dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
230 lines
13 KiB
Text
230 lines
13 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE Koha %]
|
|
[% USE KohaDates %]
|
|
[% USE AuthorisedValues %]
|
|
[% USE Price %]
|
|
[% SET ENABLE_OPAC_PAYMENTS = Koha.Preference('EnablePayPalOpacPayments') || plugins %]
|
|
[% SET DISPLAY_PAYMENT_BLOCK = 0 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog › Your fines and charges</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% BLOCK cssinclude %]
|
|
[% Asset.css("css/datatables.css") | $raw %]
|
|
[% END %]
|
|
</head>
|
|
|
|
[% INCLUDE 'bodytag.inc' bodyid='opac-account' bodyclass='scrollto' %]
|
|
[% INCLUDE 'masthead.inc' %]
|
|
|
|
<div class="main">
|
|
<ul class="breadcrumb">
|
|
<li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">›</span></li>
|
|
<li>[% IF logged_in_user %]<a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a>[% END %] <span class="divider">›</span></li>
|
|
<li><a href="#">Your fines and charges</a></li>
|
|
</ul>
|
|
|
|
<div class="container-fluid">
|
|
<div class="row-fluid">
|
|
<div class="span2">
|
|
<div id="navigation">
|
|
[% INCLUDE 'navigation.inc' IsPatronPage=1 %]
|
|
</div>
|
|
</div>
|
|
<div class="span10">
|
|
<div id="useraccount" class="maincontent">
|
|
|
|
[% IF message %]
|
|
<div class="alert alert-info">
|
|
[% IF message == 'valid_payment' %]
|
|
<p>Your payment of $[% message_value | html %] has been processed successfully!</p>
|
|
[% ELSIF message == 'duplicate_payment' %]
|
|
<p>A payment with the transaction id '[% message_value | html %]' has already been posted to an account.</p>
|
|
<p>Please contact a librarian for details.</p>
|
|
[% ELSIF message == 'invalid_payment' %]
|
|
<p>The transaction id '[% message_value | html %]' for this payment is invalid.</p>
|
|
<p>Please contact a librarian for details.</p>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF payment_error %]
|
|
<div id="error" class="dialog alert">
|
|
<p><strong>Error:</strong> there was a problem processing your payment</p>
|
|
|
|
[% IF payment_error == "PAYPAL_UNABLE_TO_CONNECT" %]
|
|
<p>Unable to connect to PayPal.</p>
|
|
<p>Please contact a librarian to verify your payment.</p>
|
|
[% ELSIF payment_error == "PAYPAL_ERROR_PROCESSING" %]
|
|
<p>Unable to verify payment.</p>
|
|
<p>Please contact a librarian to verify your payment.</p>
|
|
[% END %]
|
|
</div>
|
|
[% ELSIF payment %]
|
|
<div class="alert alert-info">
|
|
<p><strong>Payment applied:</strong> your payment of [% payment | html %] has been applied to your account</p>
|
|
</div>
|
|
[% END %]
|
|
|
|
<h3>Fines and charges</h3>
|
|
|
|
[% IF ( ACCOUNT_LINES ) %]
|
|
<form method="post" action="opac-account-pay.pl" class="form-horizontal">
|
|
<table class="table table-bordered table-striped" id="finestable">
|
|
<thead>
|
|
<tr>
|
|
[% IF ENABLE_OPAC_PAYMENTS %]<th> </th>[% END %]
|
|
<th class="title-string">Date</th>
|
|
<th>Description</th>
|
|
<th>Fine amount</th>
|
|
<th>Amount outstanding</th>
|
|
</tr>
|
|
</thead>
|
|
|
|
<tfoot>
|
|
<tr>
|
|
[%- IF ENABLE_OPAC_PAYMENTS -%]
|
|
[%- SET COLSPAN = 4 -%]
|
|
[%- ELSE -%]
|
|
[%- SET COLSPAN = 3 -%]
|
|
[%- END -%]
|
|
<th class="sum" colspan="[% COLSPAN | html %]">Total due</th>
|
|
<td class="sum">[% total | $Price | html %]</td>
|
|
</tr>
|
|
</tfoot>
|
|
|
|
<tbody>
|
|
[% FOREACH ACCOUNT_LINE IN ACCOUNT_LINES %]
|
|
[% IF ( ACCOUNT_LINE.odd ) %]<tr class="highlight">[% ELSE %]<tr>[% END %]
|
|
[% IF ENABLE_OPAC_PAYMENTS %]
|
|
<td>
|
|
[% IF ACCOUNT_LINE.amountoutstanding > 0 %]
|
|
[% SET DISPLAY_PAYMENT_BLOCK = 1 %]
|
|
<input class="checkbox-pay pay-online hidden" name="accountline" type="checkbox" id="checkbox-pay-[% ACCOUNT_LINE.accountlines_id | html %]" value="[% ACCOUNT_LINE.accountlines_id | html %]">
|
|
<input type="hidden" id="amount-[% ACCOUNT_LINE.accountlines_id | html %]" value="[% ACCOUNT_LINE.amountoutstanding | html %]" />
|
|
[% END %]
|
|
</td>
|
|
[% END %]
|
|
<td><span title="[% ACCOUNT_LINE.date | html %]">[% ACCOUNT_LINE.date | $KohaDates %]</span></td>
|
|
<td>
|
|
[% SWITCH ACCOUNT_LINE.accounttype %]
|
|
[% CASE 'Pay' %]Payment, thanks
|
|
[% CASE 'Pay00' %]Payment, thanks (cash via SIP2)
|
|
[% CASE 'Pay01' %]Payment, thanks (VISA via SIP2)
