FM / models

/var/www/myprog.com.ua/cashcontrol/models/

/var/www/myprog.com.ua/cashcontrol/models

Name	Size	Mode	Actions
class.admin_model.php	10726	0644	edit dl rm
class.api_model.php	15040	0644	edit dl rm
class.docs_model.php	1128	0644	edit dl rm
class.index_model.php	35261	0644	edit dl rm
class.login_model.php	15708	0644	edit dl rm
class.reference_model.php	24053	0644	edit dl rm

Edit: /var/www/myprog.com.ua/cashcontrol/models/class.api_model.php (15040B)

<?php
/**
 * @author Sergey Kozinets
 * @copyright Doncode 2017
 * @package CashControl API
 */
class api_model extends model {	
	
    public function __construct(){
        parent::__construct();
    }
    
    public function login(){
		$login = isset($_POST['login'])?$_POST['login']:0;
        $pass  = isset($_POST['pass'])?$_POST['pass']:0;

try{
            $sth = $this->database->prepare("SELECT id FROM users 
                WHERE login='".$login."' AND password='".hash::create('sha256',$pass,HASH_STATIC)."' LIMIT 1 ");
            $sth->execute();
            $data = $sth->fetchAll(PDO::FETCH_ASSOC);
            if(!isset($data[0]))return null;
			
			$client_id = $data[0]['id'];
			$client_key = md5(md5($login).$pass);
			
			$this->database->query("DELETE FROM api_keys WHERE client_id = '".$client_id."'");
			$insertkeyid = $this->database->insert(DB_PREFIX.'api_keys',array(
						   'client_id'     	=>$client_id,
						   'client_key'     =>$client_key,
						   'activated' 	    =>'1'
						  ));
            return $client_key;
        }catch(PDOException $e){
            return $e->getMessage();
        }

}
        
    public function get_bills(){

try{
			if($this->su){
				$superuser = ' ';
			}else{
				$superuser = ($this->client_id>0)?' AND b.owner_user_id='.$this->client_id.' ':' ';
				//$superuser = ($this->client_id>0)?' AND b.owner_user_id='.$this->client_id.' ':' ';
			}
			$sth=$this->database->prepare("SELECT b.*, cu.name as currency, co.name as company, u.login as owner_login FROM bills b
										  INNER JOIN currency cu ON cu.id=b.currency_id
										  LEFT JOIN company co ON co.id=b.company_id
										  LEFT JOIN users u ON u.id=b.owner_user_id
										  WHERE b.deleted='0' ".$superuser."
										  GROUP BY b.id
										  ORDER BY b.company_id,b.currency_id");
			$sth->execute();
//			$data = $sth->fetchAll();
            $data = $sth->fetchAll(PDO::FETCH_ASSOC);
            if(!isset($data[0]))return null;
			
            return $data;
        }catch(PDOException $e){
            return $e->getMessage();
        }

}
 
    public function get_orders(){

try{
			if($this->su){
				$superuser = ' ';
				$superinner = ' ';
			}else{
				$superuser = ($this->client_id>0)?' AND b.owner_user_id='.$this->client_id.' ':' ';
				$superinner = ' ';//' INNER JOIN user_bills ub ON ub.bill_id=b.id ';
			}
			$deleted = (isset($_POST['deleted'])&&$_POST['deleted']==1)?' ':" o.deleted='0' AND ";
			$not_fixed = (isset($_POST['not_fixed'])&&$_POST['not_fixed']==1)?" o.reduction_id='0' AND ":' ';
		
			$company = (isset($_POST['company_id'])&&$_POST['company_id']>0)?' AND b.company_id='.$_POST['company_id'].' ':' ';
			$bill = (isset($_POST['bill_id'])&&$_POST['bill_id']>0)?' AND o.bill_id='.$_POST['bill_id'].' ':' ';
			$currency = (isset($_POST['currency_id'])&&$_POST['currency_id']>0)?' AND b.currency_id='.$_POST['currency_id'].' ':' ';
	
			if(isset($_POST['start_date'])){
				$start = date("Y-m-d H:i:s",strtotime($_POST['start_date']));
			}else{
				$start = date("Y-m-d 00:00:00");
			}
			if(isset($_POST['end_date'])){
				$end = date("Y-m-d H:i:s",strtotime($_POST['end_date']));
			}else{
				$end = date("Y-m-d 23:59:59");
			}
			//$where_date = ($start==$end)?'':'';
			$where_date = (isset($_POST['not_fixed'])&&$_POST['not_fixed']==1)?' ':
						" AND o.order_date>='".substr($start,0,10).' 00:00:00'."'
							AND o.order_date<='".substr($end,0,10).' 23:59:59'."' ";
			
