MT2582: Fix user deletion without permission

[koha_gimpoz] / members / pay.pl

diff --git a/members/pay.pl b/members/pay.pl
index b782e45..5a36bd7 100755 (executable)
--- a/members/pay.pl
+++ b/members/pay.pl
@@ -13,9 +13,9 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 
 =head1 pay.pl
@@ -26,6 +26,8 @@
 =cut
 
 use strict;
+use warnings;
+
 use C4::Context;
 use C4::Auth;
 use C4::Output;
@@ -45,7 +47,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 1, updatecharges => 1 },
         debug           => 1,
     }
 );
@@ -56,7 +58,7 @@ if ( $borrowernumber eq '' ) {
 }
 
 # get borrower details
-my $data = GetMember( $borrowernumber,'borrowernumber' );
+my $data = GetMember( borrowernumber => $borrowernumber );
 my $user = $input->remote_user;
 
 # get account details
@@ -82,7 +84,7 @@ for ( my $i = 0 ; $i < @names ; $i++ ) {
         $check = 2;
     }
 }
-my $total = $input->param('total');
+my $total = $input->param('total') || '';
 if ( $check == 0 ) {
     if ( $total ne '' ) {
         recordpayment( $borrowernumber, $total );
@@ -155,6 +157,7 @@ $template->param( picture => 1 ) if $picture;
        address2 => $data->{'address2'},
        city => $data->{'city'},
        zipcode => $data->{'zipcode'},
+       country => $data->{'country'},
        phone => $data->{'phone'},
        email => $data->{'email'},
        branchcode => $data->{'branchcode'},
@@ -199,7 +202,7 @@ sub writeoff {
     undef $itemnum unless $itemnum; # if no item is attached to fine, make sure to store it as a NULL
     my $sth =
       $dbh->prepare(
-"Update accountlines set amountoutstanding=0 where (accounttype='Res' OR accounttype='FU' OR accounttype ='IP' OR accounttype='CH' OR accounttype='N' OR accounttype='F' OR accounttype='A' OR accounttype='M' OR accounttype='L' OR accounttype='RE' OR accounttype='RL') and accountno=? and borrowernumber=?"
+"Update accountlines set amountoutstanding=0 where accountno=? and borrowernumber=?"
       );
     $sth->execute( $accountnum, $borrowernumber );
     $sth->finish;