View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt (-4 / +7 lines)
Lines 45-51 Link Here
45
45
46
[% INCLUDE 'members-toolbar.inc' %]
46
[% INCLUDE 'members-toolbar.inc' %]
47
<h1>Account for [% INCLUDE 'patron-title.inc' %]</h1>
47
<h1>Account for [% INCLUDE 'patron-title.inc' %]</h1>
48
<form action="/cgi-bin/koha/members/boraccount.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
48
<form action="/cgi-bin/koha/members/boraccount.pl" method="get">[% INCLUDE 'csrf-token.inc' %]<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
49
49
50
<!-- The manual invoice and credit buttons -->
50
<!-- The manual invoice and credit buttons -->
51
<div class="statictabs">
51
<div class="statictabs">
Lines 112-125 Link Here
112
        [% END %]
112
        [% END %]
113
        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs details-action"><i class="fa fa-list"></i> Details</a>
113
        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs details-action"><i class="fa fa-list"></i> Details</a>
114
        [% IF account.is_debit && account.amountoutstanding > 0 %]
114
        [% IF account.is_debit && account.amountoutstanding > 0 %]
115
            <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]"><i class="fa fa-money"></i> Pay</a>
115
            <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-money"></i> Pay</a>
116
        [% END %]
116
        [% END %]
117
        [% IF account.is_credit && account.status != 'VOID' %]
117
        [% IF account.is_credit && account.status != 'VOID' %]
118
          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a>
118
          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]&amp;csrf_token=[% csrf_token | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a>
119
        [% END %]
119
        [% END %]
120
        [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
120
        [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
121
          <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
121
          <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
122
            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]">
122
            [% INCLUDE 'csrf-token.inc' %]
123
            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
123
            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
124
            <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
124
            <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
125
            <button type="submit" class="btn btn-default btn-xs cancel-action">
125
            <button type="submit" class="btn btn-default btn-xs cancel-action">
Lines 174-179 Link Here
174
    <!-- Issue payout modal -->
174
    <!-- Issue payout modal -->
175
    <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel">
175
    <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel">
176
        <form  id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
176
        <form  id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
177
            [% INCLUDE 'csrf-token.inc' %]
177
            <input type="hidden" name="accountlines_id" value="" id="payoutline">
178
            <input type="hidden" name="accountlines_id" value="" id="payoutline">
178
            <input type="hidden" name="action" value="payout">
179
            <input type="hidden" name="action" value="payout">
179
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
180
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
Lines 228-233 Link Here
228
    <!-- Issue refund modal -->
229
    <!-- Issue refund modal -->
229
    <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
230
    <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
230
        <form  id="refund_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
231
        <form  id="refund_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
232
            [% INCLUDE 'csrf-token.inc' %]
231
            <input type="hidden" name="accountlines_id" value="" id="refundline">
233
            <input type="hidden" name="accountlines_id" value="" id="refundline">
232
            <input type="hidden" name="action" value="refund">
234
            <input type="hidden" name="action" value="refund">
233
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
235
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
Lines 285-290 Link Here
285
    <!-- Apply discount modal -->
287
    <!-- Apply discount modal -->
286
    <div class="modal" id="applyDiscountModal" tabindex="-1" role="dialog" aria-labelledby="applyDiscountLabel">
288
    <div class="modal" id="applyDiscountModal" tabindex="-1" role="dialog" aria-labelledby="applyDiscountLabel">
287
        <form  id="discount_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
289
        <form  id="discount_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
290
            [% INCLUDE 'csrf-token.inc' %]
288
            <input type="hidden" name="accountlines_id" value="" id="discountline">
291
            <input type="hidden" name="accountlines_id" value="" id="discountline">
289
            <input type="hidden" name="action" value="discount">
292
            <input type="hidden" name="action" value="discount">
290
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
293
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt (+1 lines)
Lines 56-61 Link Here
56
[% IF ( accounts ) %]
56
[% IF ( accounts ) %]
57
    <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
57
    <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
58
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
58
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
