phpBMS

root/trunk/phpbms/modules/bms/products_saleshistory.php

Revision 704, 11.0 KB (checked in by brieb, 2 years ago)
  • Fixed several SQL injection vulnerabilities
  • Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
  • Fixed severa path disclosure errors
  • Property svn:keywords set to LastChangedBy LastChangedDate LastChangedRevision
Line 
1<?php
2/*
3 $Rev$ | $LastChangedBy$
4 $LastChangedDate$
5 +-------------------------------------------------------------------------+
6 | Copyright (c) 2004 - 2010, Kreotek LLC                                  |
7 | All rights reserved.                                                    |
8 +-------------------------------------------------------------------------+
9 |                                                                         |
10 | Redistribution and use in source and binary forms, with or without      |
11 | modification, are permitted provided that the following conditions are  |
12 | met:                                                                    |
13 |                                                                         |
14 | - Redistributions of source code must retain the above copyright        |
15 |   notice, this list of conditions and the following disclaimer.         |
16 |                                                                         |
17 | - Redistributions in binary form must reproduce the above copyright     |
18 |   notice, this list of conditions and the following disclaimer in the   |
19 |   documentation and/or other materials provided with the distribution.  |
20 |                                                                         |
21 | - Neither the name of Kreotek LLC nor the names of its contributore may |
22 |   be used to endorse or promote products derived from this software     |
23 |   without specific prior written permission.                            |
24 |                                                                         |
25 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS     |
26 | "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT       |
27 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A |
28 | PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT      |
29 | OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,   |
30 | SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT        |
31 | LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,   |
32 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY   |
33 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT     |
34 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE   |
35 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.    |
36 |                                                                         |
37 +-------------------------------------------------------------------------+
38*/
39        include("../../include/session.php");
40        include("include/fields.php");
41
42        if(!hasRights("role:259ead9f-100b-55b5-508a-27e33a6216bf"))
43            goURL(APP_PATH."noaccess.php");
44
45        if(!isset($_POST["fromdate"]))
46            $_POST["fromdate"] = dateToString(strtotime("-1 year"));
47
48        if(!isset($_POST["todate"]))
49            $_POST["todate"] = dateToString(mktime());
50
51        if(!isset($_POST["status"]))
52            $_POST["status"] = "Orders and Invoices";
53
54        if(!isset($_POST["command"]))
55            $_POST["command"] = "show";
56
57        if(!isset($_POST["date_order"]))
58            $_POST["date_order"] = "DESC";
59
60        if($_POST["command"]=="print")  {
61
62            $_SESSION["printing"]["whereclause"]="products.id=".$_GET["id"];
63            $_SESSION["printing"]["dataprint"]="Single Record";
64
65            goURL("report/products_saleshistory.php?rid=".urlencode("rpt:a278af28-9c34-da2e-d81b-4caa36dfa29f")."&tid=".urlencode("tbld:7a9e87ed-d165-c4a4-d9b9-0a4adc3c5a34")."&status=".urlencode($_POST["status"])."&fromdate=".urlencode($_POST["fromdate"])."&todate=".urlencode($_POST["todate"]));
66
67        } else {
68
69            $thestatus="(invoices.type =\"";
70            switch($_POST["status"]){
71
72                case "Orders and Invoices":
73                    $thestatus.="Order\" or invoices.type=\"Invoice\")";
74                    $searchdate="orderdate";
75                    break;
76
77                case "Invoices":
78                    $thestatus.="Invoice\")";
79                    $searchdate="invoicedate";
80                    break;
81
82                case "Orders":
83                    $thestatus.="Order\")";
84                    $searchdate="orderdate";
85                    break;
86
87            }//endswitch
88        $dateOrder = ($_POST['date_order'] == 'DESC') ? 'ASC' : 'DESC';
89
90        $mysqlfromdate=sqlDateFromString($_POST["fromdate"]);
91        $mysqltodate=sqlDateFromString($_POST["todate"]);
92
93        $refquery="select partname from products where id=".((int)$_GET["id"]);
94        $refquery=$db->query($refquery);
95        $refrecord=$db->fetchArray($refquery);
96
97        $querystatement="
98            SELECT
99                invoices.id AS id,
100                IF(invoices.type = 'Invoice', invoices.invoicedate, invoices.orderdate) AS thedate,
101                CONCAT('<strong>',IF(clients.lastname != '', CONCAT(clients.lastname,', ', clients.firstname, IF(clients.company != '', CONCAT(' (', clients.company, ')'),'')), clients.company), '</strong>') AS client,
102                lineitems.quantity AS qty,
103                lineitems.unitprice * lineitems.quantity AS extended,
104                lineitems.unitprice AS price,
105                lineitems.unitcost AS cost,
106                lineitems.unitcost * lineitems.quantity AS extendedcost
107            FROM
108                ((products INNER JOIN lineitems ON products.uuid = lineitems.productid)
109                    INNER JOIN invoices ON lineitems.invoiceid=invoices.id)
110                        INNER JOIN clients ON invoices.clientid = clients.uuid
111            WHERE
112                products.id=".((int)$_GET["id"])."
