diff --git a/.gitignore b/.gitignore index f18711d1f..ad22028c1 100644 --- a/.gitignore +++ b/.gitignore @@ -12,6 +12,7 @@ uploads/document_templates/* !uploads/document_templates/index.php uploads/expenses/* !uploads/expenses/index.php +!uploads/expenses/.htaccess uploads/recurring_tickets/* !uploads/recurring_tickets/index.php uploads/settings/* diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a04f8077..e189fbc74 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,9 +6,9 @@ This file documents all notable changes made to ITFlow. ### Upgrading to 26.11 -Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 2.9.8) in the same pass. Nothing else is required. +Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 2.9.9) in the same pass. Nothing else is required. -This is a big release, with nineteen database steps in one go, so take a backup before you update. +This is a big release, with twenty database steps in one go, so take a backup before you update. The update also clears out data that deletes in older versions left behind, all of it pointing at something that no longer exists: @@ -21,6 +21,8 @@ It also gives every existing network a type (LAN, WAN, Guest and so on) guessed Payment reminders keep the schedule they had: 1 and 30 days late, then every 30 days until the invoice is paid. If reminders were on, they stay on, and every client is included. The schedule can now be changed in Admin > Settings > Invoice (see Breaking Changes, Billing emails). Monthly statements start switched off. +Expenses already entered take who entered them from the audit log, where it has a record of it. Expense receipts are no longer opened straight from the uploads folder - see Breaking Changes, Expenses. + If you are coming from 26.08 or earlier, the database update still has to be run from the command line one time, exactly as described under Upgrading to 26.09 below. ### Breaking Changes and Notes @@ -74,6 +76,11 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Copying an invoice, or making an invoice from a quote, is refused when a tracked product on it is short, the same as adding the line by hand. Add the stock first. - Invoices made from recurring invoices are now linked to their products, so they count as sold on the product's page and in the reports. They don't move stock. - Stock can be counted in fractions (up to two decimal places), such as cable by the metre. +- Expenses: + - Receipts open through ITFlow, for agents with Financial access to the expense, instead of straight from `uploads/expenses/`. An old link to a receipt file stops working. On Apache the folder is closed by the `.htaccess` that comes with the update. On nginx, deny `/uploads/expenses/` the way you deny `/uploads/tmp/` and `/uploads/backups/`. + - A new expense takes the currency of the account it is paid from. It used to take the company's currency whatever the account. + - The description is optional now. + - Bulk Set Category, Set Account and Set Client are one window each from the same Bulk menu, with Set Payment Method added. Bulk Delete is one button that asks once. - Notifications now follow access too. An agent only sees notifications for clients and areas they can open, so someone without sales access no longer sees invoice and quote notifications. - Drop-downs: Tom Select is gone, replaced by ITFlow's own picker. It works the way you are used to: type to search, tick several in a multi-select, and type a new value in fields that allow it, such as ticket watchers. See Developer Updates if you have custom pages that used Tom Select. - Several small windows are gone because the change is now made where the value is shown: @@ -304,6 +311,26 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Our vendors' pages have a Products tab listing what we buy from them. - Search finds products by part number and opens their page. - The starter catalog in Starter Content comes with how each item is billed. The demo data's products have costs, vendors and part numbers. +- **Expenses** (rebuilt) + - Along the top of the list: what was spent this month against the same days of last month, the year so far with its monthly average, what the running recurring expenses come to a month, and how many expenses in the last 90 days have no receipt. Each one opens the expenses behind it. + - Pills cut the list to expenses for a client, ones with no receipt, and refunds, each with a count. Filter by vendor, category, client and date, and under More filters by account and how it was paid. The total of everything the filters leave sits under the list. + - Each row shows the vendor with what it was for and its reference, the category with its colour, the client, the account and how it was paid, and a paperclip that opens the receipt. + - Clicking an expense opens its quick look: + - the receipt right in the window when it is a photo or a PDF + - who it was paid to, the category, account, payment method, reference and client + - who entered it and when + - the refunds against it + - the stock deliveries it paid for + - With no receipt yet, attach one right there - on a phone, take the picture. + - New Expense, Edit, Copy and Refund are one form with an icon on every field. Picking a vendor fills in the category, account and payment method of the last expense with them, unless you changed those yourself. + - The payment method is saved on each expense, starting from the default in Admin > Settings > Defaults. + - Copy dates the copy today and leaves off the reference and receipt. + - Refund starts at what hasn't come back yet and is linked to the expense, so each shows the other. + - A receipt can be replaced or removed in Edit. + - Bulk actions set the category, account, payment method or client on the ticked expenses, or delete them. Expenses of clients you can't see are left alone. + - Export takes the same filters as the list, adding client, payment method and the pills, with Paid By, Receipt and Entered By columns. + - Search finds expenses by what they were for, their reference or their amount, and opens the quick look. + - The vendor page's Expenses tab, Transactions and a product's stock history open the expense's quick look. Client Profitability links each client's direct costs to their expenses. - **Tickets** - The ticket list has views for Open, Mine, Unassigned, Needs reply, Waiting, Overdue, Scheduled, Closed and All. - Each row shows whose move it is (yours or the client's) along with SLA and due badges, and status, priority and agent change right in the row. @@ -480,6 +507,10 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Billing: the nightly late fee line was saved without its subtotal, and the invoice total was raised by hand instead of from its lines. - Billing: the email telling your team a quote was accepted or declined linked to a page that doesn't exist. It now opens the quote. - Billing: a batch payment's receipt went to the primary contact only, and sending it wrote a PHP warning. +- Expenses: receipts were served straight from `uploads/expenses/`, so anyone with a receipt's address could open it without signing in. +- Expenses: Bulk Delete's Yes, Delete! button did nothing. Bulk Set Client could change expenses of clients the agent is not allowed to see. +- Expenses: the New Expense window opened for agents who could not save one. Deleting an expense with no receipt, or replacing a receipt when there was none, wrote a PHP warning. +- Expenses: there was no way to set how an expense was paid, so the default payment method in Admin > Settings > Defaults went unused. A photo receipt downloaded with .pdf on its name. - Products: Restore in the archived list's bulk actions did nothing. Deleting a product left its stock records behind. - Products: Add Stock could record zero units, or link an expense that no longer existed. - Products: deleting an invoice did not put its stock back. Copying an invoice or making one from a quote lost the link to the product, so the copy took no stock and the product did not count it as sold. @@ -552,6 +583,7 @@ If you are coming from 26.08 or earlier, the database update still has to be run - 2.9.6: `products.product_asset_type` (one of the asset types, NULL for none), `product_make`, `product_model` and `product_warranty_months`. `assets.asset_product_id`, `asset_invoice_id` and `asset_invoice_item_id`, keyed on the product and the invoice. - 2.9.7: `product_prices` - a product's price and cost history: `price_old`, `price_new`, `price_cost_old`, `price_cost_new`, `price_source` (`edit`, `import` or `receive`), `price_user_id` and `price_product_id`, keyed. - 2.9.8: `settings.config_invoice_reminder_days` ('1,30' - days from the due date, negative before it), `config_invoice_reminder_repeat` (30), `config_statement_monthly` (0), `config_statement_day` (1) and `config_billing_email_attach_pdf` (1), and `clients.client_reminders` (1). + - 2.9.9: `expenses.expense_created_by` (0 for cron and payment providers), backfilled from the audit log's Expense Create entries, and `expense_refund_of_id`. - New shared function files, loaded by `functions.php`: `functions/asset.php`, `asset_interface.php`, `certificate.php`, `client_overview.php`, `contact.php`, `credential.php`, `dashboard.php`, `links.php`, `location.php`, `notifications.php`, `project.php`, `rack.php`, `search.php`, `service.php`, `software.php`, `tags.php`, `ticket.php`, `ticket_fields.php`, `user.php` and `vendor.php`. They hold the queries and rules, so the pages, the API and cron share one definition. - Removed post models: `agent/post/{asset_interface,certificate,credential,domain,event,location,network_ip,network,recurring_ticket,vendor}_model.php`, `admin/post/user_model.php` and `api/v1/certificates/certificate_model.php`. Their handlers call the shared functions above. Interface handlers moved to `agent/post/asset_interface.php`. - New scripts: `js/itflow_select.js`, `quick_pick.js`, `tag_picker.js`, `global_search.js`, `notifications.js`, `dashboard.js`, `client_overview.js`, `client_switcher.js`, `credentials.js` and `autosubmit.js`, and `agent/js/calendar.js`, `calendar_event_modal.js`, `files.js`, `interface_form.js`, `network_form.js`, `project_modal.js` and `ticket_schedule_modal.js`. @@ -687,6 +719,18 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Price history: `productSave($in, $product_id, &$error, $source)` records a change to an existing product's price or cost through `productPriceRecord()` - `edit_product` passes `edit`, `import_products_csv` passes `import` and `product_stock_save` passes `receive` when a delivery sets the cost. Also `productPriceSources()`, `productPrices()` and `productPriceLastChange()`. `productDelete()` and the demo data removal delete the history too. - Repricing: `productRepriceKinds()`, `productRepriceUnionSql()` (every line from a product on recurring invoices not archived, draft invoices and draft quotes, as one union), `productRepriceOldSql()` (at a price in the product's history), `productRepriceFilterSql()`, `productRepriceCount($filters)` (lines, by kind, products, and the change a month on recurring invoices) and `productRepriceLines($filters)` (by product, with `old` and `suggested`). `productRepriceApply($changes, &$error)` checks every line and price, then changes them in one transaction through `billingItemSetPrice($type, $doc_id, $item_id, $price)` (new in `functions/billing.php` - the line's amounts at its tax rate, then `billingRecalc()`), with a history line on each document. - New page `agent/products_reprice.php` (`?product_id=`, `client_id`, `kind` and `doc_id`) posting `products_reprice_save` (`pick[]` of `kind:item_id`, and `price[kind:item_id]`). `dashboardAttention()` adds Lines at an old price, and the invoice, quote and recurring invoice pages link their own. CSS: `.itflow-reprice-*`. +- Expenses, in `functions/expenses.php` (loaded by `functions.php`): + - `expenseRow($id, $scoped = true)` reads an expense with its vendor, category, account, client and creator, `transfer_id` when it is the out side of a transfer, the expense it refunds and `refunded_amount`. It is scoped to the agent's clients unless told otherwise. + - `expenseSave($in, $id, &$error)` is the one path that writes an expense from a form - New, Edit, Copy and Refund. It checks the date, a non-zero amount, one of our vendors, an Expense category, an account, a client in scope and a listed payment method. An archived vendor, category or account is kept only when the expense already has it. `refund_of` makes the amount negative and sets `expense_refund_of_id`. A new expense takes the account's currency and records `expense_created_by`. + - `expenseDelete($id, &$error)` refuses a transfer's expense. Otherwise it removes the receipt, clears `product_stock.stock_expense_id` and refunds' `expense_refund_of_id`, then deletes. + - Receipts: `expenseReceiptTypes()`, `expenseReceiptPath()` (realpath-checked under `uploads/expenses/`), `expenseReceiptKind()`, `expenseReceiptName()`, `expenseReceiptStore($id, $file, &$error)` (replaces and deletes the old file) and `expenseReceiptRemove()`. + - The list and export share `expenseFiltersSql($src, &$summary)` (q, vendor, category, account, client, method, show, dtf, dtt, with the client scope and the vendor-only rule), `expenseJoinsSql()` and `expenseShows()`, the pills. + - Also `expenseStats()`, `expenseRecurringMonthlySql()`, `expenseVendorDefaults()` (the last expense's category, account and method by vendor), `expenseVendors()`, `expenseCategories()`, `expenseCategoryDot()` and `expenseLabel()`. + - New `agent/expense_receipt.php?expense_id=` serves the receipt after the Financial and client checks: inline with `&action=view` for photos and PDFs, otherwise as a download. `uploads/expenses/.htaccess` denies the folder, and `.gitignore` keeps it. + - New windows: the quick look `agent/modals/expense/expense.php?id=`, `expense_form.php` (the fields of `expense_add.php`, `expense_edit.php`, `expense_copy.php` and `expense_refund.php`) and `expense_bulk_edit.php?field=` (category, account, client or method). + - Handlers: `add_expense` (with `refund_of`) and `edit_expense` (with `receipt_remove`) post `vendor`, `amount`, `date`, `category`, `account`, `payment_method`, `client_id`, `reference`, `description` and `file`. New are `expense_receipt_save` (POST `expense_id`, `file`) and `bulk_edit_expenses` (POST `field`, `value`, `expense_ids[]`). `export_expenses` takes `client`, `method` and `show`, and the export adds `expense_payment_method`, `expense_receipt_display` and `user_name` columns. + - `agent/expenses.php` takes `?client=`, `?method=`, `?show=` and `?open=` (opens a quick look, as search does). `globalSearchGroups()` has an `expenses` group under `module_financial`. CSS: `.itflow-category-dot` and `.itflow-expense-receipt-empty`. + - Removed: `agent/post/expense_model.php`, `agent/modals/expense/expense_bulk_edit_category.php`, `expense_bulk_edit_account.php` and `expense_bulk_edit_client.php`, and the `bulk_edit_expense_category`, `bulk_edit_expense_account` and `bulk_edit_expense_client` handlers. - The billing helpers (`billingTimeInvoice()`, `quoteConvert()`, `recurringInvoiceGenerate()` and the rest) take the agent's name as plain text. Their handlers now pass `stripslashes($session_name)`, so a name with an apostrophe no longer shows a backslash in history and the audit log. - Sidebar brand: `agent/css/sidebar_brand_fix.css` and `agent/js/sidebar_brand_fix.js` from 26.10 are replaced by CSS in `css/itflow_custom.css`. `includes/load_company_settings.php` now sets `$session_company_logo`. - `alertMessageHtml()` no longer double-encodes, and save messages built from `escapeSql()` values use `stripslashes()` at the flash. diff --git a/admin/database_updates/2.9.9.php b/admin/database_updates/2.9.9.php new file mode 100644 index 000000000..19c32d4db --- /dev/null +++ b/admin/database_updates/2.9.9.php @@ -0,0 +1,22 @@ + 0 AND log_user_id > 0 + GROUP BY log_entity_id) AS created ON created.log_entity_id = expense_id + SET expense_created_by = created.user_id"); diff --git a/agent/expense_receipt.php b/agent/expense_receipt.php new file mode 100644 index 000000000..823b4121a --- /dev/null +++ b/agent/expense_receipt.php @@ -0,0 +1,50 @@ += 2; +$can_delete = lookupUserPermission('module_financial') >= 3; + +$vendor_filter = intval($_GET['vendor'] ?? 0); +$category_filter = intval($_GET['category'] ?? 0); +$account_filter = intval($_GET['account'] ?? 0); +$client_filter = intval($_GET['client'] ?? 0); +$method_filter = trim((string) ($_GET['method'] ?? '')); +$shows = expenseShows(); +$show = isset($shows[$_GET['show'] ?? '']) ? (string) ($_GET['show'] ?? '') : ''; + +// Only these sort - filter_header.php hands through any lowercase word +$sortable_columns = ['expense_date' => 'expense_date', 'vendor_name' => 'vendor_name', 'category_name' => 'category_name', 'client_name' => 'client_name', + 'account_name' => 'account_name', 'expense_amount' => 'expense_amount', 'expense_created_at' => 'expense_created_at']; +if (!isset($sortable_columns[$sort])) { + $sort = 'expense_date'; } -// Vendor Filter -if (isset($_GET['vendor']) & !empty($_GET['vendor'])) { - $vendor_query = 'AND (vendor_id = ' . intval($_GET['vendor']) . ')'; - $vendor_filter = intval($_GET['vendor']); -} else { - // Default - any - $vendor_query = ''; - $vendor_filter = ''; -} +// Everything but the pill, then the pill - the pill counts are over what the rest leave +$filter_src = array_merge($_GET, ['dtf' => $dtf, 'dtt' => $dtt, 'show' => '']); +$where = expenseFiltersSql($filter_src); +$show_query = $shows[$show]['where'] ? "AND {$shows[$show]['where']}" : ''; +$joins = expenseJoinsSql(); -// Category Filter -if (isset($_GET['category']) & !empty($_GET['category'])) { - $category_query = 'AND (category_id = ' . intval($_GET['category']) . ')'; - $category_filter = intval($_GET['category']); -} else { - // Default - any - $category_query = ''; - $category_filter = ''; -} - -$sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, expense_account_id, expense_amount, - expense_category_id, expense_client_id, expense_created_at, expense_currency_code, - expense_date, expense_description, expense_id, expense_receipt, expense_reference, - expense_vendor_id, vendor_name FROM expenses - LEFT JOIN categories ON expense_category_id = category_id - LEFT JOIN vendors ON expense_vendor_id = vendor_id - LEFT JOIN accounts ON expense_account_id = account_id - LEFT JOIN clients ON expense_client_id = client_id - WHERE expense_vendor_id > 0 - AND DATE(expense_date) BETWEEN '$dtf' AND '$dtt' - $vendor_query - $category_query - AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%') - $account_query - " . clientScopeSql('expense_client_id') . " - ORDER BY $sort $order LIMIT $record_from, $record_to" -); +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS expenses.*, vendor_name, vendor_archived_at, category_name, category_color, account_name, client_name, user_name + FROM expenses $joins + WHERE $where $show_query + ORDER BY {$sortable_columns[$sort]} $order, expense_id DESC LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +$expenses = []; +while ($row = mysqli_fetch_assoc($sql)) { + $expenses[] = $row; +} + +// The pills, and the total of what is listed +$count_sql = []; +foreach ($shows as $key => $s) { + $count_sql[] = $key === '' ? 'COUNT(*)' : "COALESCE(SUM({$s['where']}), 0)"; +} +$row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', $count_sql) . ", + COALESCE(SUM(CASE WHEN 1 $show_query THEN expense_amount END), 0) + FROM expenses $joins WHERE $where")); +$counts = []; +foreach (array_keys($shows) as $i => $key) { + $counts[$key] = intval($row[$i]); +} +$listed_total = floatval($row[count($shows)]); + +$stats = expenseStats(); + +$filter_url = function ($changes) { + $params = array_merge($_GET, $changes); + unset($params['page']); + return '?' . http_build_query(array_filter($params, function ($v) { return $v !== '' && $v !== null; })); +}; +$date_url = function ($from, $to, $changes = []) use ($filter_url) { + return $filter_url(array_merge(['canned_date' => 'custom', 'dtf' => $from, 'dtt' => $to], $changes)); +}; +$stat_money = function ($amount) use ($session_company_currency) { + return escapeHtml(billingMoney($amount, $session_company_currency)); +}; + +// More filters open when one of them is set +$more_filters = $account_filter || $method_filter !== ''; +$any_filter = $q || $vendor_filter || $category_filter || $account_filter || $client_filter || $method_filter !== '' || $show !== '' || $dtf !== '1970-01-01'; + +// This month against the same days of last month +$month_change = $stats['last_to_date'] > 0 ? round(($stats['month'] - $stats['last_to_date']) / $stats['last_to_date'] * 100) : null; + ?> -
