diff options
| -rw-r--r-- | Changelog | 1 | ||||
| -rwxr-xr-x | LedgerSMB/OP.pm | 149 |
2 files changed, 86 insertions, 64 deletions
@@ -15,6 +15,7 @@ Security: * Audited IS.pm, GL.pm, IR.pm for SQL injection and moved to new API. (Chris T) * Audited User.pm for SQL injection. (Chris T) * Audited HR.pm, removed old, stale payroll code, moved to new API (Chris T) +* Audited OP.pm and moved to new API (Chris T) Localization: * Moved localization files to standard codes (Seneca) diff --git a/LedgerSMB/OP.pm b/LedgerSMB/OP.pm index 47744526..13f9da01 100755 --- a/LedgerSMB/OP.pm +++ b/LedgerSMB/OP.pm @@ -23,7 +23,7 @@ # #====================================================================== # -# This file has NOT undergone whitespace cleanup. +# This file has undergone whitespace cleanup. # #====================================================================== # @@ -35,82 +35,103 @@ package OP; sub overpayment { - my ($self, $myconfig, $form, $dbh, $amount, $ml) = @_; + my ($self, $myconfig, $form, $dbh, $amount, $ml) = @_; - my $fxamount = $form->round_amount($amount * $form->{exchangerate}, 2); - my ($paymentaccno) = split /--/, $form->{account}; + my $fxamount = $form->round_amount($amount * $form->{exchangerate}, 2); + my ($paymentaccno) = split /--/, $form->{account}; - my ($null, $department_id) = split /--/, $form->{department}; - $department_id *= 1; + my ($null, $department_id) = split /--/, $form->{department}; + $department_id *= 1; - my $uid = localtime; - $uid .= "$$"; + my $uid = localtime; + $uid .= "$$"; - # add AR/AP header transaction with a payment - $query = qq|INSERT INTO $form->{arap} (invnumber, employee_id) - VALUES ('$uid', (SELECT id FROM employee - WHERE login = '$form->{login}'))|; - $dbh->do($query) || $form->dberror($query); + # add AR/AP header transaction with a payment + my $login = $dbh->quote($form->{login}); + $query = qq| + INSERT INTO $form->{arap} (invnumber, employee_id) + VALUES ('$uid', (SELECT id FROM employee + WHERE login = $login))|; + $dbh->do($query) || $form->dberror($query); - $query = qq|SELECT id FROM $form->{arap} - WHERE invnumber = '$uid'|; - ($uid) = $dbh->selectrow_array($query); + $query = qq|SELECT id FROM $form->{arap} WHERE invnumber = '$uid'|; + ($uid) = $dbh->selectrow_array($query); - my $invnumber = $form->{invnumber}; - $invnumber = $form->update_defaults($myconfig, ($form->{arap} eq 'ar') ? "sinumber" : "vinumber", $dbh) unless $invnumber; + my $invnumber = $form->{invnumber}; + $invnumber = $form->update_defaults( + $myconfig, + ($form->{arap} eq 'ar') + ? "sinumber" + : "vinumber", + $dbh) unless $invnumber; - $query = qq|UPDATE $form->{arap} set - invnumber = |.$dbh->quote($invnumber).qq|, - $form->{vc}_id = $form->{"$form->{vc}_id"}, - transdate = '$form->{datepaid}', - datepaid = '$form->{datepaid}', - duedate = '$form->{datepaid}', - netamount = 0, - amount = 0, - paid = $fxamount, - curr = '$form->{currency}', - department_id = $department_id - WHERE id = $uid|; - $dbh->do($query) || $form->dberror($query); + $query = qq| + UPDATE $form->{arap} + set invnumber = ?, + $form->{vc}_id = ?, + transdate = ?, + datepaid = ?, + duedate = ?, + netamount = 0, + amount = 0, + paid = ?, + curr = ?, + department_id = ? + WHERE id = ?|; + $sth = $dbh->prepare($query); + $sth->execute( + $invnumber, $form->{"$form->{vc}_id"}, $form->{datepaid}, + $form->{datepaid}, $form->{datepaid}, $fxamount, + $form->{currency}, $department_id, $uid + ) || $form->dberror($query); - # add AR/AP - ($accno) = split /--/, $form->{$form->{ARAP}}; + # add AR/AP + ($accno) = split /--/, $form->{$form->{ARAP}}; - $query = qq|INSERT INTO acc_trans (trans_id, chart_id, transdate, amount) - VALUES ($uid, (SELECT id FROM chart - WHERE accno = '$accno'), - '$form->{datepaid}', $fxamount * $ml)|; - $dbh->do($query) || $form->dberror($query); + $query = qq| + INSERT INTO acc_trans (trans_id, chart_id, transdate, amount) + VALUES (?, (SELECT id FROM chart + WHERE accno = ?), ?, ?)|; + $sth = $dbh->prepare($query); + $sth->execute($uid, $accno, $form->{datepaid}, $fxamount * $ml) + || $form->dberror($query); - # add payment - $query = qq|INSERT INTO acc_trans (trans_id, chart_id, transdate, - amount, source, memo) - VALUES ($uid, (SELECT id FROM chart - WHERE accno = '$paymentaccno'), - '$form->{datepaid}', $amount * $ml * -1, | - .$dbh->quote($form->{source}).qq|, | - .$dbh->quote($form->{memo}).qq|)|; - $dbh->do($query) || $form->dberror($query); + # add payment + $query = qq| + INSERT INTO acc_trans (trans_id, chart_id, transdate, + amount, source, memo) + VALUES (?, (SELECT id FROM chart WHERE accno = ?), + ?, ?, ?, ?)|; + $sth = $dbh->prepare($query); + $sth->execute( + $uid, $paymentaccno, $form->{datepaid}, $amount * $ml * -1, + $form->{source}, $form->{memo} + )|| $form->dberror($query); - # add exchangerate difference - if ($fxamount != $amount) { - $query = qq|INSERT INTO acc_trans (trans_id, chart_id, transdate, - amount, cleared, fx_transaction, source) - VALUES ($uid, (SELECT id FROM chart - WHERE accno = '$paymentaccno'), - '$form->{datepaid}', ($fxamount - $amount) * $ml * -1, - '1', '1', | - .$dbh->quote($form->{source}).qq|)|; - $dbh->do($query) || $form->dberror($query); - } + # add exchangerate difference + if ($fxamount != $amount) { + $query = qq| + INSERT INTO acc_trans (trans_id, chart_id, transdate, + amount, cleared, fx_transaction, source) + VALUES (?, (SELECT id FROM chart WHERE accno = ?), + ?, ?, '1', '1', ?)|; + $sth = $dbh->prepare($query); + $sth->execute($uid, $paymentaccno, $form->{datepaid}, + ($fxamount - $amount) * $ml * -1, $form->{source} + ) || $form->dberror($query); + } - my %audittrail = ( tablename => $form->{arap}, - reference => $invnumber, - formname => ($form->{arap} eq 'ar') ? 'deposit' : 'pre-payment', - action => 'posted', - id => $uid ); + my %audittrail = ( + tablename => $form->{arap}, + reference => $invnumber, + formname => + ($form->{arap} eq 'ar') + ? 'deposit' + : 'pre-payment', + action => 'posted', + id => $uid ); - $form->audittrail($dbh, "", \%audittrail); + $form->audittrail($dbh, "", \%audittrail); } |