			$where=(isset($_POST['contractor_id'])&&$_POST['contractor_id']>0)?' AND o.contractor_id='.$_POST['contractor_id']:'';
			$where.=(isset($_POST['order_type_id'])&&$_POST['order_type_id']>0)?' AND (o.order_type_id='.$_POST['order_type_id'].' OR ot.owner_id='.$_POST['order_type_id'].') ':'';
			$where.=$company.$bill.$currency.$superuser;
	
			$sql="SELECT o.*, cu.name as currency, t.accept, t.transfer_from, t.transfer_to, b.name as bill_name, ot.owner_id FROM orders o
									  INNER JOIN bills b ON o.bill_id=b.id
									  INNER JOIN currency cu ON cu.id=b.currency_id
									  INNER JOIN order_types ot ON ot.id=o.order_type_id OR ot.owner_id=o.order_type_id
									  LEFT JOIN transactions t ON t.order_from = o.id OR t.order_to = o.id
									  ".$superinner."
									  WHERE ".$deleted." ".$not_fixed." b.deleted='0'
									  ".$where_date." 
									  ".$where." 
									  GROUP BY o.id 
									  ORDER BY o.order_date, o.id DESC";
									 // echo $sql;exit;
			$sth=$this->database->prepare($sql);
			$sth->execute();
//			$data = $sth->fetchAll();
            $data = $sth->fetchAll(PDO::FETCH_ASSOC);
//var_export($data);exit;
            if(!isset($data[0]))return null;
			
            return $data;
        }catch(PDOException $e){
            return $e->getMessage();
        }

}
	
	
	
	
	///////
	
	public function getCompanyBills(){
		$company_id = isset($_POST['company_id'])?$_POST['company_id']:'0';
        $sth=$this->database->prepare("SELECT b.*, cu.name as currency, co.name as company, u.login as owner_login FROM bills b
									  INNER JOIN currency cu ON cu.id=b.currency_id
									  LEFT JOIN company co ON co.id=b.company_id
									  LEFT JOIN users u ON u.id=b.owner_user_id
									  WHERE b.deleted='0' AND b.company_id='".$company_id."'
									  ORDER BY b.currency_id");
        $sth->execute();
		$data = $sth->fetchAll();
        return $data;
    }

public function getContractors(){
		$bill_id = isset($_POST['bill_id'])?$_POST['bill_id']:'0';
		$company_id = isset($_POST['company_id'])?$_POST['company_id']:'0';
		if($this->client_id > 0){
			if($bill_id > 0 || $company_id > 0){
				$sql = "SELECT c.*
				FROM contractor c
				INNER JOIN company_contractor cc ON cc.contractor_id = c.id AND cc.company_id = ".$company_id."
				WHERE c.deleted='0'";
			}else{
				$sql = "SELECT c.*
				FROM contractor c
				INNER JOIN bills b ON b.id = ub.bill_id
				INNER JOIN company_contractor cc ON cc.contractor_id = c.id AND cc.company_id = b.company_id
				WHERE c.deleted='0' AND b.owner_user_id = ".$this->client_id." GROUP BY c.id";
			}
		}else{
			$sql = "SELECT * FROM contractor WHERE deleted='0'";
		}
        $sth=$this->database->prepare($sql);
        $sth->execute();
        return $sth->fetchAll();
    }

public function getOrderTypes($incoming=0){		
		$bill_id = isset($_POST['bill_id'])?$_POST['bill_id']:'0';
		$company_id = isset($_POST['company_id'])?$_POST['company_id']:'0';
		if($this->client_id > 0){
			if($bill_id > 0 || $company_id > 0){
				$sql = "SELECT ot.*
				FROM order_types ot
				INNER JOIN company_order_types cot ON cot.order_type_id = ot.id AND cot.company_id = ".$company_id."
				WHERE ot.deleted='0' AND ot.incoming='".$incoming."'";
			}else{
				$sql = "SELECT ot.*
				FROM order_types ot
				INNER JOIN bills b ON b.id = ub.bill_id
				INNER JOIN company_order_types cot ON cot.order_type_id = ot.id AND cot.company_id = b.company_id
				WHERE ot.deleted='0' AND b.owner_user_id = ".$this->client_id." AND ot.incoming='".$incoming."' GROUP BY ot.id";
				//echo $sql;exit;
			}
		}else{
			$sql = "SELECT * FROM order_types WHERE deleted='0' AND incoming='".$incoming."'";
		}
		