-
-

Expenses

-
-
- - -
- - Export - -
+ +
+
+ +
This month
+
+
+ + % + on the same days of + + in + +
+ +
+
+ +
so far
+
+
expense · a month
+ +
+
+ +
Recurring
+
+
a month from running · a year
+ +
+
+ +
No receipt, 90 days
+
+
+ +
+
+ +
+
+

Expenses

+
+
+ + + + +
+ + Export + + Recurring Expenses + Expenses Report
- -
-
-
-
-
- - - -
-
-
-
- -
-
-
-
" id="advancedFilter"> -
-
-
- - - - - -
-
-
-
- - -
-
-
-
- - -
-
-
-
- - -
-
-
-
-
-
- -
- - "> - - - - - - - - - - - - - "; - } - - ?> - - - - - - - - - - - - - - - -
-
- -
- 		- - Date - - - - Category - - / - - Description - - - - Vendor - - - - Amount - - - - Account - - - - Client - - Action
-
- -
- 		- - - - - - -
- 		true]) : '-' ?> -
- -
- - " download=""> - Download - -
- - - Edit - - - Copy - -
- - Refund - -
- - Delete - -
-
-
-
-
- +
+
+ +
+
+
+ + + +
+
+
+ + + + +
+
+ +
+
+ +
+
+
+
+ +
+ + + +
+
+
+
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+
+ + +
- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+ +
+ 		Date Vendor Category Client Paid from Amount
+
+ +
+ 		+ > + + + + + true, 'archived' => !empty($row['vendor_archived_at'])]) ?> +
+ +
+
+ +
+ + - + + 		+ +
+ 		+ +
Refund
+ 		+
+ +
+ >Open + + Download Receipt + + +
+ Edit + Copy + 0) { ?> + Refund + + + +
+ + Delete + + +
+
+
+ expense count($expenses) ? ' - the total is for all of them, not just this page' : '' ?> +
+
+ +
+ +
+
+ + +
+ + + + + + + + 'That expense no longer exists.']); + exit; +} + +$expense_id = intval($row['expense_id']); +$client_id = intval($row['expense_client_id']); +$can_edit = lookupUserPermission('module_financial') >= 2; +$can_delete = lookupUserPermission('module_financial') >= 3; +$is_transfer = !empty($row['transfer_id']); +$amount = floatval($row['expense_amount']); +$currency = (string) $row['expense_currency_code']; +$receipt_kind = $row['expense_receipt'] && expenseReceiptPath($row['expense_receipt']) !== '' ? expenseReceiptKind($row['expense_receipt']) : ''; +$receipt_missing = $row['expense_receipt'] && $receipt_kind === '' && expenseReceiptPath($row['expense_receipt']) === ''; +$receipt_url = "expense_receipt.php?expense_id=$expense_id"; + +// Refunds against it, and the stock it paid for +$refunds = []; +$sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_description FROM expenses WHERE expense_refund_of_id = $expense_id ORDER BY expense_date ASC, expense_id ASC"); +while ($refund = mysqli_fetch_assoc($sql)) { + $refunds[] = $refund; +} +$stock = []; +$sql = mysqli_query($mysqli, "SELECT stock_qty, stock_unit_cost, stock_created_at, product_id, product_name FROM product_stock + JOIN products ON product_id = stock_product_id + WHERE stock_expense_id = $expense_id ORDER BY stock_id ASC"); +while ($move = mysqli_fetch_assoc($sql)) { + $stock[] = $move; +} + +ob_start(); + +?> + +
+
+ +
+
+ + Refund +
+
+
+
+
+
+
+ +
+ +
+ + +
This is the out side of a transfer between accounts - it is changed or deleted from Transfers.
+ + + + +
+ + Receipt + + + +
+ +
+ +
+ +
+ + +
+ + + +
+
+ +
+ + + +
+
+ +
+ + +
+ +
+ + +
+
+ + · ' . escapeHtml($row['expense_payment_method']) . '' : '' ?> +
+ +
+ + +
+ +
+
+
+ + + + + Not for a client + +
+
+ + by +
+ +
+ + Money back on +
+ + +
+ + + back + · + $refund) { ?> + + +
+ +
+
+ + +
+
Description
+
+
+ + + +
+
Stock it paid for
+ +
+ + +
+ +
+ + +
+ +
+ + Receipt + + + +
+ + 0) { ?> + + +
+ + + Delete + + +
+ +
-
New Expense
+
New Expense
- -
-
- -
- - " required> -
-
- -
- -
- - -
-
-
- -
-
- -
- - -
-
- -
- -
- - - -
-
-
- -
- - -
- -
- -
- - -
-
- -
- -
- -
- - - -
-
- - - - - -
- -
- - -
-
- - - -
- -
- - -
- +
- - + +
diff --git a/agent/modals/expense/expense_bulk_delete.php b/agent/modals/expense/expense_bulk_delete.php index dab29f6c0..d60779698 100644 --- a/agent/modals/expense/expense_bulk_delete.php +++ b/agent/modals/expense/expense_bulk_delete.php @@ -1,41 +1,46 @@ 'Tick the expenses to delete first.']); + exit; +} -// Generate the HTML form content using output buffering. ob_start(); ?> +
+
Delete Expense
+ +
- -
- -
- -

Are you really, really, really sure?

-
This will permanently delete the selected expense. and ALL associated data?

This process cannot be undone.
- - + + + +
+
+ +
+
for good, with .
+
They come out of the account balances and the reports. Stock deliveries that named them stay, unlinked. This can't be undone.
+
- - - -

- - This will permanently delete the selected expense. -

-

- This action cannot be undone. -

- - - +
+
+ +
diff --git a/agent/modals/expense/expense_bulk_edit.php b/agent/modals/expense/expense_bulk_edit.php new file mode 100644 index 000000000..60d37aec5 --- /dev/null +++ b/agent/modals/expense/expense_bulk_edit.php @@ -0,0 +1,89 @@ + ['label' => 'Category', 'icon' => 'fa-list'], + 'account' => ['label' => 'Account', 'icon' => 'fa-piggy-bank'], + 'client' => ['label' => 'Client', 'icon' => 'fa-user'], + 'method' => ['label' => 'Payment Method', 'icon' => 'fa-credit-card'], +]; +if (!isset($fields[$field])) { + echo json_encode(['error' => 'Pick what to set from the Bulk Action menu.']); + exit; +} +if (!$count) { + echo json_encode(['error' => 'Tick the expenses to change first.']); + exit; +} + +ob_start(); + +?> +
+
Set expense
+ +
+ +
+ + + + + +
+ +
+ + + + + + + + + + +
+
+
+ + +
+
+ + -
-
Set Account for Expense
- -
- -
- - -
- -
- -
- - -
-
- -
-
- - -
-
- - -
-
Set Category: Expense
- -
- -
-
- - - - - -
- -
- - -
-
- -
-
- - -
-
- - - -
-
Set Client: Expense
- -
- -
- - - - -
- - -
- -
- - -
-
- -
-
- - -
-
- - 'That expense no longer exists.']); + exit; } +$form_mode = 'copy'; ob_start(); ?> -
-
Copying expense
+
Copy Expense
-
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
- -
- -
- - -
-
- -
- -
- -
- - -
-
- - - - - -
- -
- - -
-
- - - -
- -
- - -
- +
-
- - + +
diff --git a/agent/modals/expense/expense_edit.php b/agent/modals/expense/expense_edit.php index ca164c39b..bd4818673 100644 --- a/agent/modals/expense/expense_edit.php +++ b/agent/modals/expense/expense_edit.php @@ -1,223 +1,37 @@ 'That expense no longer exists.']); + exit; } +if ($form_row['transfer_id']) { + echo json_encode(['error' => 'That is the out side of a transfer between accounts - change it from Transfers.']); + exit; +} +$form_mode = 'edit'; -// Generate the HTML form content using output buffering. ob_start(); -?> +?>
-
Editing expense
+
Edit Expense
-
+ +
- - - -
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
-
- -
- - -
-
- -
- -
- - - -
-
- -
- -
- - -
- -
- -
- - -
-
- -
- -
- -
- - - -
-
- - - - - -
- -
- - -
-
- - - -
- -
- - -
- - -
- " - download=""> - - - - +
diff --git a/agent/modals/expense/expense_export.php b/agent/modals/expense/expense_export.php index 38251ef9d..af83f38a5 100644 --- a/agent/modals/expense/expense_export.php +++ b/agent/modals/expense/expense_export.php @@ -6,22 +6,14 @@ enforceUserPermission('module_financial'); // Pre-filled from the expenses page's current filters. Everything here is editable - // the export runs whatever this form posts, not whatever the page happened to show. -$client_id = intval($_GET['client_id'] ?? 0); -if ($client_id) { - enforceClientAccess(); -} - -// Search Filter $q_filter = $_GET['q'] ?? ''; - -// Account Filter $account_filter = intval($_GET['account'] ?? 0); - -// Vendor Filter $vendor_filter = intval($_GET['vendor'] ?? 0); - -// Category Filter $category_filter = intval($_GET['category'] ?? 0); +$client_filter = intval($_GET['client'] ?? 0); +$method_filter = (string) ($_GET['method'] ?? ''); +$shows = expenseShows(); +$show_filter = isset($shows[$_GET['show'] ?? '']) ? (string) ($_GET['show'] ?? '') : ''; // Date Filter - the all-time sentinels from filter_header.php leave the fields blank $date_from_filter = (!empty($_GET['dtf']) && $_GET['dtf'] !== '1970-01-01') ? escapeHtml($_GET['dtf']) : ''; @@ -46,86 +38,112 @@ ob_start();
- +
- - + +
-
- -
- - -
-
- -
- -
+
+
+ +
- + +
-
- -
- -
+
+ +
- + +
-
- -
- -
- - +
+ +
+ + +
-
- -
- -
+
+ +
+ + +
+
+
+ +
+ + +
+
+
+ +
+ + +
+
+
+ +
- + +
+
+
+ +
+ + +
diff --git a/agent/modals/expense/expense_form.php b/agent/modals/expense/expense_form.php new file mode 100644 index 000000000..9c0145533 --- /dev/null +++ b/agent/modals/expense/expense_form.php @@ -0,0 +1,279 @@ + +
+ + + +
+
+ +
+
+
+
+
+
+ 0) { ?> +
back already
+ +
+
+
+ + +
+ +
+ + + + + + + +
+ +
+ +
+ +
+ + > + +
+ +
Saved as money back - a negative expense.
