Attachment #67616 for bug #19117

View | Details | Raw Unified | Return to bug 19117
Collapse All | Expand All





[% IF ( pay_individual ) %]
    <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
    <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />
    <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />

    </form>
[% ELSIF ( writeoff_individual ) %]
    <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
    <fieldset class="rows">
    <legend>Write off an individual fine</legend>
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />

[% ELSE %]

    <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
    <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts %]" />
    <input type="hidden" name="total" id="total" value="[% total %]" />

Lines 31-36 use C4::Koha; Link Here

(-)a/members/paycollect.pl (-1 / +9 lines)
31	use Koha::Patron::Images;	31	use Koha::Patron::Images;
32	use Koha::Patrons;	32	use Koha::Patrons;
33	use Koha::Account;	33	use Koha::Account;
		34	use Koha::Token;
34		35
35	use Koha::Patron::Categories;	36	use Koha::Patron::Categories;
36		37
Lines 116-121 if ( $total_paid and $total_paid ne '0.00' ) { Link Here
116	total_due => $total_due	117	total_due => $total_due
117	);	118	);
118	} else {	119	} else {
		120	die "Wrong CSRF token"
		121	unless Koha::Token->new->check_csrf( {
		122	session_id => $input->cookie('CGISESSID'),
		123	token => scalar $input->param('csrf_token'),
		124	});
		125
119	if ($individual) {	126	if ($individual) {
120	my $line = Koha::Account::Lines->find($accountlines_id);	127	my $line = Koha::Account::Lines->find($accountlines_id);
121	Koha::Account->new( { patron_id => $borrowernumber } )->pay(	128	Koha::Account->new( { patron_id => $borrowernumber } )->pay(
Lines 183-188 $template->param( Link Here
183	total => $total_due,	190	total => $total_due,
184	RoutingSerials => C4::Context->preference('RoutingSerials'),	191	RoutingSerials => C4::Context->preference('RoutingSerials'),
185	ExtendedPatronAttributes => C4::Context->preference('ExtendedPatronAttributes'),	192	ExtendedPatronAttributes => C4::Context->preference('ExtendedPatronAttributes'),
		193
		194	csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
186	);	195	);
187		196
188	output_html_with_http_headers $input, $cookie, $template->output;	197	output_html_with_http_headers $input, $cookie, $template->output;
189	-

Return to bug 19117

Lines 101-106 function moneyFormat(textObj) { Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt (+3 lines)
101		101
102	[% IF ( pay_individual ) %]	102	[% IF ( pay_individual ) %]
103	<form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">	103	<form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
		104	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
104	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />	105	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
105	<input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />	106	<input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />
106	<input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />	107	<input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />
Lines 155-160 function moneyFormat(textObj) { Link Here
155	</form>	156	</form>
156	[% ELSIF ( writeoff_individual ) %]	157	[% ELSIF ( writeoff_individual ) %]
157	<form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >	158	<form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
		159	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
158	<fieldset class="rows">	160	<fieldset class="rows">
159	<legend>Write off an individual fine</legend>	161	<legend>Write off an individual fine</legend>
160	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />	162	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
Lines 195-200 function moneyFormat(textObj) { Link Here
195	[% ELSE %]	197	[% ELSE %]
196		198
197	<form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">	199	<form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
		200	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
198	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />	201	<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
199	<input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts %]" />	202	<input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts %]" />
200	<input type="hidden" name="total" id="total" value="[% total %]" />	203	<input type="hidden" name="total" id="total" value="[% total %]" />