<?php
include("../include/session.php");

date_default_timezone_set('Africa/Gaborone');
$entry_date = date("Y-m-d H:i:s", time()); 

$enter_password=md5($_POST['password_text']);
$purchase_id=$_POST['purchase_id_text'];
$purchase_order=$_POST['purchase_order_text'];
$supplier_id=$_POST['supplier_id_text'];
$all_total=$_POST['all_total_text'];


$table_name = $_SESSION['db_prefix']."_users";
$password_query = "SELECT password FROM $table_name WHERE username = '".$_SESSION['username']."' ";
$password_result = mySQL_query($password_query);
$saved_password = mysql_result($password_result, 0, "password");

if ($enter_password==$saved_password) {
	  	$table_name = $_SESSION['db_prefix']."_purchase";
		$authorise_query = "UPDATE $table_name SET authorised = 'yes', authorised_date = '".$entry_date."', authorised_by = '".$_SESSION['username']."' WHERE purchase_id = '".$purchase_id."' ";
		execsql($authorise_query);
		$message=4;
		
		$table_name = $_SESSION['db_prefix']."_tracking_store";
		$trackingQuery = "INSERT INTO $table_name (entry_date, user_name, action, details_1, details_2, details_3, details_4) VALUES ('".$entry_date."' ,'".$_SESSION['username']."', '86', '".$purchase_id."', '".$supplier_id."', '".$_SESSION['username']."' ,'' )";
		$trackingResult = mySQL_query($trackingQuery);

include('../include/purchase_order_authorised_alert.php');			
		
}
else {
	  $table_name = $_SESSION['db_prefix']."_purchase";
	  $authorise_query = "UPDATE $table_name SET authorised = 'no', authorised_date = '' WHERE purchase_id = '".$purchase_id."' ";
	  execsql($authorise_query);
	  $message=5;
}

?>

<script language="javascript" type="text/javascript">
         window.location="auth_purchase_order.php?purchase_id=<?php echo $purchase_id ?>&message=<?php echo $message ?>";
</script>

