addresses vulnerabilities reported at http://secunia.com/advisories/22695
[openemr.git] / interface / drugs / drug_inventory.php
blob92b2f450e0c52400862a1832cfbe8f2b91d59173
1 <?php
2 // Copyright (C) 2006 Rod Roark <rod@sunsetsystems.com>
3 //
4 // This program is free software; you can redistribute it and/or
5 // modify it under the terms of the GNU General Public License
6 // as published by the Free Software Foundation; either version 2
7 // of the License, or (at your option) any later version.
9 require_once("../globals.php");
10 require_once("$srcdir/acl.inc");
11 require_once("drugs.inc.php");
13 // Check authorization.
14 $thisauth = acl_check('admin', 'drugs');
15 if (!$thisauth) die("Not authorized.");
17 // get drugs
18 $res = sqlStatement("SELECT d.*, " .
19 "di.inventory_id, di.lot_number, di.expiration, di.manufacturer, di.on_hand " .
20 "FROM drugs AS d " .
21 "LEFT OUTER JOIN drug_inventory AS di ON di.drug_id = d.drug_id " .
22 "AND di.on_hand != 0 AND di.destroy_date IS NULL " .
23 "ORDER BY d.name, d.drug_id, di.expiration, di.lot_number");
25 <html>
27 <head>
29 <link rel=stylesheet href='<?php echo $css_header ?>' type='text/css'>
30 <title><?php xl('Drug Inventory','e'); ?></title>
32 <style>
33 tr.head { font-size:10pt; background-color:#cccccc; text-align:center; }
34 tr.detail { font-size:10pt; }
35 a, a:visited, a:hover { color:#0000cc; }
36 </style>
38 <script type="text/javascript" src="../../library/dialog.js"></script>
40 <script language="JavaScript">
42 // callback from add_edit_drug.php or add_edit_drug_inventory.php:
43 function refreshme() {
44 location.reload();
47 // Process click on drug title.
48 function dodclick(id) {
49 dlgopen('add_edit_drug.php?drug=' + id, '_blank', 600, 475);
52 // Process click on drug QOO or lot.
53 function doiclick(id, lot) {
54 dlgopen('add_edit_lot.php?drug=' + id + '&lot=' + lot, '_blank', 600, 475);
57 </script>
59 </head>
61 <body <?php echo $top_bg_line;?>>
62 <form method='post' action='drug_inventory.php'>
64 <table width='100%' cellpadding='1' cellspacing='2'>
65 <tr class='head'>
66 <td title='Click to edit'><?php xl('Name','e'); ?></td>
67 <td><?php xl('NDC','e'); ?></td>
68 <td><?php xl('Form','e'); ?></td>
69 <td><?php xl('Size','e'); ?></td>
70 <td><?php xl('Unit','e'); ?></td>
71 <td title='Click to receive (add) new lot'><?php xl('Add','e'); ?></td>
72 <td title='Click to edit'><?php xl('Lot','e'); ?></td>
73 <td><?php xl('QOH','e'); ?></td>
74 <td><?php xl('Expires','e'); ?></td>
75 </tr>
76 <?php
77 $lastid = "";
78 $encount = 0;
79 while ($row = sqlFetchArray($res)) {
80 if ($lastid != $row['drug_id']) {
81 ++$encount;
82 $bgcolor = "#" . (($encount & 1) ? "ddddff" : "ffdddd");
83 $lastid = $row['drug_id'];
84 echo " <tr class='detail' bgcolor='$bgcolor'>\n";
85 echo " <td onclick='dodclick($lastid)'>" .
86 "<a href='' onclick='return false'>" .
87 htmlentities($row['name']) . "</a></td>\n";
88 echo " <td>" . htmlentities($row['ndc_number']) . "</td>\n";
89 echo " <td>" . $form_array[$row['form']] . "</td>\n";
90 echo " <td>" . $row['size'] . "</td>\n";
91 echo " <td>" . $unit_array[$row['unit']] . "</td>\n";
92 echo " <td onclick='doiclick($lastid,0)'>" .
93 "<a href='' onclick='return false'>Add</a></td>\n";
94 } else {
95 echo " <tr class='detail' bgcolor='$bgcolor'>\n";
96 echo " <td colspan='6'>&nbsp;</td>\n";
98 if ($row['lot_number']) {
99 $lot_number = htmlentities($row['lot_number']);
100 echo " <td onclick='doiclick($lastid," . $row['inventory_id'] . ")'>" .
101 "<a href='' onclick='return false'>$lot_number</a></td>\n";
102 echo " <td>" . $row['on_hand'] . "</td>\n";
103 echo " <td>" . $row['expiration'] . "</td>\n";
104 } else {
105 echo " <td colspan='3'>&nbsp;</td>\n";
107 echo " </tr>\n";
108 } // end while
110 </table>
112 <center><p>
113 <input type='button' value='<?php xl('Add Drug','e'); ?>' onclick='dodclick(0)' style='background-color:transparent' />
114 </p></center>
116 </form>
117 </body>
118 </html>