(ttAccessAllowed('track_own_time') || ttAccessAllowed('track_time'))) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-$user_id = $user->getUser();
-$time_rec = ttTimeHelper::getRecord($cl_id, $user_id);
+$time_rec = ttTimeHelper::getRecord($cl_id);
 if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
   // Prohibit editing not ours, or assigned to timesheet, or invoiced records.
   header('Location: access_denied.php');
@@ -49,6 +48,8 @@ if (!$time_rec || $time_rec['timesheet_id'] || $time_rec['invoice_id']) {
 }
 // End of access checks.
 
+$user_id = $user->getUser();
+
 // Use custom fields plugin if it is enabled.
 if ($user->isPluginEnabled('cf')) {
   require_once('plugins/CustomFields.class.php');