113                AND ".$thestatus."
114            HAVING
115                thedate >= '".$mysqlfromdate."'
116                AND thedate <= '".$mysqltodate."'
117            ORDER BY
118                thedate " .$dateOrder;
119
120        $queryresult=$db->query($querystatement);
121
122        $numrows = ($queryresult)? $db->numRows($queryresult) : 0;
123
124        $pageTitle="Product Sales History: ".$refrecord["partname"];
125
126        $phpbms->cssIncludes[] = "pages/products.css";
127
128                //Form Elements
129                //==============================================================
130                $theform = new phpbmsForm();
131
132                $theinput = new inputDatePicker("fromdate",sqlDateFromString($_POST["fromdate"]), "from" ,true);
133                $theform->addField($theinput);
134
135                $theinput = new inputDatePicker("todate",sqlDateFromString($_POST["todate"]), "to" ,true);
136                $theform->addField($theinput);
137
138                $theform->jsMerge();
139                //==============================================================
140                //End Form Elements
141
142        include("header.php");
143
144        $phpbms->showTabs("products entry","tab:cd09d4a1-7d32-e08a-bd6e-5850bc9af88e",$_GET["id"]);?><div class="bodyline">
145        <h1><span><?php echo $pageTitle ?></span></h1>
146        <form action="<?php echo htmlentities($_SERVER["REQUEST_URI"]) ?>" method="post" name="record">
147        <div class="box">
148                <p class="timelineP">
149                   <label for="status">type</label><br />
150                   <select name="status" id="status">
151                                <option value="Orders and Invoices" <?php if($_POST["status"]=="Orders and Invoices") echo "selected=\"selected\""?>>Orders and Invoices</option>
152                                <option value="Invoices" <?php if($_POST["status"]=="Invoices") echo "selected=\"selected\""?>>Invoices</option>
153                                <option value="Orders" <?php if($_POST["status"]=="Orders") echo "selected=\"selected\""?>>Orders</option>
154                   </select>
155                </p>
156
157                <p class="timelineP"><?php $theform->showField("fromdate")?></p>
158
159                <p class="timelineP"><?php $theform->showField("todate")?></p>
160
161                <p id="printP"><br /><input id="print" name="command" type="submit" value="print" class="Buttons" /></p>
162                <p id="changeTimelineP"><br /><input name="command" type="submit" value="update" class="smallButtons" /></p>
163                <input name="date_order" id="date_order" type="hidden" value="<?php echo $_POST["date_order"]; ?>" />
164        </div>
165
166   <div class="fauxP">
167   <table border="0" cellpadding="3" cellspacing="0" class="querytable">
168      <thead>
169        <tr>
170         <th align="center" nowrap="nowrap" class="queryheader" colspan="2">ID</th>
171         <th align="center" nowrap="nowrap" class="queryheader">
172                <a href="#" onclick="javascript:document.getElementById('date_order').value='<?php echo $dateOrder; ?>'; document.record.submit(); return false;">Date</a>
173         </th>
174         <th nowrap="nowrap" class="queryheader" width="100%" align="left">Client</th>
175         <th align="center" nowrap="nowrap" class="queryheader">Qty.</th>
176         <th align="right" nowrap="nowrap" class="queryheader">Unit Cost</th>
