View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/acqui/basketheader.pl (+3 lines)
Lines 141-146 if ( $op eq 'add_form' ) { Link Here
141
#End Edit
141
#End Edit
142
} elsif ( $op eq 'add_validate' ) {
142
} elsif ( $op eq 'add_validate' ) {
143
#we are confirming the changes, save the basket
143
#we are confirming the changes, save the basket
144
#we are checking CSRF Token.
145
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
146
144
    if ( $is_an_edit ) {
147
    if ( $is_an_edit ) {
145
        ModBasketHeader(
148
        ModBasketHeader(
146
            $basketno,
149
            $basketno,
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt (-1 / +2 lines)
Lines 50-62 Link Here
50
<div class="main container-fluid">
50
<div class="main container-fluid">
51
    <div class="row">
51
    <div class="row">
52
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
52
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
53
53
    [% INCLUDE 'blocking_errors.inc' %]
54
    [% IF ( add_form ) %]
54
    [% IF ( add_form ) %]
55
        [% IF ( basketno ) %]
55
        [% IF ( basketno ) %]
56
            <h1>Edit basket [% basketname | html %]</h1>
56
            <h1>Edit basket [% basketname | html %]</h1>
57
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
57
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
58
        [% END %]
58
        [% END %]
59
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
59
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
60
        [% INCLUDE 'csrf-token.inc' %]
60
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
61
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
61
        <fieldset class="rows">
62
        <fieldset class="rows">
62
            <ol>
63
            <ol>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt (-4 / +7 lines)
Lines 45-51 Link Here
45
45
46
[% INCLUDE 'members-toolbar.inc' %]
46
[% INCLUDE 'members-toolbar.inc' %]
47
<h1>Account for [% INCLUDE 'patron-title.inc' %]</h1>
47
<h1>Account for [% INCLUDE 'patron-title.inc' %]</h1>
48
<form action="/cgi-bin/koha/members/boraccount.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
48
<form action="/cgi-bin/koha/members/boraccount.pl" method="get">[% INCLUDE 'csrf-token.inc' %]<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
49
49
50
<!-- The manual invoice and credit buttons -->
50
<!-- The manual invoice and credit buttons -->
51
<div class="statictabs">
51
<div class="statictabs">
Lines 116-129 Link Here
116
        [% END %]
116
        [% END %]
117
        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs details-action"><i class="fa fa-list"></i> Details</a>
117
        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs details-action"><i class="fa fa-list"></i> Details</a>
118
        [% IF account.is_debit && account.amountoutstanding > 0 %]
118
        [% IF account.is_debit && account.amountoutstanding > 0 %]
119
            <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]"><i class="fa fa-money"></i> Pay</a>
119
            <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-money"></i> Pay</a>
120
        [% END %]
120
        [% END %]
121
        [% IF account.is_credit && account.status != 'VOID' %]
121
        [% IF account.is_credit && account.status != 'VOID' %]
122
          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a>
122
          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]&amp;csrf_token=[% csrf_token | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a>
123
        [% END %]
123
        [% END %]
124
        [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
124
        [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
125
          <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
125
          <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
126
            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]">
126
            [% INCLUDE 'csrf-token.inc' %]
127
            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
127
            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]">
128
            <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
128
            <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]">
129
            <button type="submit" class="btn btn-default btn-xs cancel-action">
129
            <button type="submit" class="btn btn-default btn-xs cancel-action">
Lines 178-183 Link Here
178
    <!-- Issue payout modal -->
178
    <!-- Issue payout modal -->
179
    <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel">
179
    <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel">
180