        $sth=$this->database->prepare($sql);
        $sth->execute();
        return $sth->fetchAll();
    }
	
     public function order_create(){
		$bill_id = isset($_POST['bill_id'])?intval($_POST['bill_id']):0;
		$order_date = isset($_POST['order_date'])?date("Y-m-d H:i:s",strtotime($_POST['order_date'].' 00:00:00')):date("Y-m-d H:i:s");
		$id = isset($_POST['id'])?$_POST['id']:0;
		$incoming = isset($_POST['incoming'])?str_replace(',','.',trim($_POST['incoming'])):0;
		$consumption = isset($_POST['consumption'])?str_replace(',','.',trim($_POST['consumption'])):0;
		$contractor_id = isset($_POST['contractor_id'])?intval($_POST['contractor_id']):0;
		$order_type_id = isset($_POST['order_type_id'])?intval($_POST['order_type_id']):0;
		$comment = isset($_POST['comment'])?$_POST['comment']:'';

if (date("Y",strtotime($order_date))<2015){
			$error = 100;
			$error_msg = "Дата введена не правильно";
			return array($error,$error_msg,0);
		}
		if ($bill_id==0){
			$error = 101;
			$error_msg = "Счет не выбран";
			return array($error,$error_msg,0);
		}
		if ($incoming>0&&$consumption>0){
			$error = 102;
			$error_msg = "Приход и расход не могут быть заполнены одновременно";
			return array($error,$error_msg,0);
		}
		if($incoming>0){
			$incoming_type = 1;
		}else{
			$incoming_type = 0;
		}
		if ($incoming_type==1&&$order_type_id==0){
			$error = 103;
			$error_msg = "Выберите тип ордера";
			return array($error,$error_msg,0);
		}
		if ($contractor_id==0){
			$error = 104;
			$error_msg = "Выберите контрагента";
			return array($error,$error_msg,0);
		}
		if($incoming_type==1){
			if (!filter_var($incoming, FILTER_VALIDATE_FLOAT)){
				$error = 105;
				$error_msg = "Сумма прихода указана не верно";
				return array($error,$error_msg,0);
			}
			if ($incoming<=0){
				$error = 106;
				$error_msg = "Сумма должна быть больше нуля";
				return array($error,$error_msg,0);
			}
		}else{
			if (!filter_var($consumption, FILTER_VALIDATE_FLOAT)){
				$error = 107;
				$error_msg = "Сумма расхода указана не верно";
				return array($error,$error_msg,0);
			}
			if ($consumption<=0){
				$error = 108;
				$error_msg = "Сумма должна быть больше нуля";
				return array($error,$error_msg,0);
			}
		}
		if($incoming_type==1){
			$consumption = 0;
			$order_text = 'приходный';
		}
		if($incoming_type==0){
			$incoming = 0;
			$order_text = 'расходный';
		}
		
		if($id==0){
			$insert_id = $this->database->insert('orders',array(
							   'bill_id'     			=>$bill_id,
							   'create_user_id'     	=>$this->client_id,
							   'order_date'     		=>$order_date,
							   'contractor_id'     		=>$contractor_id,
							   'incoming'     			=>$incoming,
							   'consumption'     		=>$consumption,
							   'order_type_id'     		=>$order_type_id,
							   'reduction_id'     		=>0,
							   'comment'     			=>$comment
							  ));
			if($insert_id>0){
				$this->database->query("UPDATE bills SET balance=balance+'".($incoming-$consumption)."' WHERE deleted='0' AND id=".$bill_id);
				$this->database->log('Пользователь '.$this->login.' создал '.$order_text.' ордер '.$insert_id,get_class($this).'->'.__FUNCTION__);	
				$error = 0;
				$error_msg = "OK";
				return array($error,$error_msg,$insert_id);
				//ajax::success(true);
			}else{
				$error = 109;
				$error_msg = "Ошибка создания ордера";
				return array($error,$error_msg,0);
			}
		}else{
			$sth = $this->database->query("SELECT * FROM orders WHERE id=".$id);
			$order_before = $sth->fetchAll();

