MT2582: Fix user deletion without permission

[koha_gimpoz] / members / pay.pl

diff --git a/members/pay.pl b/members/pay.pl
index e0de50a..5a36bd7 100755 (executable)
--- a/members/pay.pl
+++ b/members/pay.pl
@@ -13,9 +13,9 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 
 =head1 pay.pl
@@ -26,6 +26,8 @@
 =cut
 
 use strict;
+use warnings;
+
 use C4::Context;
 use C4::Auth;
 use C4::Output;
@@ -45,7 +47,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 1, updatecharges => 1 },
         debug           => 1,
     }
 );
@@ -56,7 +58,7 @@ if ( $borrowernumber eq '' ) {
 }
 
 # get borrower details
-my $data = GetMember( $borrowernumber,'borrowernumber' );
+my $data = GetMember( borrowernumber => $borrowernumber );
 my $user = $input->remote_user;
 
 # get account details
@@ -82,7 +84,7 @@ for ( my $i = 0 ; $i < @names ; $i++ ) {
         $check = 2;
     }
 }
-my $total = $input->param('total');
+my $total = $input->param('total') || '';
 if ( $check == 0 ) {
     if ( $total ne '' ) {
         recordpayment( $borrowernumber, $total );
@@ -115,7 +117,7 @@ if ( $check == 0 ) {
                 $line{title}          = $accts->[$i]{'title'};
                 $line{notify_id}      = $accts->[$i]{'notify_id'};
                 $line{notify_level}   = $accts->[$i]{'notify_level'};
-                $line{net_balance} = 1;
+                $line{net_balance} = 1 if($accts->[$i]{'amountoutstanding'} > 0); # you can't pay a credit.
                 push( @loop_pay, \%line );
             }
         }
@@ -131,6 +133,13 @@ if ( $check == 0 ) {
           };
     }
        
+if ( $data->{'category_type'} eq 'C') {
+   my  ( $catcodes, $labels ) =  GetborCatFromCatType( 'A', 'WHERE category_type = ?' );
+   my $cnt = scalar(@$catcodes);
+   $template->param( 'CATCODE_MULTI' => 1) if $cnt > 1;
+   $template->param( 'catcode' =>    $catcodes->[0])  if $cnt == 1;
+}
+       
 $template->param( adultborrower => 1 ) if ( $data->{'category_type'} eq 'A' );
 my ($picture, $dberror) = GetPatronImage($data->{'cardnumber'});
 $template->param( picture => 1 ) if $picture;
@@ -140,18 +149,20 @@ $template->param( picture => 1 ) if $picture;
         firstname      => $data->{'firstname'},
         surname        => $data->{'surname'},
         borrowernumber => $borrowernumber,
-               cardnumber => $data->{'cardnumber'},
-           categorycode => $data->{'categorycode'},
-           category_type => $data->{'category_type'},
-           category_description => $data->{'description'},
-           address => $data->{'address'},
-               address2 => $data->{'address2'},
-           city => $data->{'city'},
-               zipcode => $data->{'zipcode'},
-               phone => $data->{'phone'},
-               email => $data->{'email'},
-           branchcode => $data->{'branchcode'},
-               is_child        => ($data->{'category_type'} eq 'C'),
+       cardnumber => $data->{'cardnumber'},
+       categorycode => $data->{'categorycode'},
+       category_type => $data->{'category_type'},
+       categoryname  => $data->{'description'},
+       address => $data->{'address'},
+       address2 => $data->{'address2'},
+       city => $data->{'city'},
+       zipcode => $data->{'zipcode'},
+       country => $data->{'country'},
+       phone => $data->{'phone'},
+       email => $data->{'email'},
+       branchcode => $data->{'branchcode'},
+       branchname => GetBranchName($data->{'branchcode'}),
+       is_child        => ($data->{'category_type'} eq 'C'),
         total          => sprintf( "%.2f", $total )
     );
     output_html_with_http_headers $input, $cookie, $template->output;
@@ -191,7 +202,7 @@ sub writeoff {
     undef $itemnum unless $itemnum; # if no item is attached to fine, make sure to store it as a NULL
     my $sth =
       $dbh->prepare(
-"Update accountlines set amountoutstanding=0 where (accounttype='Res' OR accounttype='FU' OR accounttype ='IP' OR accounttype='CH' OR accounttype='N' OR accounttype='F' OR accounttype='A' OR accounttype='M' OR accounttype='L' OR accounttype='RE' OR accounttype='RL') and accountno=? and borrowernumber=?"
+"Update accountlines set amountoutstanding=0 where accountno=? and borrowernumber=?"
       );
     $sth->execute( $accountnum, $borrowernumber );
     $sth->finish;