        <form  id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
180
        <form  id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
181
            [% INCLUDE 'csrf-token.inc' %]
181
            <input type="hidden" name="accountlines_id" value="" id="payoutline">
182
            <input type="hidden" name="accountlines_id" value="" id="payoutline">
182
            <input type="hidden" name="action" value="payout">
183
            <input type="hidden" name="action" value="payout">
183
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
184
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
Lines 232-237 Link Here
232
    <!-- Issue refund modal -->
233
    <!-- Issue refund modal -->
233
    <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
234
    <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
234
        <form  id="refund_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
235
        <form  id="refund_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
236
            [% INCLUDE 'csrf-token.inc' %]
235
            <input type="hidden" name="accountlines_id" value="" id="refundline">
237
            <input type="hidden" name="accountlines_id" value="" id="refundline">
236
            <input type="hidden" name="action" value="refund">
238
            <input type="hidden" name="action" value="refund">
237
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
239
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
Lines 289-294 Link Here
289
    <!-- Apply discount modal -->
291
    <!-- Apply discount modal -->
290
    <div class="modal" id="applyDiscountModal" tabindex="-1" role="dialog" aria-labelledby="applyDiscountLabel">
292
    <div class="modal" id="applyDiscountModal" tabindex="-1" role="dialog" aria-labelledby="applyDiscountLabel">
291
        <form  id="discount_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
293
        <form  id="discount_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated">
294
            [% INCLUDE 'csrf-token.inc' %]
292
            <input type="hidden" name="accountlines_id" value="" id="discountline">
295
            <input type="hidden" name="accountlines_id" value="" id="discountline">
293
            <input type="hidden" name="action" value="discount">
296
            <input type="hidden" name="action" value="discount">
294
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
297
            <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt (+1 lines)
Lines 60-65 Link Here
60
[% IF ( accounts ) %]
60
[% IF ( accounts ) %]
61
    <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
61
    <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
62
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
62
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
63
    [% INCLUDE 'csrf-token.inc' %]
63
<p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
64
<p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
64
<table id="finest">
65
<table id="finest">
65
<thead>
66
<thead>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (+4 lines)
Lines 103-108 Link Here
103
            [% END %]
103
            [% END %]
104
        </ol>
104
        </ol>
105
    </nav> <!-- /.breadcrumbs -->
105
    </nav> <!-- /.breadcrumbs -->
106
    [% INCLUDE 'blocking_errors.inc' %]
106
107
107
    [% IF ( op == 'show' ) %]
108
    [% IF ( op == 'show' ) %]
108
        <div class="main container-fluid">
109
        <div class="main container-fluid">
Lines 351-356 Link Here
351
            [% END %]
352
            [% END %]
352
353
353
            <form id="add_edit" action="suggestion.pl" method="post" class="validated">
354
            <form id="add_edit" action="suggestion.pl" method="post" class="validated">
355
                [% INCLUDE 'csrf-token.inc' %]
354
                <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
356
                <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
355
                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
357
                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
356
                [% IF ( suggestionid ) %]
358
                [% IF ( suggestionid ) %]
Lines 732-737 Link Here
732
                    <div id="[% suggestion.suggestiontype | html %]">
734
                    <div id="[% suggestion.suggestiontype | html %]">
733
                    [% END %]
735
                    [% END %]
734
                        <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
736
                        <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
737
                        [% INCLUDE 'csrf-token.inc' %]
735
738
736
