Bug 19531: When saving patron record do not redirect to circ if not authorised
[koha.git] / members / paycollect.pl
index 9525464..9ec3077 100755 (executable)
@@ -28,7 +28,12 @@ use C4::Members;
 use C4::Members::Attributes qw(GetBorrowerAttributes);
 use C4::Accounts;
 use C4::Koha;
-use C4::Branch;
+use Koha::Patron::Images;
+use Koha::Patrons;
+use Koha::Account;
+use Koha::Token;
+
+use Koha::Patron::Categories;
 
 my $input = CGI->new();
 
@@ -45,11 +50,18 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
 
 # get borrower details
 my $borrowernumber = $input->param('borrowernumber');
-my $borrower       = GetMember( borrowernumber => $borrowernumber );
+my $patron         = Koha::Patrons->find( $borrowernumber );
+unless ( $patron ) {
+    print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
+    exit;
+}
+my $borrower       = $patron->unblessed;
+my $category       = $patron->category;
+$borrower->{description} = $category->description;
+$borrower->{category_type} = $category->category_type;
 my $user           = $input->remote_user;
 
-# get account details
-my $branch = GetBranch( $input, GetBranches() );
+my $branch         = C4::Context->userenv->{'branch'};
 
 my ( $total_due, $accts, $numaccts ) = GetMemberAccountRecords($borrowernumber);
 my $total_paid = $input->param('paid');
@@ -58,9 +70,9 @@ my $individual   = $input->param('pay_individual');
 my $writeoff     = $input->param('writeoff_individual');
 my $select_lines = $input->param('selected');
 my $select       = $input->param('selected_accts');
-my $payment_note = uri_unescape $input->param('payment_note');
-my $accountno;
+my $payment_note = uri_unescape scalar $input->param('payment_note');
 my $accountlines_id;
+
 if ( $individual || $writeoff ) {
     if ($individual) {
         $template->param( pay_individual => 1 );
@@ -71,7 +83,6 @@ if ( $individual || $writeoff ) {
     $accountlines_id       = $input->param('accountlines_id');
     my $amount            = $input->param('amount');
     my $amountoutstanding = $input->param('amountoutstanding');
-    $accountno = $input->param('accountno');
     my $itemnumber  = $input->param('itemnumber');
     my $description  = $input->param('description');
     my $title        = $input->param('title');
@@ -81,12 +92,11 @@ if ( $individual || $writeoff ) {
     $template->param(
         accounttype       => $accounttype,
         accountlines_id    => $accountlines_id,
-        accountno         => $accountno,
         amount            => $amount,
         amountoutstanding => $amountoutstanding,
         title             => $title,
         itemnumber        => $itemnumber,
-        description       => $description,
+        individual_description => $description,
         notify_id         => $notify_id,
         notify_level      => $notify_level,
         payment_note    => $payment_note,
@@ -96,7 +106,7 @@ if ( $individual || $writeoff ) {
     $template->param(
         selected_accts => $select_lines,
         amt            => $total_due,
-        selected_accts_notes => $input->param('notes'),
+        selected_accts_notes => scalar $input->param('notes'),
     );
 }
 
