X-Git-Url: http://git.rot13.org/?a=blobdiff_plain;f=members%2Fmaninvoice.pl;h=db7a447ffa464aaca14fae465ba135cb32a6ac14;hb=a3036b4760d80dd3d2188f5f95c6f4279ecef74b;hp=ff0b9ff5be70f9bf3d3e7b48ade0034428ea7173;hpb=c84b638d013a46ad4170f5ac73fe82c018fd2e07;p=koha.git diff --git a/members/maninvoice.pl b/members/maninvoice.pl index ff0b9ff5be..db7a447ffa 100755 --- a/members/maninvoice.pl +++ b/members/maninvoice.pl @@ -1,81 +1,111 @@ #!/usr/bin/perl -#wrriten 11/1/2000 by chris@katipo.oc.nz +#written 11/1/2000 by chris@katipo.oc.nz #script to display borrowers account details # Copyright 2000-2002 Katipo Communications +# Copyright 2010 BibLibre # # This file is part of Koha. # -# Koha is free software; you can redistribute it and/or modify it under the -# terms of the GNU General Public License as published by the Free Software -# Foundation; either version 2 of the License, or (at your option) any later -# version. +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. # -# Koha is distributed in the hope that it will be useful, but WITHOUT ANY -# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR -# A PARTICULAR PURPOSE. See the GNU General Public License for more details. +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. # -# You should have received a copy of the GNU General Public License along with -# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place, -# Suite 330, Boston, MA 02111-1307 USA +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; -use strict; use C4::Auth; use C4::Output; -use CGI; +use CGI qw ( -utf8 ); use C4::Members; use C4::Accounts; use C4::Items; -use C4::Branch; +use C4::Members::Attributes qw(GetBorrowerAttributes); +use Koha::Token; + +use Koha::Items; +use Koha::Patrons; + +use Koha::Patron::Categories; my $input=new CGI; +my $flagsrequired = { borrowers => 'edit_borrowers' }; my $borrowernumber=$input->param('borrowernumber'); +my $patron = Koha::Patrons->find( $borrowernumber ); +unless ( $patron ) { + print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); + exit; +} -# get borrower details -my $data=GetMember($borrowernumber,'borrowernumber'); my $add=$input->param('add'); if ($add){ -# print $input->header; - my $barcode=$input->param('barcode'); - my $itemnum = GetItemnumberFromBarcode($barcode) if $barcode; - my $desc=$input->param('desc'); - my $amount=$input->param('amount'); - my $type=$input->param('type'); - my $error=manualinvoice($borrowernumber,$itemnum,$desc,$type,$amount); - if ($error){ - my ($template, $loggedinuser, $cookie) - = get_template_and_user({template_name => "members/maninvoice.tmpl", - query => $input, - type => "intranet", - authnotrequired => 0, - flagsrequired => {borrowers => 1}, - debug => 1, - }); - if ($error =~ /FOREIGN KEY/ && $error =~ /itemnumber/){ - $template->param('ITEMNUMBER' => 1); - } - $template->param('ERROR' => $error); - output_html_with_http_headers $input, $cookie, $template->output; - } - else { - print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"); - exit; - } + if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) { + die "Wrong CSRF token" + unless Koha::Token->new->check_csrf( { + session_id => scalar $input->cookie('CGISESSID'), + token => scalar $input->param('csrf_token'), + }); + # Note: If the logged in user is not allowed to see this patron an invoice can be forced + # Here we are trusting librarians not to hack the system + my $barcode=$input->param('barcode'); + my $itemnum; + if ($barcode) { + my $item = Koha::Items->find({barcode => $barcode}); + $itemnum = $item->itemnumber if $item; + } + my $desc=$input->param('desc'); + my $amount=$input->param('amount'); + my $type=$input->param('type'); + my $note = $input->param('note'); + my $error = manualinvoice( $borrowernumber, $itemnum, $desc, $type, $amount, $note ); + if ($error) { + my ( $template, $loggedinuser, $cookie ) = get_template_and_user( + { template_name => "members/maninvoice.tt", + query => $input, + type => "intranet", + authnotrequired => 0, + flagsrequired => $flagsrequired, + debug => 1, + } + ); + if ( $error =~ /FOREIGN KEY/ && $error =~ /itemnumber/ ) { + $template->param( 'ITEMNUMBER' => 1 ); + } + $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }) ); + $template->param( 'ERROR' => $error ); + output_html_with_http_headers $input, $cookie, $template->output; + } else { + print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"); + exit; + } + } } else { - my ($template, $loggedinuser, $cookie) - = get_template_and_user({template_name => "members/maninvoice.tmpl", - query => $input, - type => "intranet", - authnotrequired => 0, - flagsrequired => {borrowers => 1, updatecharges => 1}, - debug => 1, - }); - + my ($template, $loggedinuser, $cookie) = get_template_and_user({ + template_name => "members/maninvoice.tt", + query => $input, + type => "intranet", + authnotrequired => 0, + flagsrequired => { borrowers => 'edit_borrowers', + updatecharges => 'remaining_permissions' }, + debug => 1, + }); + + my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; + output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); + # get authorised values with type of MANUAL_INV my @invoice_types; my $dbh = C4::Context->dbh; @@ -86,35 +116,18 @@ if ($add){ } $template->param( invoice_types_loop => \@invoice_types ); - if ( $data->{'category_type'} eq 'C') { - my ( $catcodes, $labels ) = GetborCatFromCatType( 'A', 'WHERE category_type = ?' ); - my $cnt = scalar(@$catcodes); - $template->param( 'CATCODE_MULTI' => 1) if $cnt > 1; - $template->param( 'catcode' => $catcodes->[0]) if $cnt == 1; + if (C4::Context->preference('ExtendedPatronAttributes')) { + my $attributes = GetBorrowerAttributes($borrowernumber); + $template->param( + ExtendedPatronAttributes => 1, + extendedattributes => $attributes + ); } - $template->param( adultborrower => 1 ) if ( $data->{'category_type'} eq 'A' ); - my ($picture, $dberror) = GetPatronImage($data->{'cardnumber'}); - $template->param( picture => 1 ) if $picture; - - $template->param( - borrowernumber => $borrowernumber, - firstname => $data->{'firstname'}, - surname => $data->{'surname'}, - cardnumber => $data->{'cardnumber'}, - categorycode => $data->{'categorycode'}, - category_type => $data->{'category_type'}, - categoryname => $data->{'description'}, - address => $data->{'address'}, - address2 => $data->{'address2'}, - city => $data->{'city'}, - zipcode => $data->{'zipcode'}, - country => $data->{'country'}, - phone => $data->{'phone'}, - email => $data->{'email'}, - branchcode => $data->{'branchcode'}, - branchname => GetBranchName($data->{'branchcode'}), - is_child => ($data->{'category_type'} eq 'C'), + $template->param( + csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }), + patron => $patron, + finesview => 1, ); output_html_with_http_headers $input, $cookie, $template->output; }