+ +
Negative - money back from the vendor.
+ +
+ +
+ +
+ + + + + +
+
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
A direct cost of theirs - it counts against them in Client Profitability.
+
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+ + +
+ + +
+ + +
+
+ +
+ + +
+
A photo or a PDF - on a phone, take the picture right here.
+
+ +
+ + + + diff --git a/agent/modals/expense/expense_refund.php b/agent/modals/expense/expense_refund.php index a0f557a22..7b9a978f5 100644 --- a/agent/modals/expense/expense_refund.php +++ b/agent/modals/expense/expense_refund.php @@ -1,93 +1,43 @@ 'That expense no longer exists.']); + exit; } +if (floatval($form_row['expense_amount']) <= 0) { + echo json_encode(['error' => 'That is a refund already - there is nothing to give back.']); + exit; +} +$form_mode = 'refund'; ob_start(); ?> -
-
Refunding expense
+
Record a Refund
- - + - - - -
- -
- -
- -
- - -
-
- -
- -
- - -
-
-
- -
- - -
- -
- -
- - -
-
- -
- - -
- +
- +
0; + + logAudit("Expense", $refund ? "Refund" : "Create", "$session_name " . ($refund ? 'recorded a refund from ' : 'added the expense ') . escapeSql($label), intval($row['expense_client_id']), $expense_id); + + if ($receipt_error) { + flashAlert(($refund ? 'Refund' : 'Expense') . " " . escapeHtml($label) . " added, but " . lcfirst(escapeHtml($receipt_error)), 'warning'); + } else { + flashAlert(($refund ? 'Refund' : 'Expense') . " " . escapeHtml($label) . " added" . ($row['expense_receipt'] ? ' with its receipt' : '')); + } redirect(); @@ -55,48 +48,58 @@ if (isset($_POST['edit_expense'])) { enforceUserPermission('module_financial', 2); - require_once 'expense_model.php'; + $expense_id = intval($_POST['expense_id'] ?? 0); - $expense_id = intval($_POST['expense_id']); - - // Check the client the expense belongs to now, not just the one submitted - $existing_client_id = intval(getFieldById('expenses', $expense_id, 'expense_client_id')); - if ($existing_client_id) { - enforceClientAccess($existing_client_id); + if (!expenseSave($_POST, $expense_id, $error)) { + flashAlert($error, 'error'); + redirect(); } - if ($client_id) { - enforceClientAccess(); + $receipt_error = ''; + if (!empty($_POST['receipt_remove'])) { + expenseReceiptRemove($expense_id); + } else { + expenseReceiptStore($expense_id, $_FILES['file'] ?? null, $receipt_error); } - // Get old receipt - $existing_file_name = escapeSql(getFieldById('expenses', $expense_id, 'expense_receipt')); + $row = expenseRow($expense_id, false); + $label = expenseLabel($row); - // Check for and process attachment - $extended_alert_description = ''; - if (isset($_FILES['file']['tmp_name'])) { - if ($new_file_name = checkFileUpload($_FILES['file'], array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf'))) { + logAudit("Expense", "Edit", "$session_name edited the expense " . escapeSql($label), intval($row['expense_client_id']), $expense_id); - $file_tmp_path = $_FILES['file']['tmp_name']; - - // directory in which the uploaded file will be moved - $upload_file_dir = "../uploads/expenses/"; - $dest_path = $upload_file_dir . $new_file_name; - move_uploaded_file($file_tmp_path, $dest_path); - - //Delete old file - unlink("../uploads/expenses/$existing_file_name"); - - mysqli_query($mysqli,"UPDATE expenses SET expense_receipt = '$new_file_name' WHERE expense_id = $expense_id"); - $extended_alert_description = '. File successfully uploaded.'; - } + if ($receipt_error) { + flashAlert("Expense " . escapeHtml($label) . " saved, but " . lcfirst(escapeHtml($receipt_error)), 'warning'); + } else { + flashAlert("Expense " . escapeHtml($label) . " saved"); } - mysqli_query($mysqli,"UPDATE expenses SET expense_date = '$date', expense_amount = $amount, expense_account_id = $account, expense_vendor_id = $vendor, expense_client_id = $client_id, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference' WHERE expense_id = $expense_id"); + redirect(); - logAudit("Expense", "Edit", "$session_name edited expense $description", $client_id, $expense_id); +} - flashAlert("Expense modified" . $extended_alert_description); +// A receipt added from the expense's quick look +if (isset($_POST['expense_receipt_save'])) { + + validateCSRFToken(); + + enforceUserPermission('module_financial', 2); + + $row = expenseRow(intval($_POST['expense_id'] ?? 0)); + if (!$row || $row['transfer_id']) { + flashAlert('That expense no longer exists', 'error'); + redirect(); + } + $expense_id = intval($row['expense_id']); + + $receipt_error = ''; + if (!expenseReceiptStore($expense_id, $_FILES['file'] ?? null, $receipt_error)) { + flashAlert($receipt_error ?: 'Choose the receipt to attach', 'error'); + redirect(); + } + + logAudit("Expense", "Receipt", "$session_name attached a receipt to the expense " . escapeSql(expenseLabel($row)), intval($row['expense_client_id']), $expense_id); + + flashAlert("Receipt attached to " . escapeHtml(expenseLabel($row)) . ""); redirect(); @@ -108,153 +111,86 @@ if (isset($_GET['delete_expense'])) { enforceUserPermission('module_financial', 3); - $expense_id = intval($_GET['delete_expense']); - - $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id"); - $row = mysqli_fetch_assoc($sql); - $expense_receipt = escapeSql($row['expense_receipt']); - $expense_description = escapeSql($row['expense_description']); - $client_id = intval($row['expense_client_id']); - - if ($client_id) { - enforceClientAccess(); + $row = expenseDelete(intval($_GET['delete_expense']), $error); + if (!$row) { + flashAlert($error, 'error'); + redirect(); } - unlink("../uploads/expenses/$expense_receipt"); + logAudit("Expense", "Delete", "$session_name deleted the expense " . escapeSql(expenseLabel($row)), intval($row['expense_client_id'])); - mysqli_query($mysqli,"DELETE FROM expenses WHERE expense_id = $expense_id"); - - logAudit("Expense", "Delete", "$session_name deleted expense $expense_description", $client_id); - - flashAlert("Expense deleted", 'error'); + flashAlert("Expense " . escapeHtml(expenseLabel($row)) . " deleted", 'error'); redirect(); } -if (isset($_POST['bulk_edit_expense_category'])) { +/* + * Set one thing on the ticked expenses: field = category, account, client + * (0 takes the client off) or method ('' clears it), to value. + */ +if (isset($_POST['bulk_edit_expenses'])) { validateCSRFToken(); enforceUserPermission('module_financial', 2); - $category_id = intval($_POST['bulk_category_id']); + $field = (string) ($_POST['field'] ?? ''); + $value = trim((string) ($_POST['value'] ?? '')); + $expense_ids = array_unique(array_filter(array_map('intval', (array) ($_POST['expense_ids'] ?? [])))); - // Get Category name for logging and Notification - $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); - - // Assign category to Selected Expenses - if (isset($_POST['expense_ids'])) { - - // Get Selected Count - $count = count($_POST['expense_ids']); - - foreach($_POST['expense_ids'] as $expense_id) { - $expense_id = intval($expense_id); - - // Get Expense Details for Logging - $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); - $row = mysqli_fetch_assoc($sql); - $expense_description = escapeSql($row['expense_description']); - $client_id = intval($row['expense_client_id']); - - if ($client_id) { - enforceClientAccess(); - } - - mysqli_query($mysqli,"UPDATE expenses SET expense_category_id = $category_id WHERE expense_id = $expense_id"); - - logAudit("Expense", "Edit", "$session_name assigned expense $expense_description to category $category_name", $client_id, $expense_id); - - } // End Assign Loop - - logAudit("Expense", "Bulk Edit", "$session_name assigned $count expenses to category $category_name"); - - flashAlert("You assigned expense category $category_name to $count expense(s)"); + // What the value is, and that it can be picked + $set = ''; + $label = ''; + if ($field === 'category') { + $categories = expenseCategories(); + if (isset($categories[intval($value)])) { + $set = "expense_category_id = " . intval($value); + $label = "the category to " . $categories[intval($value)]['category_name']; + } + } elseif ($field === 'account') { + $accounts = paymentAccounts(); + if (isset($accounts[intval($value)])) { + $set = "expense_account_id = " . intval($value); + $label = "the account to " . $accounts[intval($value)]['account_name']; + } + } elseif ($field === 'client') { + $client_name = intval($value) ? getFieldById('clients', intval($value), 'client_name') : ''; + if (!intval($value)) { + $set = "expense_client_id = 0"; + $label = "no client"; + } elseif ($client_name !