Bug 20701: Add csrf protection to maninvoice.pl
[srvgit] / koha-tmpl / intranet-tmpl / prog / en / modules / members / maninvoice.tt
1 [% USE Asset %]
2 [% USE Koha %]
3 [% USE Branches %]
4 [% SET footerjs = 1 %]
5 [% INCLUDE 'doc-head-open.inc' %]
6 <title>Koha &rsaquo; Patrons &rsaquo; Create manual invoice</title>
7 [% INCLUDE 'doc-head-close.inc' %]
8 </head>
9
10 <body id="pat_maninvoice" class="pat">
11 [% INCLUDE 'header.inc' %]
12 [% INCLUDE 'patron-search.inc' %]
13
14 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Manual invoice</div>
15
16 <div id="doc3" class="yui-t2">
17    
18    <div id="bd">
19         <div id="yui-main">
20         <div class="yui-b">
21 [% INCLUDE 'members-toolbar.inc' %]
22
23 <!-- The manual invoice and credit buttons -->
24 <div class="statictabs">
25 <ul>
26     <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a></li>
27     <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a></li>
28     <li class="active"><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a></li>
29     <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a></li>
30 </ul>
31 <div class="tabs-container">
32
33 [% IF ( ERROR ) %]
34 [% IF ( ITEMNUMBER ) %]
35   ERROR an invalid itemnumber was entered, please hit back and try again
36 [% END %]
37 [% ELSE %]
38 <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
39     <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
40         <fieldset class="rows">
41         <legend>Manual invoice</legend>
42         <ol>
43       <li>
44         <label for="type">Type: </label>
45         <select name="type" id="invoice_type">
46           <option value="L">Lost item</option>
47           <option value="F">Fine</option>
48           <option value="A">Account management fee</option>
49           <option value="N">New card</option>
50           <option value="M">Sundry</option>
51           [% FOREACH invoice_types_loo IN invoice_types_loop %]
52             <option value="[% invoice_types_loo.authorised_value %]">[% invoice_types_loo.authorised_value %]</option>
53           [% END %]
54         </select>
55       </li>
56         <li><label for="barcode">Barcode: </label><input type="text" name="barcode" id="barcode" /></li>
57         <li><label for="desc">Description: </label><input type="text" name="desc" id="desc" size="50" /></li>
58     <li><label for="note">Note: </label><input type="text" name="note" size="50" id="note" /></li>
59     <li><label for="amount">Amount: </label><input type="number" name="amount" id="amount" required="required" value="" step="any" min="0" /> Example: 5.00</li>
60         </ol></fieldset>
61 <fieldset class="action"><input type="submit" name="add" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a></fieldset>
62 </form>
63
64 [% END %]
65 </div></div>
66
67 </div>
68 </div>
69
70 <div class="yui-b">
71 [% INCLUDE 'circ-menu.inc' %]
72 </div>
73 </div>
74
75 [% MACRO jsinclude BLOCK %]
76     [% Asset.js("js/members-menu.js") %]
77     <script type="text/javascript">
78         var type_fees = {'L':'','F':'','A':'','N':'','M':''};
79         [% FOREACH invoice_types_loo IN invoice_types_loop %]
80             type_fees['[% invoice_types_loo.authorised_value %]'] = "[% invoice_types_loo.lib %]";
81         [% END %]
82         $(document).ready(function(){
83             $('#maninvoice').preventDoubleFormSubmit();
84             $("fieldset.rows input, fieldset.rows select").addClass("noEnterSubmit");
85             $("#invoice_type").on("change",function(){
86                 this.form.desc.value = this.options[this.selectedIndex].value;
87                 this.form.amount.value = type_fees[this.options[this.selectedIndex].value];
88             });
89         });
90     </script>
91 [% END %]
92
93 [% INCLUDE 'intranet-bottom.inc' %]