Bug 26592: [20.05] Prevent XSS vulnerabilities when circ/ysearch.pl is used
[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / members / mancredit.tt
1 [% USE raw %]
2 [% USE Asset %]
3 [% USE Koha %]
4 [% USE Branches %]
5 [% SET footerjs = 1 %]
6 [% INCLUDE 'doc-head-open.inc' %]
7 <title>Koha &rsaquo; Patrons &rsaquo; Create manual credit</title>
8 [% INCLUDE 'doc-head-close.inc' %]
9 </head>
10
11 <body id="pat_mancredit" class="pat">
12 [% INCLUDE 'header.inc' %]
13 [% INCLUDE 'patron-search.inc' %]
14
15 <div id="breadcrumbs">
16     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
17     <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo;
18     Manual credit
19 </div>
20
21 <div class="main container-fluid">
22     <div class="row">
23         <div class="col-sm-10 col-sm-push-2">
24             <main>
25
26             [% INCLUDE 'members-toolbar.inc' %]
27
28             <!-- The manual invoice and credit buttons -->
29             <div class="statictabs">
30                 <ul>
31                     <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | uri %]">Transactions</a></li>
32                     <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | uri %]" >Make a payment</a></li>
33                     <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | uri %]" >Create manual invoice</a></li>
34                     <li class="active"><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | uri %]" >Create manual credit</a></li>
35                 </ul>
36                 <div class="tabs-container">
37
38                 <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
39                     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
40                     <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
41
42                     <fieldset class="rows">
43                         <legend>Manual credit</legend>
44                         <ol>
45                             <li>
46                                 <label for="type">Credit type: </label>
47                                 <select name="type" id="type">
48                                     [% FOREACH credit_type IN credit_types %]
49                                     <option value="[% credit_type.code | html %]">[% credit_type.description | html %]</option>
50                                     [% END %]
51                                 </select>
52                             </li>
53                             <li><label for="barcode">Barcode: </label><input type="text" name="barcode" id="barcode" /></li>
54                             <li><label for="desc">Description: </label><input type="text" name="desc" size="50" id="desc" /></li>
55                             <li><label for="note">Note: </label><input type="text" name="note" size="50" id="note" /></li>
56                             <li><label for="amount">Amount: </label><input type="number" name="amount" id="amount" required="required" value="" step="any" min="0" /> Example: 5.00</li>
57                         </ol>
58                     </fieldset>
59
60                     <fieldset class="action"><input type="submit" name="add" value="Add credit" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a></fieldset>
61                 </form>
62
63                 </div>
64             </div>
65
66             </main>
67         </div> <!-- /.col-sm-10.col-sm-push-2 -->
68
69         <div class="col-sm-2 col-sm-pull-10">
70             <aside>
71                 [% INCLUDE 'circ-menu.inc' %]
72             </aside>
73         </div> <!-- /.col-sm-2.col-sm-pull-10 -->
74     </div> <!-- /.row -->
75
76 [% MACRO jsinclude BLOCK %]
77     [% INCLUDE 'str/members-menu.inc' %]
78     [% Asset.js("js/members-menu.js") | $raw %]
79     <script>
80         $(document).ready(function(){
81             $('#mancredit').preventDoubleFormSubmit();
82             $("fieldset.rows input, fieldset.rows select").addClass("noEnterSubmit");
83         });
84     </script>
85 [% END %]
86
87 [% INCLUDE 'intranet-bottom.inc' %]