mirror of
https://github.com/itflow-org/itflow
synced 2026-11-15 00:47:24 +00:00
cd7ebc0a5f
Agents restricted from a client could still edit, archive, restore or delete it, run bulk actions on it (edits, tags, archive, email, tickets) and add credits. Every selected client is now checked before anything is written. Expense, trip and recurring expense edits now check the client the record already belongs to, not just the submitted one. Recurring expense delete, revenue edit/delete and task approval handlers gained the same check. Per-client reports and the dashboard payment/ticket lists now hide clients the agent is denied. Company-wide totals are unchanged.
91 lines
2.8 KiB
PHP
91 lines
2.8 KiB
PHP
<?php
|
|
|
|
/*
|
|
* ITFlow - GET/POST request handler for revenue
|
|
*/
|
|
|
|
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
|
|
|
|
if (isset($_POST['add_revenue'])) {
|
|
|
|
validateCSRFToken();
|
|
|
|
enforceUserPermission('module_sales', 2);
|
|
|
|
$date = escapeSql($_POST['date']);
|
|
$amount = floatval($_POST['amount']);
|
|
$account = intval($_POST['account']);
|
|
$category = intval($_POST['category']);
|
|
$payment_method = escapeSql($_POST['payment_method']);
|
|
$description = escapeSql($_POST['description']);
|
|
$reference = escapeSql($_POST['reference']);
|
|
|
|
mysqli_query($mysqli,"INSERT INTO revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_currency_code = '$session_company_currency', revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account");
|
|
|
|
$revenue_id = mysqli_insert_id($mysqli);
|
|
|
|
logAudit("Revenue", "Create", "$session_name added revenue $description", 0, $revenue_id);
|
|
|
|
flashAlert("Revenue added");
|
|
|
|
redirect();
|
|
|
|
}
|
|
|
|
if (isset($_POST['edit_revenue'])) {
|
|
|
|
validateCSRFToken();
|
|
|
|
enforceUserPermission('module_sales', 2);
|
|
|
|
$revenue_id = intval($_POST['revenue_id']);
|
|
|
|
$client_id = intval(getFieldById('revenues', $revenue_id, 'revenue_client_id'));
|
|
if ($client_id) {
|
|
enforceClientAccess();
|
|
}
|
|
|
|
$date = escapeSql($_POST['date']);
|
|
$amount = floatval($_POST['amount']);
|
|
$account = intval($_POST['account']);
|
|
$category = intval($_POST['category']);
|
|
$payment_method = escapeSql($_POST['payment_method']);
|
|
$description = escapeSql($_POST['description']);
|
|
$reference = escapeSql($_POST['reference']);
|
|
|
|
mysqli_query($mysqli,"UPDATE revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account WHERE revenue_id = $revenue_id");
|
|
|
|
logAudit("Revenue", "Edit", "$session_name edited revenue $description", 0, $revenue_id);
|
|
|
|
flashAlert("Revenue edited");
|
|
|
|
redirect();
|
|
|
|
}
|
|
|
|
if (isset($_GET['delete_revenue'])) {
|
|
|
|
validateCSRFToken();
|
|
|
|
enforceUserPermission('module_sales', 3);
|
|
|
|
$revenue_id = intval($_GET['delete_revenue']);
|
|
|
|
$client_id = intval(getFieldById('revenues', $revenue_id, 'revenue_client_id'));
|
|
if ($client_id) {
|
|
enforceClientAccess();
|
|
}
|
|
|
|
// Get Revenue Details
|
|
$revenue_description = escapeSql(getFieldById('revenues', $revenue_id, 'revenue_description'));
|
|
|
|
mysqli_query($mysqli,"DELETE FROM revenues WHERE revenue_id = $revenue_id");
|
|
|
|
logAudit("Revenue", "Delete", "$session_name deleted revenue $revenue_description");
|
|
|
|
flashAlert("Revenue removed", 'error');
|
|
|
|
redirect();
|
|
|
|
}
|