                            [% IF suggestion.suggestions.size %]
739
                            [% IF suggestion.suggestions.size %]
737
                                <p>
740
                                <p>
Lines 1002-1007 Link Here
1002
                <div class="col-sm-2 col-sm-pull-10">
1005
                <div class="col-sm-2 col-sm-pull-10">
1003
                    <aside>
1006
                    <aside>
1004
                        <form name="suggestionfilter" action="suggestion.pl" method="get">
1007
                        <form name="suggestionfilter" action="suggestion.pl" method="get">
1008
                            [% INCLUDE 'csrf-token.inc' %]
1005
                            <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1009
                            <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1006
                            <fieldset class="brief">
1010
                            <fieldset class="brief">
1007
                                <ol style="display:block;">
1011
                                <ol style="display:block;">
(-)a/members/boraccount.pl (-5 / +10 lines)
Lines 69-74 output_and_exit_if_error( $input, $cookie, $template, { module => 'members', log Link Here
69
my $registerid = $input->param('registerid');
69
my $registerid = $input->param('registerid');
70
70
71
if ( $action eq 'void' ) {
71
if ( $action eq 'void' ) {
72
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
72
    my $payment_id = scalar $input->param('accountlines_id');
73
    my $payment_id = scalar $input->param('accountlines_id');
73
    my $payment    = Koha::Account::Lines->find( $payment_id );
74
    my $payment    = Koha::Account::Lines->find( $payment_id );
74
    $payment->void(
75
    $payment->void(
Lines 81-88 if ( $action eq 'void' ) { Link Here
81
}
82
}
82
83
83
if ( $action eq 'payout' ) {
84
if ( $action eq 'payout' ) {
84
    my $payment_id       = scalar $input->param('accountlines_id');
85
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
85
    my $amount           = scalar $input->param('amount');
86
    my $payment_id  = scalar $input->param('accountlines_id');
87
    my $payment     = Koha::Account::Lines->find($payment_id);
88
    my $amount      = scalar $input->param('amount');
86
    my $payout_type = scalar $input->param('payout_type');
89
    my $payout_type = scalar $input->param('payout_type');
87
    if ( $payment_id eq "" ) {
90
    if ( $payment_id eq "" ) {
88
        $schema->txn_do(
91
        $schema->txn_do(
Lines 119-127 if ( $action eq 'payout' ) { Link Here
119
}
122
}
120
123
121
if ( $action eq 'refund' ) {
124
if ( $action eq 'refund' ) {
122
    my $charge_id        = scalar $input->param('accountlines_id');
125
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
123
    my $charge           = Koha::Account::Lines->find($charge_id);
126
    my $charge_id   = scalar $input->param('accountlines_id');
124
    my $amount           = scalar $input->param('amount');
127
    my $charge      = Koha::Account::Lines->find($charge_id);
128
    my $amount      = scalar $input->param('amount');
125
    my $refund_type = scalar $input->param('refund_type');
129
    my $refund_type = scalar $input->param('refund_type');
126
    $schema->txn_do(
130
    $schema->txn_do(
127
        sub {
131
        sub {
Lines 152-157 if ( $action eq 'refund' ) { Link Here
152
}
156
}
153
157
154
if ( $action eq 'discount' ) {
158
if ( $action eq 'discount' ) {
159
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
155
    my $charge_id        = scalar $input->param('accountlines_id');
160
    my $charge_id        = scalar $input->param('accountlines_id');
156
    my $charge           = Koha::Account::Lines->find($charge_id);
161
    my $charge           = Koha::Account::Lines->find($charge_id);
157
    my $amount           = scalar $input->param('amount');
162
    my $amount           = scalar $input->param('amount');
(-)a/members/pay.pl (+7 lines)
Lines 77-95 $user ||= q{}; Link Here
77
our $branch = C4::Context->userenv->{'branch'};
77
our $branch = C4::Context->userenv->{'branch'};
78
78
79
if ( $input->param('paycollect') ) {
79
if ( $input->param('paycollect') ) {
80
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
80
    print $input->redirect(
81
    print $input->redirect(
81
        "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
82
        "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
82
}
83
}
83
elsif ( $input->param('payselected') ) {
84
elsif ( $input->param('payselected') ) {
85
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
84
    payselected({ params => \@names });
86
