Bug 25898: Prohibit indirect object notation
[koha.git] / acqui / cancelorder.pl
blob84d03485b51e179e7bd542a0f42ec6c52871567b
1 #!/usr/bin/perl
3 # Copyright 2014 BibLibre
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 =head1 NAME
22 cancelorder.pl
24 =head1 DESCRIPTION
26 Ask confirmation for cancelling an order line
27 and add possibility to indicate a reason for cancellation
28 (saved in aqorders.notes)
30 =cut
32 use Modern::Perl;
34 use CGI;
35 use C4::Auth;
36 use C4::Output;
37 use C4::Acquisition;
38 use Koha::Acquisition::Baskets;
40 my $input = CGI->new;
41 my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( {
42 template_name => 'acqui/cancelorder.tt',
43 query => $input,
44 type => 'intranet',
45 flagsrequired => { 'acquisition' => 'order_manage' },
46 debug => 1,
47 } );
49 my $action = $input->param('action');
50 my $ordernumber = $input->param('ordernumber');
51 my $biblionumber = $input->param('biblionumber');
52 my $basketno = $input->param('basketno');
53 my $basket = Koha::Acquisition::Baskets->find({ basketno => $basketno }, { prefetch => 'booksellerid' });
54 my $referrer = $input->param('referrer') || $input->referer;
55 my $del_biblio = $input->param('del_biblio') ? 1 : 0;
57 if($action and $action eq "confirmcancel") {
58 my $reason = $input->param('reason');
59 my $error = DelOrder($biblionumber, $ordernumber, $del_biblio, $reason);
61 if($error) {
62 $template->param(error_delitem => 1) if $error->{'delitem'};
63 $template->param(error_delbiblio => 1) if $error->{'delbiblio'};
64 } else {
65 $template->param(success_cancelorder => 1);
67 $template->param(confirmcancel => 1);
70 $template->param(
71 ordernumber => $ordernumber,
72 biblionumber => $biblionumber,
73 basket => $basket,
74 referrer => $referrer,
75 del_biblio => $del_biblio,
78 output_html_with_http_headers $input, $cookie, $template->output;