@@ -107,14 +117,22 @@ if ( $total_paid and $total_paid ne '0.00' ) {
             total_due => $total_due
         );
     } else {
+        die "Wrong CSRF token"
+            unless Koha::Token->new->check_csrf( {
+                session_id => $input->cookie('CGISESSID'),
+                token  => scalar $input->param('csrf_token'),
+            });
+
         if ($individual) {
-            if ( $total_paid == $total_due ) {
-                makepayment( $accountlines_id, $borrowernumber, $accountno, $total_paid, $user,
-                    $branch, $payment_note );
-            } else {
-                makepartialpayment( $accountlines_id, $borrowernumber, $accountno, $total_paid,
-                    $user, $branch, $payment_note );
-            }
+            my $line = Koha::Account::Lines->find($accountlines_id);
+            Koha::Account->new( { patron_id => $borrowernumber } )->pay(
+                {
+                    lines      => [$line],
+                    amount     => $total_paid,
+                    library_id => $branch,
+                    note       => $payment_note
+                }
+            );
             print $input->redirect(
                 "/cgi-bin/koha/members/pay.pl?borrowernumber=$borrowernumber");
         } else {
@@ -124,14 +142,34 @@ if ( $total_paid and $total_paid ne '0.00' ) {
                 }
                 my @acc = split /,/, $select;
                 my $note = $input->param('selected_accts_notes');
-                recordpayment_selectaccts( $borrowernumber, $total_paid, \@acc, $note );
-            } else {
+
+                my @lines = Koha::Account::Lines->search(
+                    {
+                        borrowernumber    => $borrowernumber,
+                        amountoutstanding => { '<>' => 0 },
+                        accountlines_id   => { 'IN' => \@acc },
+                    },
+                    { order_by => 'date' }
+                );
+
+                Koha::Account->new(
+                    {
+                        patron_id => $borrowernumber,
+                    }
+                  )->pay(
+                    {
+                        amount => $total_paid,
+                        lines  => \@lines,
+                        note   => $note,
+                    }
+                  );
+            }
+            else {
                 my $note = $input->param('selected_accts_notes');
-                recordpayment( $borrowernumber, $total_paid, '', $note );
+                Koha::Account->new( { patron_id => $borrowernumber } )
+                  ->pay( { amount => $total_paid, note => $note } );
             }
 
-# recordpayment does not return success or failure so lets redisplay the boraccount
-
             print $input->redirect(
 "/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"
             );
@@ -141,48 +179,43 @@ if ( $total_paid and $total_paid ne '0.00' ) {
     $total_paid = '0.00';    #TODO not right with pay_individual
 }
 
-borrower_add_additional_fields($borrower);
+borrower_add_additional_fields($borrower, $template);
 
 $template->param(%$borrower);
 
 $template->param(
     borrowernumber => $borrowernumber,    # some templates require global
     borrower      => $borrower,
+    categoryname  => $borrower->{description},
     total         => $total_due,
-    activeBorrowerRelationship => (C4::Context->preference('borrowerRelationship') ne ''),
     RoutingSerials => C4::Context->preference('RoutingSerials'),
     ExtendedPatronAttributes => C4::Context->preference('ExtendedPatronAttributes'),
+
+    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
 );
 
 output_html_with_http_headers $input, $cookie, $template->output;
 
 sub borrower_add_additional_fields {
-    my $b_ref = shift;
+    my ( $b_ref, $template ) = @_;
 
 # some borrower info is not returned in the standard call despite being assumed
 # in a number of templates. It should not be the business of this script but in lieu of
 # a revised api here it is ...
     if ( $b_ref->{category_type} eq 'C' ) {
-        my ( $catcodes, $labels ) =
-          GetborCatFromCatType( 'A', 'WHERE category_type = ?' );
-        if ( @{$catcodes} ) {
-            if ( @{$catcodes} > 1 ) {
-                $b_ref->{CATCODE_MULTI} = 1;
-            } elsif ( @{$catcodes} == 1 ) {
-                $b_ref->{catcode} = $catcodes->[0];
-            }
-        }
-    } elsif ( $b_ref->{category_type} eq 'A' ) {
+        my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
+        $template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1;
+        $template->param( 'catcode' => $patron_categories->next )  if $patron_categories->count == 1;
+    } elsif ( $b_ref->{category_type} eq 'A' || $b_ref->{category_type} eq 'I' ) {
         $b_ref->{adultborrower} = 1;
     }
 
-    my ($picture, $dberror) = GetPatronImage($borrower->{'borrowernumber'});
-    $template->param( picture => 1 ) if $picture;
+    my $patron_image = Koha::Patron::Images->find($b_ref->{borrowernumber});
+    $template->param( picture => 1 ) if $patron_image;
 
     if (C4::Context->preference('ExtendedPatronAttributes')) {
-        $b_ref->{extendedattributes} = GetBorrowerAttributes($borrowernumber);
+        $b_ref->{extendedattributes} = GetBorrowerAttributes($b_ref->{borrowernumber});
     }
 
-    $b_ref->{branchname} = GetBranchName( $b_ref->{branchcode} );
     return;
 }