From 2a4d1f8b066a433d5ec62a5fe30051bc18ce971e Mon Sep 17 00:00:00 2001
From: Katrin Fischer <katrin.fischer@bsz-bw.de>
Date: Fri, 4 Aug 2023 15:13:36 +0000
Subject: [PATCH] Bug 34469: Block editing for received order lines

When an already received order line is modified/edited,
we experience data loss. Most prominently, we will lose the
linked invoiceid. Therefore we should not allow editing an
order line that was already received. If something needs to be
changed, the receipt should be cancelled first.

To test:
* Create basket as standing order with items added in cataloguing
* Add an order line
* Receive shipment
* Go to the basket summary page, click on 'Modify'
* Change the actual cost
* Save
* Verify that the invoice is now empty
* In the database aqorders.invoiceid will be NULL
* Apply patch
* Receive another shipment for the standing order
* Go back to basket summary page
* Verify the 'Modify' link is no longer present
* Click 'Modify' on the unreceived order line
* Edit the URL parameter odernumber to have the number of an
  already received order line
* Verify you see a nice error message:
  This order cannot be edited, the basket is closed or the order was already received.

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit a4b7490633d2e8bc9ca9a0f60ebec1200ed0b07a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 93e91843276beb48c69576b540f304d2ddec8a32)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
---
 acqui/neworderempty.pl                                    | 8 ++++----
 .../intranet-tmpl/prog/en/includes/blocking_errors.inc    | 2 +-
 koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt   | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/acqui/neworderempty.pl b/acqui/neworderempty.pl
index 2a976114cf..438e5755e5 100755
--- a/acqui/neworderempty.pl
+++ b/acqui/neworderempty.pl
@@ -134,9 +134,10 @@ if(!$basketno) {
 }
 
 our $basket = GetBasket($basketno);
-my $basketobj = Koha::Acquisition::Baskets->find( $basketno );
+my $basketobj = Koha::Acquisition::Baskets->find($basketno);
 $booksellerid = $basket->{booksellerid} unless $booksellerid;
-my $bookseller = Koha::Acquisition::Booksellers->find( $booksellerid );
+my $bookseller = Koha::Acquisition::Booksellers->find($booksellerid);
+$data = GetOrder($ordernumber) if $ordernumber;
 
 output_and_exit( $input, $cookie, $template, 'unknown_basket') unless $basketobj;
 output_and_exit( $input, $cookie, $template, 'unknown_vendor') unless $bookseller;
@@ -149,7 +150,7 @@ $template->param(
     name         => $bookseller->name,
 );
 output_and_exit( $input, $cookie, $template, 'order_cannot_be_edited' )
-    if $ordernumber and $basketobj->closedate;
+    if $ordernumber and ( $basketobj->closedate || $data->{orderstatus} eq "complete" );
 
 my $contract = GetContract({
     contractnumber => $basket->{contractnumber}
@@ -258,7 +259,6 @@ if ( not $ordernumber ) {    # create order
     }
 }
 else {    #modify order
-    $data   = GetOrder($ordernumber);
     $budget_id = $data->{'budget_id'};
 
     $template->param(
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
index 1821f54817..b596390fd5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
@@ -14,7 +14,7 @@
     [% CASE 'unknown_vendor' %]
         <div class="dialog message">Vendor not found.</div>
     [% CASE 'order_cannot_be_edited' %]
-        <div class="dialog message">This order cannot be edited, the basket is closed.</div>
+        <div class="dialog message">This order cannot be edited, the basket is closed or the order was already received.</div>
     [% CASE 'wrong_csrf_token' %]
         <div class="dialog message">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div>
     [% CASE 'budget_is_locked' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index 3b49e6193a..182b904969 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -654,8 +654,8 @@
                                                         [% IF ( active ) %]
                                                             [% UNLESS ( closedate ) %]
                                                                 <td>
-                                                                    <a href="neworderempty.pl?ordernumber=[% books_loo.ordernumber | uri %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Modify</a>
                                                                     [% UNLESS (books_loo.order_received) %]
+                                                                        <a href="neworderempty.pl?ordernumber=[% books_loo.ordernumber | uri %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Modify</a>
                                                                         <br />
                                                                         <a href="#" class="transfer_order" data-ordernumber="[% books_loo.ordernumber | html %]">Transfer</a>
                                                                     [% END %]
-- 
2.39.5