View | Details | Raw Unified | Return to bug 21702
Collapse All | Expand All

(-)a/members/mancredit.pl (-49 / +42 lines)
Lines 33-105 use C4::Accounts; Link Here
33
use C4::Items;
33
use C4::Items;
34
use C4::Members::Attributes qw(GetBorrowerAttributes);
34
use C4::Members::Attributes qw(GetBorrowerAttributes);
35
35
36
use Koha::Account;
37
use Koha::Items;
36
use Koha::Items;
38
use Koha::Patrons;
37
use Koha::Patrons;
39
use Koha::Patron::Categories;
38
use Koha::Patron::Categories;
40
use Koha::Token;
39
use Koha::Token;
41
40
42
my $input=new CGI;
41
my $input=new CGI;
43
my $flagsrequired = { borrowers => 'edit_borrowers', updatecharges => 1 };
44
42
45
my $borrowernumber=$input->param('borrowernumber');
43
my ($template, $loggedinuser, $cookie) = get_template_and_user(
44
    {
45
        template_name   => "members/mancredit.tt",
46
        query           => $input,
47
        type            => "intranet",
48
        authnotrequired => 0,
49
        flagsrequired   => { borrowers     => 'edit_borrowers',
50
                             updatecharges => 'remaining_permissions' }
51
    }
52
);
53
54
my $logged_in_user = Koha::Patrons->find($loggedinuser) or die "Not logged in";
55
my $borrowernumber = $input->param('borrowernumber');
56
my $patron         = Koha::Patrons->find($borrowernumber);
46
57
47
my $patron = Koha::Patrons->find( $borrowernumber );
48
unless ( $patron ) {
58
unless ( $patron ) {
49
    print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
59
    print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
50
    exit;
60
    exit;
51
}
61
}
52
my $add=$input->param('add');
62
my $add = $input->param('add');
53
63
54
if ($add){
64
if ($add){
55
65
56
    my ( $user_id ) = checkauth( $input, 0, $flagsrequired, 'intranet' );
66
    die "Wrong CSRF token"
57
67
        unless Koha::Token->new->check_csrf( {
58
    if ( $user_id ) {
68
            session_id => scalar $input->cookie('CGISESSID'),
59
69
            token  => scalar $input->param('csrf_token'),
60
        die "Wrong CSRF token"
61
            unless Koha::Token->new->check_csrf( {
62
                session_id => scalar $input->cookie('CGISESSID'),
63
                token  => scalar $input->param('csrf_token'),
64
            });
65
66
        # Note: If the logged in user is not allowed to see this patron an invoice can be forced
67
        # Here we are trusting librarians not to hack the system
68
        my $barcode = $input->param('barcode');
69
        my $item_id;
70
        if ($barcode) {
71
            my $item = Koha::Items->find({barcode => $barcode});
72
            $item_id = $item->itemnumber if $item;
73
        }
74
        my $description = $input->param('desc');
75
        my $note        = $input->param('note');
76
        my $amount      = $input->param('amount') || 0;
77
        my $type        = $input->param('type');
78
79
        Koha::Account->new({ patron_id => $borrowernumber })->add_credit({
80
            amount      => $amount,
81
            description => $description,
82
            item_id     => $item_id,
83
            note        => $note,
84
            type        => $type,
85
            user_id     => $user_id
86
        });
70
        });
87
71
88
        print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber");
72
    # Note: If the logged in user is not allowed to see this patron an invoice can be forced
73
    # Here we are trusting librarians not to hack the system
74
    my $barcode = $input->param('barcode');
75
    my $item_id;
76
    if ($barcode) {
77
        my $item = Koha::Items->find({barcode => $barcode});
78
        $item_id = $item->itemnumber if $item;
89
    }
79
    }
80
    my $description = $input->param('desc');
81
    my $note        = $input->param('note');
82
    my $amount      = $input->param('amount') || 0;
83
    my $type        = $input->param('type');
84
85
    $patron->account->add_credit({
86
        amount      => $amount,
87
        description => $description,
88
        item_id     => $item_id,
89
        note        => $note,
90
        type        => $type,
91
        user_id     => $logged_in_user->id
92
    });
93
94
    print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber");
95
90
} else {
96
} else {
91
    my ($template, $loggedinuser, $cookie) = get_template_and_user(
92
        {
93
            template_name   => "members/mancredit.tt",
94
            query           => $input,
95
            type            => "intranet",
96
            authnotrequired => 0,
97
            flagsrequired   => { borrowers     => 'edit_borrowers',
98
                                 updatecharges => 'remaining_permissions' },
99
            debug           => 1,
100
        }
101
    );
102
    my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
103
    output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
97
    output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
104
98
105
    if (C4::Context->preference('ExtendedPatronAttributes')) {
99
    if (C4::Context->preference('ExtendedPatronAttributes')) {
106
- 

Return to bug 21702