|
|
[% CASE 'Pay02' %]Payment, thanks (credit card via SIP2)
|
|
[% CASE 'N' %]New card
|
|
[% CASE 'F' %]Fine
|
|
[% CASE 'A' %]Account management fee
|
|
[% CASE 'M' %]Sundry
|
|
[% CASE 'L' %]Lost item
|
|
[% CASE 'W' %]Writeoff
|
|
[% CASE 'FU' %]Accruing fine
|
|
[% CASE 'HE' %]Hold waiting too long
|
|
[% CASE 'Rent' %]Rental fee
|
|
[% CASE 'FOR' %]Forgiven
|
|
[% CASE 'LR' %]Lost item fee refund
|
|
[% CASE 'PF' %]Processing fee
|
|
[% CASE 'PAY' %]Payment
|
|
[% CASE 'WO' %]Writeoff
|
|
[% CASE 'C' %]Credit
|
|
[% CASE 'CR' %]Credit
|
|
[% CASE %][% ACCOUNT_LINE.accounttype | html %]
|
|
[%- END -%]
|
|
[%- IF ACCOUNT_LINE.payment_type %], [% AuthorisedValues.GetByCode('PAYMENT_TYPE', ACCOUNT_LINE.payment_type, 1) | html %][% END %]
|
|
[%- IF ACCOUNT_LINE.description %], [% ACCOUNT_LINE.description | html %][% END %]
|
|
[% IF ACCOUNT_LINE.title %]([% ACCOUNT_LINE.title | html %])[% END %]
|
|
</td>
|
|
[% IF ( ACCOUNT_LINE.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amount | $Price | html %]</td>
|
|
[% IF ( ACCOUNT_LINE.amountoutstandingcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amountoutstanding | $Price | html %]</td>
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
|
|
</table>
|
|
|
|
[% IF ENABLE_OPAC_PAYMENTS && DISPLAY_PAYMENT_BLOCK %]
|
|
<fieldset class="pay-online hidden">
|
|
<legend>Pay selected fines and charges</legend>
|
|
<span class="help-block"><h3>Payment method</h3></span>
|
|
|
|
[% IF Koha.Preference('EnablePayPalOpacPayments') %]
|
|
<div class="control-group">
|
|
<label class="radio">
|
|
<input type="radio" name="payment_method" id="payment_method-paypal" value="paypal" checked="checked">
|
|
<!-- PayPal Logo --><a href="https://www.paypal.com/webapps/mpp/paypal-popup" title="How PayPal Works" class="paypal"><img src="https://www.paypalobjects.com/webstatic/mktg/logo/AM_SbyPP_mc_vs_dc_ae.jpg" border="0" alt="PayPal Acceptance Mark"></a><!-- PayPal Logo -->
|
|
</label>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% FOREACH p IN plugins %]
|
|
<div class="control-group">
|
|
<label class="radio">
|
|
<input type="radio" name="payment_method" id="payment_method-[% p.class | html %]" value="[% p.class | html %]" checked="checked">
|
|
[% p.get_metadata.name | html %]
|
|
</label>
|
|
</div>
|
|
[% END %]
|
|
|
|
<div class="control-group">
|
|
<input type="hidden" id="payment-amount" name="payment_amount" value="0" />
|
|
<button id="submit-pay" type="submit" class="btn" disabled="disabled">Make payment</button>
|
|
<span id="amount-to-pay-label">
|
|
Amount to pay: <span id="amount-to-pay">0.00</span>
|
|
</span>
|
|
</div>
|
|
</fieldset>
|
|
[% END %]
|
|
</form>
|
|
[% ELSE %]
|
|
<h4>You have no fines or charges</h4>
|
|
[% END %]
|
|
</div> <!-- / #useraccount -->
|
|
</div> <!-- / .span10 -->
|
|
</div> <!-- / .row-fluid -->
|
|
</div> <!-- / .container-fluid -->
|
|
</div> <!-- / .main -->
|
|
|
|
[% INCLUDE 'opac-bottom.inc' %]
|
|
[% BLOCK jsinclude %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script>
|
|
$( document ).ready(function() {
|
|
|
|
$("#finestable").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
"columnDefs": [
|
|
{ "type": "title-string", "targets" : [ "title-string" ] }
|
|
]
|
|
} ));
|
|
|
|
$(".paypal").on("click", function() {
|
|
window.open('https://www.paypal.com/webapps/mpp/paypal-popup','WIPaypal','toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, width=1060, height=700');
|
|
return false;
|
|
});
|
|
|
|
$(".pay-online").removeClass("hidden");
|
|
|
|
$("#amount-to-pay-label").hide();
|
|
|
|
$(".checkbox-pay").change( function() {
|
|
// Disable the pay button if no fees are selected
|
|
$("#submit-pay").prop("disabled", ! $(".checkbox-pay:checked").length );
|
|
|
|
// Calculate the total amount to be paid based on selected fees
|
|
var total = 0;
|
|
$(".checkbox-pay").each( function() {
|
|
if ( $(this).is(":checked") ) {
|
|
var id = this.id.split("checkbox-pay-")[1];
|
|
total += parseFloat( $("#amount-" + id).val() );
|
|
}
|
|
});
|
|
|
|
if ( total ) {
|
|
$("#amount-to-pay").html( total.toFixed(2) );
|
|
$("#amount-to-pay-label").show();
|
|
} else {
|
|
$("#amount-to-pay-label").hide();
|
|
}
|
|
});
|
|
});
|
|
</script>
|
|
[% END %]
|