Bug 19086 XSS in members/member.pl
[koha.git] / members / paycollect.pl
blobbc540992835531ebc6389aa8e84d3ce02e3cf462
1 #!/usr/bin/perl
2 # Copyright 2009,2010 PTFS Inc.
3 # Copyright 2011 PTFS-Europe Ltd
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use strict;
21 use warnings;
22 use URI::Escape;
23 use C4::Context;
24 use C4::Auth;
25 use C4::Output;
26 use CGI qw ( -utf8 );
27 use C4::Members;
28 use C4::Members::Attributes qw(GetBorrowerAttributes);
29 use C4::Accounts;
30 use C4::Koha;
31 use Koha::Patron::Images;
32 use Koha::Account;
34 use Koha::Patron::Categories;
36 my $input = CGI->new();
38 my $updatecharges_permissions = $input->param('writeoff_individual') ? 'writeoff' : 'remaining_permissions';
39 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
40 { template_name => 'members/paycollect.tt',
41 query => $input,
42 type => 'intranet',
43 authnotrequired => 0,
44 flagsrequired => { borrowers => 1, updatecharges => $updatecharges_permissions },
45 debug => 1,
49 # get borrower details
50 my $borrowernumber = $input->param('borrowernumber');
51 my $borrower = GetMember( borrowernumber => $borrowernumber );
52 my $user = $input->remote_user;
54 my $branch = C4::Context->userenv->{'branch'};
56 my ( $total_due, $accts, $numaccts ) = GetMemberAccountRecords($borrowernumber);
57 my $total_paid = $input->param('paid');
59 my $individual = $input->param('pay_individual');
60 my $writeoff = $input->param('writeoff_individual');
61 my $select_lines = $input->param('selected');
62 my $select = $input->param('selected_accts');
63 my $payment_note = uri_unescape $input->param('payment_note');
64 my $accountlines_id;
66 if ( $individual || $writeoff ) {
67 if ($individual) {
68 $template->param( pay_individual => 1 );
69 } elsif ($writeoff) {
70 $template->param( writeoff_individual => 1 );
72 my $accounttype = $input->param('accounttype');
73 $accountlines_id = $input->param('accountlines_id');
74 my $amount = $input->param('amount');
75 my $amountoutstanding = $input->param('amountoutstanding');
76 my $itemnumber = $input->param('itemnumber');
77 my $description = $input->param('description');
78 my $title = $input->param('title');
79 my $notify_id = $input->param('notify_id');
80 my $notify_level = $input->param('notify_level');
81 $total_due = $amountoutstanding;
82 $template->param(
83 accounttype => $accounttype,
84 accountlines_id => $accountlines_id,
85 amount => $amount,
86 amountoutstanding => $amountoutstanding,
87 title => $title,
88 itemnumber => $itemnumber,
89 individual_description => $description,
90 notify_id => $notify_id,
91 notify_level => $notify_level,
92 payment_note => $payment_note,
94 } elsif ($select_lines) {
95 $total_due = $input->param('amt');
96 $template->param(
97 selected_accts => $select_lines,
98 amt => $total_due,
99 selected_accts_notes => scalar $input->param('notes'),
103 if ( $total_paid and $total_paid ne '0.00' ) {
104 if ( $total_paid < 0 or $total_paid > $total_due ) {
105 $template->param(
106 error_over => 1,
107 total_due => $total_due
109 } else {
110 if ($individual) {
111 my $line = Koha::Account::Lines->find($accountlines_id);
112 Koha::Account->new( { patron_id => $borrowernumber } )->pay(
114 lines => [$line],
115 amount => $total_paid,
116 library_id => $branch,
117 note => $payment_note
120 print $input->redirect(
121 "/cgi-bin/koha/members/pay.pl?borrowernumber=$borrowernumber");
122 } else {
123 if ($select) {
124 if ( $select =~ /^([\d,]*).*/ ) {
125 $select = $1; # ensure passing no junk
127 my @acc = split /,/, $select;
128 my $note = $input->param('selected_accts_notes');
130 my @lines = Koha::Account::Lines->search(
132 borrowernumber => $borrowernumber,
133 amountoutstanding => { '<>' => 0 },
134 accountlines_id => { 'IN' => \@acc },
136 { order_by => 'date' }
139 Koha::Account->new(
141 patron_id => $borrowernumber,
143 )->pay(
145 amount => $total_paid,
146 lines => \@lines,
147 note => $note,
151 else {
152 my $note = $input->param('selected_accts_notes');
153 Koha::Account->new( { patron_id => $borrowernumber } )
154 ->pay( { amount => $total_paid, note => $note } );
157 print $input->redirect(
158 "/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"
162 } else {
163 $total_paid = '0.00'; #TODO not right with pay_individual
166 borrower_add_additional_fields($borrower, $template);
168 $template->param(%$borrower);
170 $template->param(
171 borrowernumber => $borrowernumber, # some templates require global
172 borrower => $borrower,
173 categoryname => $borrower->{description},
174 total => $total_due,
175 RoutingSerials => C4::Context->preference('RoutingSerials'),
176 ExtendedPatronAttributes => C4::Context->preference('ExtendedPatronAttributes'),
179 output_html_with_http_headers $input, $cookie, $template->output;
181 sub borrower_add_additional_fields {
182 my ( $b_ref, $template ) = @_;
184 # some borrower info is not returned in the standard call despite being assumed
185 # in a number of templates. It should not be the business of this script but in lieu of
186 # a revised api here it is ...
187 if ( $b_ref->{category_type} eq 'C' ) {
188 my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
189 $template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1;
190 $template->param( 'catcode' => $patron_categories->next ) if $patron_categories->count == 1;
191 } elsif ( $b_ref->{category_type} eq 'A' || $b_ref->{category_type} eq 'I' ) {
192 $b_ref->{adultborrower} = 1;
195 my $patron_image = Koha::Patron::Images->find($b_ref->{borrowernumber});
196 $template->param( picture => 1 ) if $patron_image;
198 if (C4::Context->preference('ExtendedPatronAttributes')) {
199 $b_ref->{extendedattributes} = GetBorrowerAttributes($b_ref->{borrowernumber});
202 return;