== null && mysqli_num_rows(mysqli_query($mysqli, "SELECT client_id FROM clients WHERE client_id = " . intval($value) . " " . clientScopeSql('client_id')))) { + $set = "expense_client_id = " . intval($value); + $label = "the client to $client_name"; + } + } elseif ($field === 'method') { + if ($value === '') { + $set = "expense_payment_method = NULL"; + $label = "no payment method"; + } elseif (in_array($value, paymentMethods(), true)) { + $set = "expense_payment_method = '" . escapeSql($value) . "'"; + $label = "the payment method to $value"; + } + } + if ($set === '' || !$expense_ids) { + flashAlert($expense_ids ? 'Pick what to set them to' : 'Tick the expenses to change first', 'error'); + redirect(); } - redirect(); - -} - -if (isset($_POST['bulk_edit_expense_account'])) { - - validateCSRFToken(); - - enforceUserPermission('module_financial', 2); - - $account_id = intval($_POST['bulk_account_id']); - - // Get Account name for logging and Notification - $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name')); - - // Assign account to Selected Expenses - if (isset($_POST['expense_ids'])) { - - // Get Selected Contacts Count - $count = count($_POST['expense_ids']); - - foreach($_POST['expense_ids'] as $expense_id) { - $expense_id = intval($expense_id); - - // Get Expense Details for Logging - $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); - $row = mysqli_fetch_assoc($sql); - $expense_description = escapeSql($row['expense_description']); - $client_id = intval($row['expense_client_id']); - - if ($client_id) { - enforceClientAccess(); - } - - mysqli_query($mysqli,"UPDATE expenses SET expense_account_id = $account_id WHERE expense_id = $expense_id"); - - logAudit("Expense", "Edit", "$session_name assigned expense $expense_description to account $account_name", $client_id, $expense_id); - - } // End Assign Loop - - logAudit("Expense", "Bulk Edit", "$session_name assigned $count expense(s) to account $account_name"); - - flashAlert("You assigned account $account_name to $count expense(s)"); + $count = 0; + foreach ($expense_ids as $expense_id) { + $row = expenseRow($expense_id); + if (!$row || $row['transfer_id'] || !intval($row['expense_vendor_id'])) { + continue; + } + mysqli_query($mysqli, "UPDATE expenses SET $set WHERE expense_id = $expense_id"); + logAudit("Expense", "Edit", "$session_name set " . escapeSql($label) . " on the expense " . escapeSql(expenseLabel($row)), intval($row['expense_client_id']), $expense_id); + $count++; } - redirect(); + logAudit("Expense", "Bulk Edit", "$session_name set " . escapeSql($label) . " on $count expense" . ($count === 1 ? '' : 's')); -} - -if (isset($_POST['bulk_edit_expense_client'])) { - - validateCSRFToken(); - - enforceUserPermission('module_financial', 2); - - $client_id = intval($_POST['bulk_client_id']); - - enforceClientAccess(); - - // Get Client name for logging and Notification - $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name')); - - // Assign Client to Selected Expenses - if (isset($_POST['expense_ids'])) { - - // Get Selected Count - $count = count($_POST['expense_ids']); - - foreach($_POST['expense_ids'] as $expense_id) { - $expense_id = intval($expense_id); - - // Get Expense Details for Logging - $expense_description = escapeSql(getFieldById('expenses', $expense_id, 'expense_description')); - - mysqli_query($mysqli,"UPDATE expenses SET expense_client_id = $client_id WHERE expense_id = $expense_id"); - - logAudit("Expense", "Edit", "$session_name assigned expense $expense_description to client $client_name", $client_id, $expense_id); - - } // End Assign Loop - - flashAlert("You assigned client $client_name to $count expense(s)"); - } + flashAlert("Set " . escapeHtml($label) . " on $count expense" . ($count === 1 ? '' : 's')); redirect(); @@ -266,40 +202,20 @@ if (isset($_POST['bulk_delete_expenses'])) { enforceUserPermission('module_financial', 3); - if (isset($_POST['expense_ids'])) { - - // Get Selected Count - $count = count($_POST['expense_ids']); - - // Cycle through array and delete each expense - foreach ($_POST['expense_ids'] as $expense_id) { - - $expense_id = intval($expense_id); - - $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id"); - $row = mysqli_fetch_assoc($sql); - $expense_description = escapeSql($row['expense_description']); - $expense_receipt = escapeSql($row['expense_receipt']); - $client_id = intval($row['expense_client_id']); - - if ($client_id) { - enforceClientAccess(); - } - - unlink("../uploads/expenses/$expense_receipt"); - - mysqli_query($mysqli, "DELETE FROM expenses WHERE expense_id = $expense_id"); - - logAudit("Expense", "Delete", "$session_name deleted expense $expense_description", $client_id); - + $count = 0; + foreach (array_unique(array_filter(array_map('intval', (array) ($_POST['expense_ids'] ?? [])))) as $expense_id) { + $row = expenseDelete($expense_id); + if (!$row) { + continue; } - - logAudit("Expense", "Bulk Delete", "$session_name deleted $count expense(s)"); - - flashAlert("Deleted $count expense(s)", 'error'); - + logAudit("Expense", "Delete", "$session_name deleted the expense " . escapeSql(expenseLabel($row)), intval($row['expense_client_id'])); + $count++; } + logAudit("Expense", "Bulk Delete", "$session_name deleted $count expense" . ($count === 1 ? '' : 's')); + + flashAlert("Deleted $count expense" . ($count === 1 ? '' : 's'), 'error'); + redirect(); } @@ -313,72 +229,13 @@ if (isExportRequest('export_expenses')) { $format = resolveExportFormat($_POST['export_expenses']); - // Filters inherited from the expenses page - mirrors agent/expenses.php - $filter_summary = []; + // The same filters as the expenses list (functions/expenses.php) + $where = expenseFiltersSql($_POST, $filter_summary); - $client_id = 0; // for Logging - $file_name_prepend = "$session_company_name-"; - - // Account Filter - if (!empty($_POST['account'])) { - $filter_account_id = intval($_POST['account']); - $account_query = "AND (expense_account_id = $filter_account_id)"; - $filter_summary['Account'] = getFieldById('accounts', $filter_account_id, 'account_name'); - } else { - // Default - any - $account_query = ''; - } - - // Vendor Filter - if (!empty($_POST['vendor'])) { - $filter_vendor_id = intval($_POST['vendor']); - $vendor_query = "AND (vendor_id = $filter_vendor_id)"; - $filter_summary['Vendor'] = getFieldById('vendors', $filter_vendor_id, 'vendor_name'); - } else { - // Default - any - $vendor_query = ''; - } - - // Category Filter - if (!empty($_POST['category'])) { - $filter_category_id = intval($_POST['category']); - $category_query = "AND (category_id = $filter_category_id)"; - $filter_summary['Category'] = getFieldById('categories', $filter_category_id, 'category_name'); - } else { - // Default - any - $category_query = ''; - } - - // Date Filter - $dtf = escapeSql(!empty($_POST['dtf']) ? $_POST['dtf'] : '1970-01-01'); - $dtt = escapeSql(!empty($_POST['dtt']) ? $_POST['dtt'] : '2099-12-31'); - $date_range = formatExportDateRange($dtf, $dtt); - if ($date_range) { - $filter_summary['Dated'] = $date_range; - } - - // Search Filter - $q = escapeSql($_POST['q'] ?? ''); - if (!empty($q)) { - $filter_summary['Search'] = $_POST['q']; - } - - $sql = mysqli_query( - $mysqli, - "SELECT * FROM expenses - LEFT JOIN categories ON expense_category_id = category_id - LEFT JOIN vendors ON expense_vendor_id = vendor_id - LEFT JOIN accounts ON expense_account_id = account_id - LEFT JOIN clients ON expense_client_id = client_id - WHERE expense_vendor_id > 0 - AND DATE(expense_date) BETWEEN '$dtf' AND '$dtt' - $vendor_query - $category_query - AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%') - $account_query - " . clientScopeSql('expense_client_id') . " - ORDER BY expense_date ASC" - ); + $sql = mysqli_query($mysqli, "SELECT expenses.*, vendor_name, category_name, account_name, client_name, user_name + FROM expenses " . expenseJoinsSql() . " + WHERE $where + ORDER BY expense_date ASC, expense_id ASC"); $num_rows = mysqli_num_rows($sql); @@ -386,16 +243,17 @@ if (isExportRequest('export_expenses')) { guardExportPdfRowCount($format, $num_rows); - $export = beginExport('expenses', $format, $file_name_prepend . 'Expenses', 'Expenses', summarizeExportFilters($filter_summary)); + $export = beginExport('expenses', $format, "$session_company_name-Expenses", 'Expenses', summarizeExportFilters($filter_summary)); while ($row = mysqli_fetch_assoc($sql)) { + $row['expense_receipt_display'] = $row['expense_receipt'] ? 'Yes' : 'No'; addExportRow($export, $row); } finishExport($export); } - logAudit("Expense", "Export", "$session_name exported $num_rows expense(s) to a " . strtoupper($format) . " file", $client_id); + logAudit("Expense", "Export", "$session_name exported $num_rows expense(s) to a " . strtoupper($format) . " file"); exit; diff --git a/agent/post/expense_model.php b/agent/post/expense_model.php deleted file mode 100644 index 753d8b94e..000000000 --- a/agent/post/expense_model.php +++ /dev/null @@ -1,11 +0,0 @@ -"> -
