Improved safety of timesheet assignment by adding an inner join.

[timetracker.git] / WEB-INF / lib / ttReportHelper.class.php

diff --git a/WEB-INF/lib/ttReportHelper.class.php b/WEB-INF/lib/ttReportHelper.class.php
index ceaee4b011f530c00cd77c5ab676047cb2c5823d..a64bb8700e31749b127cace55e6dd6c239942fc6 100644 (file)
--- a/WEB-INF/lib/ttReportHelper.class.php
+++ b/WEB-INF/lib/ttReportHelper.class.php
@@ -639,9 +639,10 @@ class ttReportHelper {
     $org_id = $user->org_id;
 
     if ($time_log_ids) {
-      $sql = "update tt_log l".
-        // TODO: inner join does not work properly for de-assignment. Improve.
-        // " inner join tt_timesheets ts on (ts.id = $timesheet_id and ts.approve_status is null)".
+      if ($timesheet_id)
+        $inner_join = " inner join tt_timesheets ts on (ts.id = $timesheet_id and ts.approve_status is null)";
+
+      $sql = "update tt_log l $inner_join".
         " set l.timesheet_id = ".$mdb2->quote($timesheet_id).
         " where l.id in(".join(', ', $time_log_ids).") and l.user_id = $user_id and l.group_id = $group_id and l.org_id = $org_id";
       $affected = $mdb2->exec($sql);