use bind variables in C4::Acquisition::GetPendingOrders

I improved the tests a bit for this module so that they at least skip
if there's not enough data in the database to test with.
I was unable to test the actual execution path through the change I actually made.

Signed-off-by: Galen Charlton <galen.charlton@liblime.com>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>

C4/Acquisition.pm

@@ -220,20 +220,22 @@ sub GetPendingOrders {
             AND (to_days(now())-to_days(closedate) < 180 OR closedate IS NULL)
     ";
     ## FIXME  Why 180 days ???
+    my @query_params = ( $supplierid );
     if ( C4::Context->preference("IndependantBranches") ) {
         my $userenv = C4::Context->userenv;
         if ( ($userenv) && ( $userenv->{flags} != 1 ) ) {
-            $strsth .=
-                " and (borrowers.branchcode = '"
-              . $userenv->{branch}
-              . "' or borrowers.branchcode ='')";
+            warn 'in branch';
+            $strsth .= " and (borrowers.branchcode = ?
+                          or borrowers.branchcode  = '')";
+            push @query_params, $userenv->{branch};
+ 
         }
     }
     $strsth .= " group by aqbasket.basketno" if $grouped;
     $strsth .= " order by aqbasket.basketno";
 
     my $sth = $dbh->prepare($strsth);
-    $sth->execute($supplierid);
+    $sth->execute( @query_params );
     my $results = $sth->fetchall_arrayref({});
     $sth->finish;
     return $results;

t/db_dependent/Acquisition.t

@@ -5,14 +5,69 @@
 
 use strict;
 use warnings;
+use Data::Dumper;
 
-use Test::More tests => 3;
+use C4::Bookseller;
+
+use Test::More tests => 37;
 
 BEGIN {
     use_ok('C4::Acquisition');
 }
 
-my ($basket, $basketno);
-ok($basketno = NewBasket(1,1),			"NewBasket(  1 , 1  ) returns $basketno");
-ok($basket   = GetBasket($basketno),	"GetBasket($basketno) returns $basket");
+my $booksellerid = 1;
+my $booksellerinfo = GetBookSellerFromId( $booksellerid );
+# diag( Data::Dumper->Dump( [ $booksellerinfo ], [ 'booksellerinfo' ] ) );
+SKIP: {
+    skip 'No booksellers in database, cannot test baskets', 2 unless $booksellerinfo;
+    my ($basket, $basketno);
+    ok($basketno = NewBasket(1,1),			"NewBasket(  1 , 1  ) returns $basketno");
+    ok($basket   = GetBasket($basketno),	"GetBasket($basketno) returns $basket");
+}
+
 
+my $supplierid = 1;
+my $grouped    = 0;
+my $orders = GetPendingOrders( $supplierid, $grouped );
+isa_ok( $orders, 'ARRAY' );
+SKIP: {
+    skip 'No relevant orders in database, cannot test baskets', 33 unless( scalar @$orders );
+    # diag( Data::Dumper->Dump( [ $orders ], [ 'orders' ] ) );
+    my @expectedfields = qw( basketno
+                             biblioitemnumber
+                             biblionumber
+                             booksellerinvoicenumber
+                             budgetdate
+                             cancelledby
+                             closedate
+                             creationdate
+                             currency
+                             datecancellationprinted
+                             datereceived
+                             ecost
+                             entrydate
+                             firstname
+                             freight
+                             gst
+                             listprice
+                             notes
+                             ordernumber
+                             purchaseordernumber
+                             quantity
+                             quantityreceived
+                             rrp
+                             serialid
+                             sort1
+                             sort2
+                             subscription
+                             supplierreference
+                             surname
+                             timestamp
+                             title
+                             totalamount
+                             unitprice );
+    my $firstorder = $orders->[0];
+    for my $field ( @expectedfields ) {
+        ok( exists( $firstorder->{ $field } ), "This order has a $field field" );
+    }
+}