+
= 1) { ?>
diff --git a/agent/reports/client_profitability.php b/agent/reports/client_profitability.php index 12b00dbd0..a9965f860 100644 --- a/agent/reports/client_profitability.php +++ b/agent/reports/client_profitability.php @@ -118,8 +118,8 @@ $columns = [ return reportClientCell($row['client_id'], $row['client'], $row['abbr']); }], 'income' => ['label' => 'Income', 'type' => 'money'], - 'costs' => ['label' => 'Direct costs', 'type' => 'money', 'title' => 'Expenses filed against the client', 'html' => function ($row) { - return $row['costs'] > 0 ? reportMoney($row['costs']) : '–'; + 'costs' => ['label' => 'Direct costs', 'type' => 'money', 'title' => 'Expenses filed against the client', 'html' => function ($row) use ($period) { + return $row['costs'] > 0 ? '' . reportMoney($row['costs']) . '' : '–'; }], 'net' => ['label' => 'Net', 'type' => 'money', 'class' => 'fw-semibold'], ]; diff --git a/agent/transactions.php b/agent/transactions.php index 102be0ac9..07f7d646c 100644 --- a/agent/transactions.php +++ b/agent/transactions.php @@ -496,7 +496,7 @@ if ($account_filter) { if ($transaction_type == 'Transfer In' || $transaction_type == 'Transfer Out') { $transaction_modal_url = "modals/transfer/transfer_edit.php?id=$transaction_transfer_id"; } elseif ($transaction_type == 'Expense') { - $transaction_modal_url = "modals/expense/expense_edit.php?id=$transaction_id"; + $transaction_modal_url = "modals/expense/expense.php?id=$transaction_id"; } elseif ($transaction_type == 'Revenue') { $transaction_modal_url = "modals/revenue/revenue_edit.php?id=$transaction_id"; } else { diff --git a/agent/vendor.php b/agent/vendor.php index 41211eaaf..f39bf4d78 100644 --- a/agent/vendor.php +++ b/agent/vendor.php @@ -129,7 +129,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie $spend = null; if ($is_ours && $can_financial) { $spend = vendorSpend($vendor_id); - $sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_currency_code, expense_description, expense_reference, category_name, account_name + $sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_currency_code, expense_description, expense_reference, expense_receipt, category_name, account_name FROM expenses LEFT JOIN categories ON category_id = expense_category_id LEFT JOIN accounts ON account_id = expense_account_id @@ -270,7 +270,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie
- + Expense @@ -682,7 +682,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie
All - +
@@ -693,7 +693,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie - +
-' ?>
diff --git a/css/itflow_custom.css b/css/itflow_custom.css index d816af4f8..614321c13 100644 --- a/css/itflow_custom.css +++ b/css/itflow_custom.css @@ -6307,3 +6307,23 @@ a.itflow-billing-stat:hover { display: none; } } + +/* ---------- Expenses (agent/expenses.php, modals/expense/) ---------- */ +.itflow-category-dot { + display: inline-block; + width: .6rem; + height: .6rem; + margin-right: .45rem; + border-radius: 50%; + background-color: var(--bs-secondary-bg); + box-shadow: inset 0 0 0 1px rgba(0, 0, 0, .12); + vertical-align: .05rem; +} +.itflow-expense-receipt-empty { + padding: 1.25rem 1rem; + border: 1px dashed var(--bs-border-color); + border-radius: var(--bs-border-radius-lg); + background-color: var(--bs-tertiary-bg); + color: var(--bs-secondary-color); + text-align: center; +} diff --git a/db.sql b/db.sql index 1544057dc..23cf1c23f 100644 --- a/db.sql +++ b/db.sql @@ -1349,10 +1349,12 @@ CREATE TABLE `expenses` ( `expense_created_at` datetime NOT NULL DEFAULT current_timestamp(), `expense_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(), `expense_archived_at` datetime DEFAULT NULL, + `expense_created_by` int(11) NOT NULL DEFAULT 0, `expense_vendor_id` int(11) NOT NULL DEFAULT 0, `expense_client_id` int(11) NOT NULL DEFAULT 0, `expense_category_id` int(11) NOT NULL DEFAULT 0, `expense_account_id` int(11) DEFAULT NULL, + `expense_refund_of_id` int(11) DEFAULT NULL, PRIMARY KEY (`expense_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; diff --git a/functions.php b/functions.php index b887053b4..0a15026a9 100644 --- a/functions.php +++ b/functions.php @@ -53,3 +53,4 @@ require_once __DIR__ . '/functions/share.php'; require_once __DIR__ . '/functions/billing.php'; require_once __DIR__ . '/functions/products.php'; require_once __DIR__ . '/functions/billing_email.php'; +require_once __DIR__ . '/functions/expenses.php'; diff --git a/functions/expenses.php b/functions/expenses.php new file mode 100644 index 000000000..f5e74df4a --- /dev/null +++ b/functions/expenses.php @@ -0,0 +1,437 @@ + ['label' => 'All', 'where' => ''], + 'client' => ['label' => 'For a client', 'icon' => 'fa-user', 'where' => 'expense_client_id > 0', 'title' => 'Filed against a client - their direct costs'], + 'no_receipt' => ['label' => 'No receipt', 'icon' => 'fa-paperclip', 'where' => "COALESCE(expense_receipt, '') = '' AND expense_amount > 0", 'title' => 'No receipt attached yet'], + 'refunds' => ['label' => 'Refunds', 'icon' => 'fa-undo-alt', 'where' => 'expense_amount < 0', 'title' => 'Money that came back - refunds and credits'], + ]; +} + +/** + * The WHERE for a set of filters, as the list and the export take them + * from the query string or the form: q, vendor, category, account, client, + * method, show, dtf and dtt. Starts with the vendor-expenses-only rule and + * the agent's client scope. $summary is filled with what each filter is, + * by name, for the export's heading. + */ +function expenseFiltersSql(array $src, &$summary = []) { + global $mysqli; + $summary = []; + $sql = "expense_vendor_id > 0 " . clientScopeSql('expense_client_id'); + + $q = trim((string) ($src['q'] ?? '')); + if ($q !== '') { + $like = escapeSql($q); + $sql .= " AND (vendor_name LIKE '%$like%' OR client_name LIKE '%$like%' OR category_name LIKE '%$like%' OR account_name LIKE '%$like%' + OR expense_description LIKE '%$like%' OR expense_reference LIKE '%$like%' OR expense_payment_method LIKE '%$like%' OR expense_amount LIKE '%$like%')"; + $summary['Search'] = $q; + } + foreach (['vendor' => ['expense_vendor_id', 'vendors', 'vendor_name', 'Vendor'], 'category' => ['expense_category_id', 'categories', 'category_name', 'Category'], + 'account' => ['expense_account_id', 'accounts', 'account_name', 'Account'], 'client' => ['expense_client_id', 'clients', 'client_name', 'Client']] as $key => $f) { + $id = intval($src[$key] ?? 0); + if ($id) { + $sql .= " AND {$f[0]} = $id"; + $summary[$f[3]] = (string) getFieldById($f[1], $id, $f[2]); + } + } + $method = trim((string) ($src['method'] ?? '')); + if ($method !== '') { + $sql .= " AND expense_payment_method = '" . escapeSql($method) . "'"; + $summary['Paid by'] = $method; + } + $shows = expenseShows(); + $show = (string) ($src['show'] ?? ''); + if (isset($shows[$show]) && $shows[$show]['where']) { + $sql .= " AND {$shows[$show]['where']}"; + $summary['Showing'] = $shows[$show]['label']; + } + $dtf = (string) ($src['dtf'] ?? ''); + $dtt = (string) ($src['dtt'] ?? ''); + $dtf = preg_match('/^\d{4}-\d{2}-\d{2}$/', $dtf) ? $dtf : '1970-01-01'; + $dtt = preg_match('/^\d{4}-\d{2}-\d{2}$/', $dtt) ? $dtt : '2099-12-31'; + if ($dtf !== '1970-01-01' || $dtt !== '2099-12-31') { + $sql .