59
    [% INCLUDE 'csrf-token.inc' %]
59
<p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
60
<p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
60
<table id="finest">
61
<table id="finest">
61
<thead>
62
<thead>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (+4 lines)
Lines 103-108 Link Here
103
            [% END %]
103
            [% END %]
104
        </ol>
104
        </ol>
105
    </nav> <!-- /.breadcrumbs -->
105
    </nav> <!-- /.breadcrumbs -->
106
    [% INCLUDE 'blocking_errors.inc' %]
106
107
107
    [% IF ( op == 'show' ) %]
108
    [% IF ( op == 'show' ) %]
108
        <div class="main container-fluid">
109
        <div class="main container-fluid">
Lines 345-350 Link Here
345
            [% END %]
346
            [% END %]
346
347
347
            <form id="add_edit" action="suggestion.pl" method="post" class="validated">
348
            <form id="add_edit" action="suggestion.pl" method="post" class="validated">
349
                [% INCLUDE 'csrf-token.inc' %]
348
                <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
350
                <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
349
                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
351
                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
350
                [% IF ( suggestionid ) %]
352
                [% IF ( suggestionid ) %]
Lines 718-723 Link Here
718
                [% FOREACH suggestion IN suggestions %]
720
                [% FOREACH suggestion IN suggestions %]
719
                    <div id="[% suggestion.suggestiontype | html %]" role="tabpanel" class="tab-pane">
721
                    <div id="[% suggestion.suggestiontype | html %]" role="tabpanel" class="tab-pane">
720
                        <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
722
                        <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
723
                        [% INCLUDE 'csrf-token.inc' %]
721
724
722
                            [% IF ( suggestion.suggestions_loop ) %]
725
                            [% IF ( suggestion.suggestions_loop ) %]
723
                                <p>
726
                                <p>
Lines 991-996 Link Here
991
                <div class="col-sm-2 col-sm-pull-10">
994
                <div class="col-sm-2 col-sm-pull-10">
992
                    <aside>
995
                    <aside>
993
                        <form name="suggestionfilter" action="suggestion.pl" method="get">
996
                        <form name="suggestionfilter" action="suggestion.pl" method="get">
997
                            [% INCLUDE 'csrf-token.inc' %]
994
                            <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
998
                            <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
995
                            <fieldset class="brief">
999
                            <fieldset class="brief">
996
                                <ol style="display:block;">
1000
                                <ol style="display:block;">
(-)a/members/boraccount.pl (-5 / +10 lines)
Lines 69-74 output_and_exit_if_error( $input, $cookie, $template, { module => 'members', log Link Here
69
my $registerid = $input->param('registerid');
69
my $registerid = $input->param('registerid');
70
70
71
if ( $action eq 'void' ) {
71
if ( $action eq 'void' ) {
72
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
72
    my $payment_id = scalar $input->param('accountlines_id');
73
    my $payment_id = scalar $input->param('accountlines_id');
73
    my $payment    = Koha::Account::Lines->find( $payment_id );
74
    my $payment    = Koha::Account::Lines->find( $payment_id );
74
    $payment->void(
75
    $payment->void(
Lines 81-88 if ( $action eq 'void' ) { Link Here
81
}
82
}
82
83
83
if ( $action eq 'payout' ) {
84
if ( $action eq 'payout' ) {
84
    my $payment_id       = scalar $input->param('accountlines_id');
85
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
85
    my $amount           = scalar $input->param('amount');
86
    my $payment_id  = scalar $input->param('accountlines_id');
87
    my $payment     = Koha::Account::Lines->find($payment_id);
88
    my $amount      = scalar $input->param('amount');
86
    my $payout_type = scalar $input->param('payout_type');
89
    my $payout_type = scalar $input->param('payout_type');
87
    if ( $payment_id eq "" ) {
90
    if ( $payment_id eq "" ) {
88
        $schema->txn_do(
91
        $schema->txn_do(
Lines 119-127 if ( $action eq 'payout' ) { Link Here
119
}
122
}
120
123
121
if ( $action eq 'refund' ) {
124
if ( $action eq 'refund' ) {
122
    my $charge_id        = scalar $input->param('accountlines_id');
125
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
123
    my $charge           = Koha::Account::Lines->find($charge_id);
126
    my $charge_id   = scalar $input->param('accountlines_id');
124
    my $amount           = scalar $input->param('amount');
127
    my $charge      = Koha::Account::Lines->find($charge_id);
128
    my $amount      = scalar $input->param('amount');
125
    my $refund_type = scalar $input->param('refund_type');
129
    my $refund_type = scalar $input->param('refund_type');
126
    $schema->txn_do(
130
    $schema->txn_do(
127
        sub {
131
        sub {
Lines 152-157 if ( $action eq 'refund' ) { Link Here
152
}
156
}
153
157
154
if ( $action eq 'discount' ) {
158
if ( $action eq 'discount' ) {
159
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
155
    my $charge_id        = scalar $input->param('accountlines_id');
160
    my $charge_id        = scalar $input->param('accountlines_id');
