nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

code audit fixes: require_once, issue flow, role guards

Browse Source
This commit is contained in:
Thanakorn S
2026-05-23 17:06:08 +07:00
parent 54f3f11fd2
commit 5ca6b49fd0
191 changed files with 534 additions and 464 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/expense/api/engine/convert_purchase_request.php
+3 -3
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require '../../../assets/utils/classes/PurchaseRequestManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
require_role($user_role, ['owner', 'admin', 'staff']);
$request_id = (int)($data['request_id'] ?? 0);
app/expense/api/engine/manage_purchase_request.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PurchaseRequestManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
require_role($user_role, ['owner', 'admin', 'staff']);
$action = $data['action'] ?? '';
app/expense/api/engine/manage_supplier_credit_note.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
try {
$new_id = null;
app/expense/api/engine/retrieve_purchase_request.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PurchaseRequestManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
$id = (int)($data['id'] ?? 0);
$prm = new PurchaseRequestManager($pdo2, $company_id);
app/expense/api/engine/update_purchase_request_status.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PurchaseRequestManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
require_role($user_role, ['owner', 'admin', 'staff']);
$id = (int)($data['id'] ?? 0);
app/expense/manage_purchase_invoice.php
+78 -2
View File
@@ -128,6 +128,10 @@
<i class="ti ti-device-floppy me-1"></i>Save
</button>
<button class="btn btn-success w-100" id="btn_issue" onclick="issue_invoice()">
<i class="ti ti-send me-1"></i>Issue
</button>
<a href="#" class="btn btn-outline-info w-100 d-none" id="btn_create_scn">
<i class="ti ti-file-minus me-1"></i>Create Supplier Credit Note
</a>
@@ -136,6 +140,10 @@
<i class="ti ti-ban me-1"></i>Void
</button>
<button class="btn btn-outline-danger w-100 d-none" id="btn_delete" onclick="delete_invoice()">
<i class="ti ti-trash me-1"></i>Delete
</button>
</div>
</div>
@@ -147,6 +155,9 @@
<?php require '../include_ending.php'; ?>
<script>
const can_delete = ['admin', 'owner'].includes(user_role);
var invoice_id = <?php echo $invoice_id; ?>;
var invoice_data = null;
@@ -183,8 +194,13 @@
$('#due_date_row').toggleClass('d-none', is_dn);
$('#due_date, #notes').prop('disabled', !is_editable);
$('#btn_issue').html(is_dn
? '<i class="ti ti-send me-1"></i>Issue Supplier Credit Note'
: '<i class="ti ti-send me-1"></i>Issue Purchase Invoice');
var not_editable_hint = (!is_pi && !is_dn) ? 'Unsupported document type' : '';
set_btn_state('#btn_save', is_editable, not_editable_hint || 'Only draft documents can be edited');
set_btn_state('#btn_save', is_editable, not_editable_hint || 'Only draft documents can be edited');
set_btn_state('#btn_issue', is_editable, not_editable_hint || (status > 0 ? 'Already issued' : 'Only drafts can be issued'));
$('#btn_create_scn')
.toggleClass('d-none', !(is_pi && status >= 1 && status !== 4))
@@ -192,8 +208,10 @@
set_btn_state('#btn_void', is_pi && status >= 1 && status !== 4,
!is_pi ? 'Only purchase invoices can be voided'
: status === 0 ? 'Invoice has not been issued yet'
: status === 0 ? 'Issue the document before voiding'
: status === 4 ? 'Already void' : '');
$('#btn_delete').toggleClass('d-none', !can_delete || !invoice_id);
}
function retrieve_invoice() {
@@ -325,6 +343,64 @@
});
}
function issue_invoice() {
var is_dn = invoice_data && invoice_data.doc_type === 'supplier_credit_note';
var due_date = $('#due_date').val().trim();
if (!is_dn && !due_date) {
bootbox.alert('Please enter a due date before issuing this purchase invoice.');
return;
}
var label = is_dn ? 'Issue Supplier Credit Note' : 'Issue Purchase Invoice';
bootbox.confirm({
message: is_dn ? 'Issue this supplier credit note?' : 'Issue this purchase invoice?',
buttons: {
confirm: { label: label, className: 'btn-success' },
cancel: { label: 'Back', className: 'btn-secondary' }
},
callback: function(result) {
if (!result) return;
ajax_request({
url: '<?php echo $server_url?>order/api/engine/issue_invoice.php',
autoPrepare: true,
checkRequired: 0,
action: 'update',
data: {
invoice_id: invoice_id,
due_date: is_dn ? '' : due_date.split('/').reverse().join('-')
},
onSuccess: function(res) {
retrieve_invoice();
if (res.gl_posted === true) {
toastr.success('GL entry posted automatically.', 'GL Posted');
} else if (res.gl_posted === false) {
toastr.warning('Document issued, but GL posting failed: ' + (res.gl_message || 'Unknown error'), 'GL Skipped', { timeOut: 8000 });
}
}
});
}
});
}
function delete_invoice() {
bootbox.confirm({
message: 'Delete this document? Any GL entry will be removed.',
buttons: { confirm: { label: 'Delete', className: 'btn-danger' }, cancel: { label: 'Back', className: 'btn-secondary' } },
callback: function(result) {
if (!result) return;
ajax_request({
url: '<?php echo $server_url?>order/api/engine/delete_invoice.php',
autoPrepare: false,
checkRequired: 0,
action: 'delete',
data: { id: invoice_id },
onSuccess: function() {
window.location.href = '<?php echo $server_url?>expense/purchase_invoice.php';
}
});
}
});
}
function void_invoice() {
bootbox.confirm({
message: '<strong>Void this purchase invoice?</strong><br>This action cannot be undone.',
app/expense/purchase_invoice.php
+3 -6
View File
@@ -193,6 +193,7 @@
<script>
var current_tab = <?php echo json_encode($_GET['tab'] ?? 'purchase_invoice'); ?>;
var all_invoices = [];
const can_delete = ['admin', 'owner'].includes(user_role);
var formula_map = {};
function load_formula_map() {
@@ -352,9 +353,7 @@
<a href="javascript:;" title="View GL Entry" class="me-2" onclick="show_gl_modal('purchase_invoice',${inv.id})">
<i class="ti ti-book fs-5 text-secondary"></i>
</a>
<a href="javascript:;" title="Delete" class="link-danger" onclick="delete_invoice(${inv.id},'${escape_html(inv.invoice_number)}')">
<i class="ti ti-trash fs-5"></i>
</a>
${can_delete ? `<a href="javascript:;" title="Delete" class="link-danger" onclick="delete_invoice(${inv.id},'${escape_html(inv.invoice_number)}')"><i class="ti ti-trash fs-5"></i></a>` : ''}
</td>
</tr>`;
});
@@ -400,9 +399,7 @@
<a href="javascript:;" title="View GL Entry" class="me-2" onclick="show_gl_modal('supplier_credit_note',${scn.id})">
<i class="ti ti-book fs-5 text-secondary"></i>
</a>
<a href="javascript:;" title="Delete" class="link-danger" onclick="delete_invoice(${scn.id},'${escape_html(scn.invoice_number)}')">
<i class="ti ti-trash fs-5"></i>
</a>
${can_delete ? `<a href="javascript:;" title="Delete" class="link-danger" onclick="delete_invoice(${scn.id},'${escape_html(scn.invoice_number)}')"><i class="ti ti-trash fs-5"></i></a>` : ''}
</td>
</tr>`;
});