= " AND expense_date BETWEEN '$dtf' AND '$dtt'"; + $range = formatExportDateRange($dtf, $dtt); + if ($range) { + $summary['Dated'] = $range; + } + } + return $sql; +} + +/** + * What a recurring expense costs a month, as SQL - yearly ones count as a + * twelfth. Use it in sums over recurring_expenses. + */ +function expenseRecurringMonthlySql() { + return "CASE recurring_expense_frequency WHEN 2 THEN recurring_expense_amount / 12 ELSE recurring_expense_amount END"; +} + +/** + * The money along the top of the list, in the agent's client scope: spent + * this month and last, the year to date, what the running recurring + * expenses come to a month, and the last 90 days' expenses with no receipt. + */ +function expenseStats() { + global $mysqli; + $scope = clientScopeSql('expense_client_id'); + $month_start = date('Y-m-01'); + $last_start = date('Y-m-01', strtotime("$month_start -1 month")); + $last_same_day = date('Y-m-d', min(strtotime(date('Y-m-t', strtotime($last_start))), strtotime($last_start . ' +' . (intval(date('j')) - 1) . ' days'))); + $year_start = date('Y-01-01'); + $since_90 = date('Y-m-d', strtotime('-90 days')); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT + COALESCE(SUM(CASE WHEN expense_date >= '$month_start' AND expense_date <= CURDATE() THEN expense_amount END), 0) AS month, + COALESCE(SUM(CASE WHEN expense_date >= '$month_start' AND expense_date <= CURDATE() THEN 1 END), 0) AS month_count, + COALESCE(SUM(CASE WHEN expense_date >= '$last_start' AND expense_date < '$month_start' THEN expense_amount END), 0) AS last_month, + COALESCE(SUM(CASE WHEN expense_date >= '$last_start' AND expense_date <= '$last_same_day' THEN expense_amount END), 0) AS last_to_date, + COALESCE(SUM(CASE WHEN expense_date >= '$year_start' AND expense_date <= CURDATE() THEN expense_amount END), 0) AS year, + COALESCE(SUM(CASE WHEN expense_date >= '$year_start' AND expense_date <= CURDATE() THEN 1 END), 0) AS year_count, + COALESCE(SUM(CASE WHEN expense_date >= '$since_90' AND COALESCE(expense_receipt, '') = '' AND expense_amount > 0 THEN 1 END), 0) AS no_receipt, + COALESCE(SUM(CASE WHEN expense_date >= '$since_90' AND COALESCE(expense_receipt, '') = '' AND expense_amount > 0 THEN expense_amount END), 0) AS no_receipt_amount + FROM expenses WHERE expense_vendor_id > 0 $scope")); + $recurring = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COALESCE(SUM(" . expenseRecurringMonthlySql() . "), 0) AS monthly, COUNT(*) AS running + FROM recurring_expenses WHERE recurring_expense_status = 1 AND recurring_expense_archived_at IS NULL " . clientScopeSql('recurring_expense_client_id'))); + $months_in = max(1, intval(date('n')) - 1 + intval(date('j')) / intval(date('t'))); + return [ + 'month' => floatval($row['month']), 'month_count' => intval($row['month_count']), 'month_start' => $month_start, + 'last_month' => floatval($row['last_month']), 'last_to_date' => floatval($row['last_to_date']), 'last_start' => $last_start, + 'last_end' => date('Y-m-t', strtotime($last_start)), 'year' => floatval($row['year']), 'year_count' => intval($row['year_count']), + 'year_start' => $year_start, 'year_average' => floatval($row['year']) / $months_in, + 'no_receipt' => intval($row['no_receipt']), 'no_receipt_amount' => floatval($row['no_receipt_amount']), 'since_90' => $since_90, + 'recurring_monthly' => floatval($recurring['monthly']), 'recurring_count' => intval($recurring['running']), + ]; +} + +/** A category's colour as a small dot - names like "lightblue" or a hex value; nothing for anything else. */ +function expenseCategoryDot($color) { + $color = trim((string) $color); + if (!preg_match('/^(#[0-9a-f]{3,8}|[a-z]{3,24})$/i', $color)) { + return ''; + } + return ''; +} + +/** + * The last expense with each vendor - its category, account and payment + * method, by vendor id. New Expense fills these in when a vendor is picked. + */ +function expenseVendorDefaults() { + global $mysqli; + $defaults = []; + $sql = mysqli_query($mysqli, "SELECT e.expense_vendor_id, e.expense_category_id, e.expense_account_id, e.expense_payment_method + FROM expenses AS e + JOIN (SELECT expense_vendor_id, MAX(expense_id) AS last_id FROM expenses WHERE expense_vendor_id > 0 AND expense_amount > 0 GROUP BY expense_vendor_id) AS last + ON last.last_id = e.expense_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $defaults[intval($row['expense_vendor_id'])] = [ + 'category' => intval($row['expense_category_id']), + 'account' => intval($row['expense_account_id']), + 'method' => (string) $row['expense_payment_method'], + ]; + } + return $defaults; +} + +/** Our own vendors for a picker - not archived, plus $keep_id. */ +function expenseVendors($keep_id = 0) { + global $mysqli; + $keep_id = intval($keep_id); + $vendors = []; + $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name, vendor_description, vendor_archived_at FROM vendors + WHERE vendor_client_id = 0 AND (vendor_archived_at IS NULL OR vendor_id = $keep_id) + ORDER BY vendor_favorite DESC, vendor_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $vendors[intval($row['vendor_id'])] = $row; + } + return $vendors; +} + +/** Expense categories for a picker - not archived, plus $keep_id. */ +function expenseCategories($keep_id = 0) { + global $mysqli; + $keep_id = intval($keep_id); + $categories = []; + $sql = mysqli_query($mysqli, "SELECT category_id, category_name, category_color, category_icon, category_archived_at FROM categories + WHERE category_type = 'Expense' AND (category_archived_at IS NULL OR category_id = $keep_id) + ORDER BY category_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $categories[intval($row['category_id'])] = $row; + } + return $categories; +} + +/** + * Add an expense, or change one - the one path that writes an expense from + * a form: New, Edit, Copy and Refund. $in: date, amount, vendor, category, + * account, client_id, payment_method, reference, description and, for a + * new refund, refund_of (the expense it gives back - the amount is made + * negative). Checks each against what can be picked; an archived vendor, + * category or account is only kept when it is already the expense's. + * Returns the expense id, or 0 with $error. + */ +function expenseSave(array $in, $expense_id = 0, &$error = '') { + global $mysqli, $session_company_currency, $session_user_id; + $error = ''; + $expense_id = intval($expense_id); + $existing = $expense_id ? expenseRow($expense_id) : null; + if ($expense_id && !$existing) { + $error = 'That expense no longer exists'; + return 0; + } + if ($existing && $existing['transfer_id']) { + $error = 'That is the out side of a transfer between accounts - change it from Transfers'; + return 0; + } + + $date = trim((string) ($in['date'] ?? '')); + if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $date) || !checkdate(intval(substr($date, 5, 2)), intval(substr($date, 8, 2)), intval(substr($date, 0, 4)))) { + $error = 'Enter the date it was paid'; + return 0; + } + $amount_text = str_replace([',', ' ', '$'], '', trim((string) ($in['amount'] ?? ''))); + if (!is_numeric($amount_text) || round(floatval($amount_text), 2) == 0) { + $error = 'Enter the amount'; + return 0; + } + $amount = round(floatval($amount_text), 2); + if (abs($amount) > 9999999999999.99) { + $error = 'That amount is too large'; + return 0; + } + + $refund_of = $existing ? intval($existing['expense_refund_of_id']) : intval($in['refund_of'] ?? 0); + if (!$existing && $refund_of) { + $original = expenseRow($refund_of); + if (!$original || floatval($original['expense_amount']) <= 0 || $original['transfer_id']) { + $error = 'The expense being refunded no longer exists'; + return 0; + } + $amount = -abs($amount); + } + + $vendor = intval($in['vendor'] ?? 0); + $vendors = expenseVendors($existing ? $existing['expense_vendor_id'] : 0); + if (!isset($vendors[$vendor])) { + $error = 'Pick one of your vendors'; + return 0; + } + $category = intval($in['category'] ?? 0); + $categories = expenseCategories($existing ? $existing['expense_category_id'] : 0); + if (!isset($categories[$category])) { + $error = 'Pick an expense category'; + return 0; + } + $account = intval($in['account'] ?? 0); + $accounts = paymentAccounts($existing ? $existing['expense_account_id'] : 0); + if (!isset($accounts[$account])) { + $error = 'Pick the account it was paid from'; + return 0; + } + $client_id = intval($in['client_id'] ?? 0); + if ($client_id && !mysqli_num_rows(mysqli_query($mysqli, "SELECT client_id FROM clients WHERE client_id = $client_id " . clientScopeSql('client_id')))) { + $error = "That client isn't one you can file expenses against"; + return 0; + } + $method = trim((string) ($in['payment_method'] ?? '')); + if ($method !== '' && !in_array($method, paymentMethods(), true) && !($existing && $method === (string) $existing['expense_payment_method'])) { + $error = 'Pick how it was paid'; + return 0; + } + $reference = mb_substr(trim((string) ($in['reference'] ?? '')), 0, 200); + $description = trim((string) ($in['description'] ?? '')); + + $set = "expense_date = '$date', expense_amount = $amount, expense_vendor_id = $vendor, expense_category_id = $category, + expense_account_id = $account, expense_client_id = $client_id, expense_payment_method = " . ($method === '' ? 'NULL' : "'" . escapeSql($method) . "'") . ", + expense_reference = '" . escapeSql($reference) . "', expense_description = '" . escapeSql($description) . "'"; + + if ($existing) { + mysqli_query($mysqli, "UPDATE expenses SET $set WHERE expense_id = $expense_id"); + return $expense_id; + } + $currency = escapeSql((string) ($accounts[$account]['account_currency_code'] ?: $session_company_currency)); + mysqli_query($mysqli, "INSERT INTO expenses SET $set, expense_currency_code = '$currency', expense_created_by = " . intval($session_user_id) + . ($refund_of ? ", expense_refund_of_id = $refund_of" : '')); + return mysqli_insert_id($mysqli); +} + +/** + * Delete an expense - its receipt, the stock deliveries that named it (they + * stay, unlinked) and the link from any refund of it. The out side of a + * transfer is refused. Returns the row it deleted, or null with $error. + */ +function expenseDelete($expense_id, &$error = '') { + global $mysqli; + $error = ''; + $row = expenseRow($expense_id); + if (!$row) { + $error = 'That expense no longer exists'; + return null; + } + if ($row['transfer_id']) { + $error = 'That is the out side of a transfer between accounts - delete the transfer instead'; + return null; + } + $expense_id = intval($row['expense_id']); + expenseReceiptDeleteFile($row['expense_receipt']); + mysqli_query($mysqli, "UPDATE product_stock SET stock_expense_id = NULL WHERE stock_expense_id = $expense_id"); + mysqli_query($mysqli, "UPDATE expenses SET expense_refund_of_id = NULL WHERE expense_refund_of_id = $expense_id"); + mysqli_query($mysqli, "DELETE FROM expenses WHERE expense_id = $expense_id"); + return $row; +} + +/** The receipt's place on disk, if it is there - '' otherwise. */ +function expenseReceiptPath($file_name) { + $file_name = basename((string) $file_name); + if ($file_name === '' || $file_name === 'index.php' || $file_name[0] === '.') { + return ''; + } + $base = realpath(dirname(__DIR__) . '/uploads/expenses'); + $path = realpath(dirname(__DIR__) . "/uploads/expenses/$file_name"); + if ($base === false || $path === false || strpos($path, $base . DIRECTORY_SEPARATOR) !== 0 || !is_file($path)) { + return ''; + } + return $path; +} + +/** What a browser can show of the receipt in a page: 'image', 'pdf' or ''. */ +function expenseReceiptKind($file_name) { + $ext = strtolower(pathinfo((string) $file_name, PATHINFO_EXTENSION)); + if ($ext === 'pdf') { + return 'pdf'; + } + return in_array($ext, ['jpg', 'jpeg', 'gif', 'png', 'webp'], true) ? 'image' : ''; +} + +/** The name a receipt downloads as - "2026-10-14 Pax8 - Software - 1234.pdf". Raw. */ +function expenseReceiptName(array $row) { + $ext = strtolower(pathinfo((string) $row['expense_receipt'], PATHINFO_EXTENSION)); + $name = implode(' - ', array_filter([$row['expense_date'] . ' ' . ($row['vendor_name'] ?? ''), $row['category_name'] ?? '', $row['expense_id']])); + $name = trim(preg_replace('/[^\p{L}\p{N} ._()&-]+/u', '', $name)); + return ($name !== '' ? $name : 'Receipt') . ($ext !== '' ? ".$ext" : ''); +} + +/** Remove a receipt file from uploads/expenses/. */ +function expenseReceiptDeleteFile($file_name) { + $path = expenseReceiptPath($file_name); + if ($path !== '') { + @unlink($path); + } +} + +/** + * Attach an uploaded receipt to an expense, replacing the one it had. + * Returns the stored name, or '' with $error. A missing upload is not an + * error - $error stays empty. + */ +function expenseReceiptStore($expense_id, $file, &$error = '') { + global $mysqli; + $error = ''; + $expense_id = intval($expense_id); + if (!is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE || empty($file['name'])) { + return ''; + } + $new_name = checkFileUpload($file, expenseReceiptTypes()); + if (!$new_name) { + $error = 'The receipt was not saved - it has to be a photo (JPG, PNG, GIF or WebP) or a PDF'; + return ''; + } + $dir = dirname(__DIR__) . '/uploads/expenses'; + if (!is_dir($dir)) { + mkdir($dir, 0775, true); + } + if (!move_uploaded_file($file['tmp_name'], "$dir/$new_name")) { + $error = 'The receipt could not be saved'; + return ''; + } + $old = getFieldById('expenses', $expense_id, 'expense_receipt'); + mysqli_query($mysqli, "UPDATE expenses SET expense_receipt = '" . escapeSql($new_name) . "' WHERE expense_id = $expense_id"); + if ($old && $old !== $new_name) { + expenseReceiptDeleteFile($old); + } + return $new_name; +} + +/** Take the receipt off an expense, and its file. */ +function expenseReceiptRemove($expense_id) { + global $mysqli; + $expense_id = intval($expense_id); + $old = getFieldById('expenses', $expense_id, 'expense_receipt'); + mysqli_query($mysqli, "UPDATE expenses SET expense_receipt = NULL WHERE expense_id = $expense_id"); + if ($old) { + expenseReceiptDeleteFile($old); + } +} + +/** + * How an expense reads in a log or message - "Pax8 $149.99 on 2026-10-14". + * Raw. + */ +function expenseLabel(array $row) { + return trim(($row['vendor_name'] ?? 'Expense') . ' ' . billingMoney($row['expense_amount'], $row['expense_currency_code']) . ' on ' . $row['expense_date']); +} diff --git a/functions/export.php b/functions/export.php index 82798a229..b226e7151 100644 --- a/functions/export.php +++ b/functions/export.php @@ -384,7 +384,10 @@ function getExportColumns($export_type) { 'category_name' => ['label' => 'Category'], 'account_name' => ['label' => 'Account'], 'client_name' => ['label' => 'Client', 'weight' => 2, 'default' => false], + 'expense_payment_method' => ['label' => 'Paid By', 'default' => false], 'expense_reference' => ['label' => 'Reference', 'default' => false], + 'expense_receipt_display' => ['label' => 'Receipt', 'default' => false], + 'user_name' => ['label' => 'Entered By', 'default' => false], ], 'income' => [ diff --git a/functions/search.php b/functions/search.php index 564c00647..cc6acb7cc 100644 --- a/functions/search.php +++ b/functions/search.php @@ -533,6 +533,31 @@ function globalSearchGroups($terms, $deep) { }, ]; + // Expenses by what they were for, their reference, or the amount ("149.99", "$1,250") + $expense_amount_text = str_replace([',', '$'], '', $q); + $expense_amount = preg_match('/^-?\d+(\.\d{1,2})?$/', $expense_amount_text) ? abs(round(floatval($expense_amount_text), 2)) : 0; + $expense_amount_match = $expense_amount > 0 ? "OR ABS(expense_amount) = $expense_amount" : ''; + $groups[] = [ + 'key' => 'expenses', 'label' => 'Expenses', 'icon' => 'shopping-cart', 'module' => 'module_financial', 'enabled' => $accounting, + 'select' => 'expense_id, expense_date, expense_amount, expense_currency_code, expense_description, expense_reference, vendor_name, client_name', + 'from' => 'expenses LEFT JOIN vendors ON expense_vendor_id = vendor_id LEFT JOIN clients ON expense_client_id = client_id', + 'where' => "expense_vendor_id > 0 + AND (expense_description LIKE '%$like%' OR expense_reference LIKE '%$like%' $expense_amount_match)", + 'scope' => 'expense_client_id', + 'order' => ($expense_amount > 0 ? "(ABS(expense_amount) = $expense_amount) DESC, " : '') . 'expense_date DESC, expense_id DESC', + 'list_url' => '/agent/expenses.php?' . http_build_query(['q' => $q]), + 'item' => function ($row) { + $description = trim((string) $row['expense_description']); + return [ + 'title' => $description !== '' ? mb_strimwidth($description, 0, 80, '...') : ($row['vendor_name'] ?: 'Expense'), + 'subtitle' => globalSearchMoney($row['expense_amount'], $row['expense_currency_code']) . ' · ' . $row['expense_date'] + . ($row['expense_reference'] ? ' · #' . $row['expense_reference'] : ''), + 'context' => implode(' · ', array_filter([$row['vendor_name'], $row['client_name']])), + 'url' => '/agent/expenses.php?open=' . intval($row['expense_id']), + ]; + }, + ]; + $vendor_phone_match = $phone ? "OR REGEXP_REPLACE(vendor_phone, '[^0-9]', '') LIKE '%$phone%'" : ''; $groups[] = [ 'key' => 'vendors', 'label' => 'Vendors', 'icon' => 'building', 'module' => 'module_client', diff --git a/uploads/expenses/.htaccess b/uploads/expenses/.htaccess new file mode 100644 index 000000000..7cb1de172 --- /dev/null +++ b/uploads/expenses/.htaccess @@ -0,0 +1,3 @@ +Require all denied +Options -ExecCGI -Indexes +php_flag engine off