    payselected({ params => \@names });
85
}
87
}
86
elsif ( $input->param('writeoff_selected') ) {
88
elsif ( $input->param('writeoff_selected') ) {
89
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
87
    payselected({ params => \@names, type => 'WRITEOFF' });
90
    payselected({ params => \@names, type => 'WRITEOFF' });
88
}
91
}
89
elsif ( $input->param('woall') ) {
92
elsif ( $input->param('woall') ) {
93
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
90
    writeoff_all(@names);
94
    writeoff_all(@names);
91
}
95
}
92
elsif ( $input->param('apply_credits') ) {
96
elsif ( $input->param('apply_credits') ) {
97
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
93
    apply_credits({ patron => $patron, cgi => $input });
98
    apply_credits({ patron => $patron, cgi => $input });
94
}
99
}
95
elsif ( $input->param('confirm_writeoff') ) {
100
elsif ( $input->param('confirm_writeoff') ) {
Lines 129-137 elsif ( $input->param('confirm_writeoff') ) { Link Here
129
134
130
for (@names) {
135
for (@names) {
131
    if (/^pay_indiv_(\d+)$/) {
136
    if (/^pay_indiv_(\d+)$/) {
137
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
132
        my $line_no = $1;
138
        my $line_no = $1;
133
        redirect_to_paycollect( 'pay_individual', $line_no );
139
        redirect_to_paycollect( 'pay_individual', $line_no );
134
    } elsif (/^wo_indiv_(\d+)$/) {
140
    } elsif (/^wo_indiv_(\d+)$/) {
141
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
135
        my $line_no = $1;
142
        my $line_no = $1;
136
        redirect_to_paycollect( 'writeoff_individual', $line_no );
143
        redirect_to_paycollect( 'writeoff_individual', $line_no );
137
    }
144
    }
(-)a/members/setstatus.pl (+1 lines)
Lines 53-58 my $patron = Koha::Patrons->find( $borrowernumber ); Link Here
53
if ( $logged_in_user->can_see_patron_infos($patron) ) {
53
if ( $logged_in_user->can_see_patron_infos($patron) ) {
54
    if ( $reregistration eq 'y' ) {
54
    if ( $reregistration eq 'y' ) {
55
        # re-reregistration function to automatic calcul of date expiry
55
        # re-reregistration function to automatic calcul of date expiry
56
        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
56
        $dateexpiry = $patron->renew_account;
57
        $dateexpiry = $patron->renew_account;
57
    } else {
58
    } else {
58
        my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
59
        my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
(-)a/suggestion/suggestion.pl (-3 / +5 lines)
Lines 133-138 my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch Link Here
133
##
133
##
134
134
135
if ( $op =~ /save/i ) {
135
if ( $op =~ /save/i ) {
136
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
136
    my @messages;
137
    my @messages;
137
    my $biblio = MarcRecordFromNewSuggestion({
138
    my $biblio = MarcRecordFromNewSuggestion({
138
            title => $suggestion_only->{title},
139
            title => $suggestion_only->{title},
Lines 250-256 elsif ($op=~/add/) { Link Here
250
    $op ='save';
251
    $op ='save';
251
}
252
}
252
elsif ($op=~/edit/) {
253
elsif ($op=~/edit/) {
253
    #Edit suggestion  
254
    #Edit suggestion
255
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
254
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
256
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
255
    $suggestion_ref->{reasonsloop} = $reasonsloop;
257
    $suggestion_ref->{reasonsloop} = $reasonsloop;
256
    my $other_reason = 1;
258
    my $other_reason = 1;
Lines 265-271 elsif ($op=~/edit/) { Link Here
265
    $op ='save';
267
    $op ='save';
266
}  
268
}  
267
elsif ($op eq "update_status" ) {
269
elsif ($op eq "update_status" ) {
268
270
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
269
    my $suggestion;
271
    my $suggestion;
270
    # set accepted/rejected/managed informations if applicable
272
    # set accepted/rejected/managed informations if applicable
271
    # ie= if the librarian has chosen some action on the suggestions
273
    # ie= if the librarian has chosen some action on the suggestions
Lines 302-307 elsif ($op eq "update_status" ) { Link Here
302
    }
304
    }
303
    redirect_with_params($input);
305
    redirect_with_params($input);
304
}elsif ($op eq "delete" ) {
306
}elsif ($op eq "delete" ) {
307
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
305
    foreach my $delete_field (@editsuggestions) {
308
    foreach my $delete_field (@editsuggestions) {
306
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
309
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
307
    }
310
    }
308
- 

Return to bug 22990