$insert_id = $this->database->update('orders',array(
							   'bill_id'     			=>$bill_id,
							   'edit_user_id'     		=>$this->client_id,
							   'order_date'     		=>$order_date,
							   'contractor_id'     		=>$contractor_id,
							   'incoming'     			=>$incoming,
							   'consumption'     		=>$consumption,
							   'order_type_id'     		=>$order_type_id,
							   'comment'     			=>$comment
							  ),"id=".$id." AND reduction_id='0'");
			if($insert_id>0){
				$this->database->query("UPDATE bills SET balance=balance+'".(($incoming-$consumption)-($order_before[0]['incoming']-$order_before[0]['consumption']))."'
									   WHERE deleted='0' AND id=".$order_before[0]['bill_id']);
				$this->database->log('Пользователь '.$this->login.' изменил '.$order_text.' ордер '.$insert_id,get_class($this).'->'.__FUNCTION__);	
				$error = 0;
				$error_msg = "OK";
				return array($error,$error_msg,$insert_id);
				//ajax::success(true);
			}else{
				$error = 110;
				$error_msg = "Ошибка редактирования ордера";
				return array($error,$error_msg,0);
			}
		}
    }
    
	public function order_delete(){
		$id = isset($_POST['id'])?intval($_POST['id']):0;
		$sth=$this->database->query("SELECT incoming,consumption,bill_id FROM orders WHERE deleted='0' AND id=".$id);
		$order_before = $sth->fetchAll();
		
		$insert_id = $this->database->update('orders',array(
							   'deleted'     		=>1
							  ),"id=".$id);
			if($insert_id>0){
//				$login = session::get('login');
				$this->database->query("UPDATE bills SET balance=balance-'".($order_before[0]['incoming']-$order_before[0]['consumption'])."'
									   WHERE deleted='0' AND id=".$order_before[0]['bill_id']);
				$this->database->log('Пользователь '.$this->login.' удалил ордер '.$id,get_class($this).'->'.__FUNCTION__);	
				$error = 0;
				$error_msg = "OK";
				return array($error,$error_msg,$id);
			}else{
				$error = 100;
				$error_msg = "Ошибка удаления";
				return array($error,$error_msg,0);
			}
	}

public function order_type_create(){
		if(!$this->hasPrivilege('menu_references_order_types')){ 
			$error = 100;
			$error_msg = "Нет доступа";
			return array($error,$error_msg,0);
        }
		$data['name'] = isset($_POST['name'])?$_POST['name']:'';
		$data['incoming'] = isset($_POST['incoming'])?intval($_POST['incoming']):'1';
		$data['type'] = isset($_POST['type'])?$_POST['type']:'cont';
		$data['owner_id'] = isset($_POST['owner_id'])?intval($_POST['owner_id']):'0';
		$id = $this->database->insert('order_types',$data);		
		if($id > 0){
			if(isset($_POST['company_id']) > 0){
				$data2['company_id'] = intval($_POST['company_id']);
				$data2['order_type_id'] = $id;
				$id2 = $this->database->insert('company_order_types',$data2);
			}
			$error = 0;
			$error_msg = "OK";
			return array($error,$error_msg,$id);
		}else{
			$error = 101;
			$error_msg = "Ошибка создания категории";
			return array($error,$error_msg,0);
		}
	}

public function contractor_create(){
		if(!$this->hasPrivilege('menu_references_contractors')){ 
			$error = 100;
			$error_msg = "Нет доступа";
			return array($error,$error_msg,0);
        }
		$data['name'] = isset($_POST['name'])?$_POST['name']:'';
		$data['phone'] = isset($_POST['phone'])?$_POST['phone']:'';
		$data['type'] = isset($_POST['type'])?$_POST['type']:'cont';
		$data['email'] = isset($_POST['email'])?$_POST['email']:'0';
		$id = $this->database->insert('contractor',$data);		
		if($id > 0){
			if(isset($_POST['company_id']) > 0){
				$data2['company_id'] = intval($_POST['company_id']);
				$data2['contractor_id'] = $id;
				$id2 = $this->database->insert('company_contractor',$data2);
			}
			$error = 0;
			$error_msg = "OK";
			return array($error,$error_msg,$id);
		}else{
			$error = 101;
			$error_msg = "Ошибка создания контрагента или объекта учета";
			return array($error,$error_msg,0);
		}
	}
}

cmd: