Files
Thanakorn SandClaude Sonnet 4.6 b07882e3f4 code audit fixes: require_once, issue flow, role guards
- Upgraded all plain `require` to `require_once` across 172 api/engine
  and api/engine_report files to prevent class-redeclaration errors
- Added issue button, issue_invoice() with GL toastr, and delete_invoice()
  to expense/manage_purchase_invoice.php, bringing it in line with
  po/manage_purchase_invoice.php
- Added can_delete role guard (admin/owner only) to trash icons on
  revenue/invoice.php and expense/purchase_invoice.php, matching the
  existing pattern in finance/receipt.php and finance/payment.php

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-23 17:06:08 +07:00

55 lines
1.7 KiB
PHP

<?php
session_start();
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
require_role($user_role, ['owner', 'admin']);
$csm = new CompanySettingManager($pdo1, $company_id);
if ($data['action'] === 'read') {
$open_from = $csm->get('posting_open_from');
if ($open_from === null || $open_from === '') {
$open_from = $csm->get('gl_open_from') ?: '';
}
$open_to = $csm->get('posting_open_to');
if ($open_to === null || $open_to === '') {
$open_to = $csm->get('gl_open_to') ?: '';
}
$answer['output'] = [
'open_from' => $open_from ?: '',
'open_to' => $open_to ?: '',
];
$answer['success'] = 1;
exit(json_encode($answer));
}
if ($data['action'] === 'save') {
$from = trim((string)($data['open_from'] ?? ''));
$to = trim((string)($data['open_to'] ?? ''));
if ($from !== '' && !preg_match('/^\d{4}-\d{2}-\d{2}$/', $from)) {
$answer['message'] = 'Invalid open_from date. Use YYYY-MM-DD.';
exit(json_encode($answer));
}
if ($to !== '' && !preg_match('/^\d{4}-\d{2}-\d{2}$/', $to)) {
$answer['message'] = 'Invalid open_to date. Use YYYY-MM-DD.';
exit(json_encode($answer));
}
if ($from && $to && $from > $to) {
$answer['message'] = 'Open From must be on or before Open To.';
exit(json_encode($answer));
}
$csm->set('posting_open_from', $from);
$csm->set('posting_open_to', $to);
$answer['success'] = 1;
$answer['message'] = 'Posting window saved.';
exit(json_encode($answer));
}
$answer['message'] = 'Invalid action.';
exit(json_encode($answer));