Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed: Employee was able to download invoice for all hotels from Admin Invoice controller #940

Merged
merged 1 commit into from
Mar 15, 2024
Merged

Fixed: Employee was able to download invoice for all hotels from Admin Invoice controller #940

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions classes/order/OrderInvoice.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -887,9 +887,11 @@ public static function getByDateInterval($date_from, $date_to)
SELECT oi.*
FROM `'._DB_PREFIX_.'order_invoice` oi
LEFT JOIN `'._DB_PREFIX_.'orders` o ON (o.`id_order` = oi.`id_order`)
INNER JOIN `'._DB_PREFIX_.'htl_booking_detail` hbd ON (oi.id_order = hbd.id_order)
WHERE DATE_ADD(oi.date_add, INTERVAL -1 DAY) <= \''.pSQL($date_to).'\'
AND oi.date_add >= \''.pSQL($date_from).'\'
'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o').'
'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o')
.HotelBranchInformation::addHotelRestriction(false, 'hbd').'
AND oi.number > 0
ORDER BY oi.date_add ASC
');
Expand All @@ -908,8 +910,10 @@ public static function getByStatus($id_order_state)
SELECT oi.*
FROM `'._DB_PREFIX_.'order_invoice` oi
LEFT JOIN `'._DB_PREFIX_.'orders` o ON (o.`id_order` = oi.`id_order`)
INNER JOIN `'._DB_PREFIX_.'htl_booking_detail` hbd ON (oi.id_order = hbd.id_order)
WHERE '.(int)$id_order_state.' = o.current_state
'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o').'
'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o')
.HotelBranchInformation::addHotelRestriction(false, 'hbd').'
AND oi.number > 0
ORDER BY oi.`date_add` ASC
');
Expand Down
4 changes: 3 additions & 1 deletion controllers/admin/AdminInvoicesController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,10 +195,12 @@ public function initFormByStatus()
);

$result = Db::getInstance(_PS_USE_SQL_SLAVE_)->executeS('
SELECT COUNT( o.id_order ) AS nbOrders, o.current_state as id_order_state
SELECT COUNT(DISTINCT(o.id_order)) AS nbOrders, o.current_state as id_order_state
FROM `'._DB_PREFIX_.'order_invoice` oi
LEFT JOIN `'._DB_PREFIX_.'orders` o ON oi.id_order = o.id_order
INNER JOIN `'._DB_PREFIX_.'htl_booking_detail` hbd ON (oi.id_order = hbd.id_order)
WHERE o.id_shop IN('.implode(', ', Shop::getContextListShopID()).')
'.HotelBranchInformation::addHotelRestriction(false, 'hbd').'
AND oi.number > 0
GROUP BY o.current_state
');
Expand Down