mirror of
https://github.com/itflow-org/itflow
synced 2026-11-11 15:07:24 +00:00
cd7ebc0a5f
Agents restricted from a client could still edit, archive, restore or delete it, run bulk actions on it (edits, tags, archive, email, tickets) and add credits. Every selected client is now checked before anything is written. Expense, trip and recurring expense edits now check the client the record already belongs to, not just the submitted one. Recurring expense delete, revenue edit/delete and task approval handlers gained the same check. Per-client reports and the dashboard payment/ticket lists now hide clients the agent is denied. Company-wide totals are unchanged.
35 lines
1.0 KiB
PHP
35 lines
1.0 KiB
PHP
<?php
|
|
|
|
/*
|
|
* ITFlow - GET/POST request handler for credits
|
|
*/
|
|
|
|
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
|
|
|
|
if (isset($_POST['add_credit'])) {
|
|
|
|
validateCSRFToken();
|
|
|
|
enforceUserPermission('module_sales', 2);
|
|
|
|
$client_id = intval($_POST['client']);
|
|
|
|
enforceClientAccess();
|
|
|
|
$amount = floatval($_POST['amount']);
|
|
$type = escapeSql($_POST['type']);
|
|
$expire = escapeSql($_POST['expire']);
|
|
$note = escapeSql($_POST['note']);
|
|
|
|
mysqli_query($mysqli,"INSERT INTO credits SET credit_amount = $amount, credit_type = '$type', credit_note = '$note', credit_created_by = $session_user_id, credit_client_id = $client_id");
|
|
|
|
$credit_id = mysqli_insert_id($mysqli);
|
|
|
|
logAudit("Credit", "Create", "$session_name added " . numfmt_format_currency($currency_format, $amount, $session_company_currency) . "", $client_id, $credit_id);
|
|
|
|
flashAlert(numfmt_format_currency($currency_format, $amount, $session_company_currency) . " Credit Added");
|
|
|
|
redirect();
|
|
|
|
}
|