156
    my $charge           = Koha::Account::Lines->find($charge_id);
161
    my $charge           = Koha::Account::Lines->find($charge_id);
157
    my $amount           = scalar $input->param('amount');
162
    my $amount           = scalar $input->param('amount');
(-)a/members/pay.pl (+7 lines)
Lines 77-95 $user ||= q{}; Link Here
77
our $branch = C4::Context->userenv->{'branch'};
77
our $branch = C4::Context->userenv->{'branch'};
78
78
79
if ( $input->param('paycollect') ) {
79
if ( $input->param('paycollect') ) {
80
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
80
    print $input->redirect(
81
    print $input->redirect(
81
        "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
82
        "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
82
}
83
}
83
elsif ( $input->param('payselected') ) {
84
elsif ( $input->param('payselected') ) {
85
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
84
    payselected({ params => \@names });
86
    payselected({ params => \@names });
85
}
87
}
86
elsif ( $input->param('writeoff_selected') ) {
88
elsif ( $input->param('writeoff_selected') ) {
89
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
87
    payselected({ params => \@names, type => 'WRITEOFF' });
90
    payselected({ params => \@names, type => 'WRITEOFF' });
88
}
91
}
89
elsif ( $input->param('woall') ) {
92
elsif ( $input->param('woall') ) {
93
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
90
    writeoff_all(@names);
94
    writeoff_all(@names);
91
}
95
}
92
elsif ( $input->param('apply_credits') ) {
96
elsif ( $input->param('apply_credits') ) {
97
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
93
    apply_credits({ patron => $patron, cgi => $input });
98
    apply_credits({ patron => $patron, cgi => $input });
94
}
99
}
95
elsif ( $input->param('confirm_writeoff') ) {
100
elsif ( $input->param('confirm_writeoff') ) {
Lines 129-137 elsif ( $input->param('confirm_writeoff') ) { Link Here
129
134
130
for (@names) {
135
for (@names) {
131
    if (/^pay_indiv_(\d+)$/) {
136
    if (/^pay_indiv_(\d+)$/) {
137
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
132
        my $line_no = $1;
138
        my $line_no = $1;
133
        redirect_to_paycollect( 'pay_individual', $line_no );
139
        redirect_to_paycollect( 'pay_individual', $line_no );
134
    } elsif (/^wo_indiv_(\d+)$/) {
140
    } elsif (/^wo_indiv_(\d+)$/) {
141
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
135
        my $line_no = $1;
142
        my $line_no = $1;
136
        redirect_to_paycollect( 'writeoff_individual', $line_no );
143
        redirect_to_paycollect( 'writeoff_individual', $line_no );
137
    }
144
    }
(-)a/members/setstatus.pl (+1 lines)
Lines 53-58 my $patron = Koha::Patrons->find( $borrowernumber ); Link Here
53
if ( $logged_in_user->can_see_patron_infos($patron) ) {
53
if ( $logged_in_user->can_see_patron_infos($patron) ) {
54
    if ( $reregistration eq 'y' ) {
54
    if ( $reregistration eq 'y' ) {
55
        # re-reregistration function to automatic calcul of date expiry
55
        # re-reregistration function to automatic calcul of date expiry
56
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
56
        $dateexpiry = $patron->renew_account;
57
        $dateexpiry = $patron->renew_account;
57
    } else {
58
    } else {
58
        my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
59
        my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
(-)a/suggestion/suggestion.pl (-3 / +5 lines)
Lines 127-132 my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch Link Here
127
##
127
##
128
128
129
if ( $op =~ /save/i ) {
129
if ( $op =~ /save/i ) {
130
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
130
    my @messages;
131
    my @messages;
131
    my $biblio = MarcRecordFromNewSuggestion({
132
    my $biblio = MarcRecordFromNewSuggestion({
132
            title => $suggestion_only->{title},
133
            title => $suggestion_only->{title},
Lines 243-249 elsif ($op=~/add/) { Link Here
243
    $op ='save';
244
    $op ='save';
244
}
245
}
245
elsif ($op=~/edit/) {
246
elsif ($op=~/edit/) {
246
    #Edit suggestion  
247
    #Edit suggestion
248
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
247
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
249
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
248
    $suggestion_ref->{reasonsloop} = $reasonsloop;
250
    $suggestion_ref->{reasonsloop} = $reasonsloop;
249
    my $other_reason = 1;
251
    my $other_reason = 1;
Lines 258-264 elsif ($op=~/edit/) { Link Here
258
    $op ='save';
260
    $op ='save';
259
}  
261
}  
260
elsif ($op eq "update_status" ) {
262
elsif ($op eq "update_status" ) {
261
263
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
262
    my $suggestion;
264
    my $suggestion;
263
    # set accepted/rejected/managed informations if applicable
265
    # set accepted/rejected/managed informations if applicable
264
    # ie= if the librarian has chosen some action on the suggestions
266
    # ie= if the librarian has chosen some action on the suggestions
Lines 295-300 elsif ($op eq "update_status" ) { Link Here
295
    }
297
    }
296
    redirect_with_params($input);
298
    redirect_with_params($input);
297
}elsif ($op eq "delete" ) {
299
}elsif ($op eq "delete" ) {
300
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
298
    foreach my $delete_field (@editsuggestions) {
301
    foreach my $delete_field (@editsuggestions) {
299
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
302
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
300
    }
303
    }
301
- 

Return to bug 22990