177         <th align="right" nowrap="nowrap" class="queryheader">Cost Ext.</th>
178         <th align="right" nowrap="nowrap" class="queryheader">Unit Price</th>
179         <th align="right" nowrap="nowrap" class="queryheader">Price Ext.</th>
180        </tr>
181     </thead>
182    <?php
183        $totalextended=0;
184        $totalcostextended=0;
185        $totalquantity=0;
186        $avgprice=0;
187        $avgcost=0;
188        $row=1;
189        ob_start();
190        ?><tbody><?php
191        while ($therecord=$db->fetchArray($queryresult)){
192                if($row==1) $row=2;else $row=1;
193                $avgcost+=$therecord["cost"];
194                $avgprice+=$therecord["price"];
195                $totalquantity+=$therecord["qty"];
196                $totalextended+=$therecord["extended"];
197                $totalcostextended+=$therecord["extendedcost"];
198?>
199        <tr class="row<?php echo $row?>">
200         <td>
201                <button type="button" class="invisibleButtons" onclick="location.href='<?php echo getAddEditFile($db, "tbld:62fe599d-c18f-3674-9e54-b62c2d6b1883") ?>?id=<?php echo $therecord["id"]?>&amp;backurl=<?php echo urlencode($_SERVER["REQUEST_URI"]); ?>'"><img src="<?php echo APP_PATH ?>common/stylesheet/<?php echo STYLESHEET ?>/image/button-edit.png" align="middle" alt="edit" width="16" height="16" border="0" /></button>
202         </td>
203         <td align="center" nowrap="nowrap"><?php echo $therecord["id"]?></td>
204         <td align="center" nowrap="nowrap"><?php echo $therecord["thedate"]?formatFromSQLDate($therecord["thedate"]):"&nbsp;" ?></td>
205         <td nowrap="nowrap"><?php echo $therecord["client"]?></td>
206         <td align="center" nowrap="nowrap"><?php echo number_format($therecord["qty"],2)?></td>
207         <td align="right" nowrap="nowrap"><?php echo numberToCurrency($therecord["cost"])?></td>
208         <td align="right" nowrap="nowrap"><?php echo numberToCurrency($therecord["extendedcost"])?></td>
209         <td align="right" nowrap="nowrap"><?php echo numberToCurrency($therecord["price"])?></td>
210         <td align="right" nowrap="nowrap"><?php echo numberToCurrency($therecord["extended"])?></td>
211        </tr>
212    <?php } if(!$db->numRows($queryresult)) {?>
213        <tr class="norecords"><td colspan="9">No Sales Data for Given Timeframe</td></tr>
214        <?php }?>
215        </tbody>
216        <?php $tbody = ob_get_clean(); ?>
217        <tfoot>
218        <tr class="queryfooter">
219         <td align="center" >&nbsp;</td>
220         <td align="center" >&nbsp;</td>
221         <td align="center" >&nbsp;</td>
222         <td align="center" >&nbsp;</td>
223         <td align="center" ><?php echo number_format($totalquantity,2)?></td>
224         <td align="right" nowrap="nowrap" >avg. = <?php $numrows?$avgcost=$avgcost/$numrows:$avgcost=0; echo numberToCurrency($avgcost)?></td>
225         <td align="right" ><?php echo numberToCurrency($totalcostextended)?></td>
226         <td align="right" nowrap="nowrap" >avg. = <?php $numrows?$avgprice=$avgprice/$numrows:$avgprice=0; echo numberToCurrency($avgprice)?></td>
227         <td align="right" ><?php echo numberToCurrency($totalextended)?></td>
228        </tr>
229        </tfoot>
230        <?php echo $tbody; ?>
231   </table></div></form>
232</div>
233<?php include("footer.php"); }//end if?>
Note: See TracBrowser for help on using the browser.
phpBMS vulnerability assesment provided by Orvant Inc. Copyright © 2010 Kreotek, LLC. All Rights reserved.