basket.pl and template - Many fixes including SQL injection security check,
[koha.git] / acqui / basket.pl
1 #!/usr/bin/perl
2
3 #script to show display basket of orders
4 #written by chris@katipo.co.nz 24/2/2000
5
6 # Copyright 2000-2002 Katipo Communications
7 #
8 # This file is part of Koha.
9 #
10 # Koha is free software; you can redistribute it and/or modify it under the
11 # terms of the GNU General Public License as published by the Free Software
12 # Foundation; either version 2 of the License, or (at your option) any later
13 # version.
14 #
15 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
16 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
17 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
18 #
19 # You should have received a copy of the GNU General Public License along with
20 # Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
21 # Suite 330, Boston, MA  02111-1307 USA
22
23 use strict;
24 use C4::Auth;
25 use C4::Koha;
26 use C4::Output;
27 use CGI;
28 use C4::Acquisition;
29 use C4::Bookfund;
30 use C4::Bookseller;
31 use C4::Dates qw/format_date/;
32 use C4::Debug;
33
34 =head1 NAME
35
36 basket.pl
37
38 =head1 DESCRIPTION
39
40  This script display all informations about basket for the supplier given
41  on input arg.  Moreover, it allows us to add a new order for this supplier from
42  an existing record, a suggestion or a new record.
43
44 =head1 CGI PARAMETERS
45
46 =over 4
47
48 =item $basketno
49
50 The basket number.
51
52 =item supplierid
53
54 the supplier this script have to display the basket.
55
56 =item order
57
58 =back
59
60 =cut
61
62 my $query        = new CGI;
63 my $basketno     = $query->param('basketno');
64 my $booksellerid = $query->param('supplierid');
65 my $sort         = $query->param('order');
66
67 my @sort_loop;
68 if (defined $sort) {
69         foreach (split /\,/, $sort) {
70                 my %sorthash = (
71                         string => $_,
72                 );
73                 # other possibly valid tables for later: aqbookfund biblio biblioitems
74                 if (
75                         (/^\s*(aqorderbreakdown)\.(\w+)\s*$/ and $2 eq 'bookfundid'   ) or
76                         (/^\s*(biblioitems)\.(\w+)\s*$/      and $2 eq 'publishercode')
77                 ) {
78                         $sorthash{table} = $1;
79                         $sorthash{field} = $2;
80                 } else {
81                         $sorthash{error} = 1;
82                 }
83                 push @sort_loop, \%sorthash;
84         }
85 }
86
87 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
88     {
89         template_name   => "acqui/basket.tmpl",
90         query           => $query,
91         type            => "intranet",
92         authnotrequired => 0,
93         flagsrequired   => { acquisition => 1 },
94         debug           => 1,
95     }
96 );
97
98 my $basket = GetBasket($basketno);
99
100 # FIXME : what about the "discount" percentage?
101 # FIXME : the query->param('supplierid') below is probably useless. The bookseller is always known from the basket
102 # if no booksellerid in parameter, get it from basket
103 # warn "=>".$basket->{booksellerid};
104 $booksellerid = $basket->{booksellerid} unless $booksellerid;
105 my ($bookseller) = GetBookSellerFromId($booksellerid);
106
107 if ( !$bookseller ) {
108     $template->param( NO_BOOKSELLER => 1 );
109 }
110 else {
111
112     # get librarian branch...
113     if ( C4::Context->preference("IndependantBranches") ) {
114         my $userenv = C4::Context->userenv;
115         unless ( $userenv->{flags} == 1 ) {
116             my $validtest = ( $basket->{creationdate} eq '' )
117               || ( $userenv->{branch} eq $basket->{branch} )
118               || ( $userenv->{branch} eq '' )
119               || ( $basket->{branch}  eq '' );
120             unless ($validtest) {
121                 print $query->redirect("../mainpage.pl");
122                 exit 1;
123             }
124         }
125     }
126
127     # if new basket, pre-fill infos
128     $basket->{creationdate} = ""            unless ( $basket->{creationdate} );
129     $basket->{authorisedby} = $loggedinuser unless ( $basket->{authorisedby} );
130     $debug
131       and warn sprintf
132       "loggedinuser: $loggedinuser; creationdate: %s; authorisedby: %s",
133       $basket->{creationdate}, $basket->{authorisedby};
134
135     my @results = GetOrders( $basketno, $sort );
136     my $count = scalar @results;
137
138     my $sub_total;      # total of line totals
139     my $grand_total;    # $subttotal + $gist
140
141     # my $line_total_est; # total of each line
142     my $sub_total_est;      # total of line totals
143     my $sub_total_rrp;      # total of line totals
144     my $grand_total_est;    # $subttotal + $gist
145
146     my $qty_total;
147     my @books_loop;
148     for ( my $i = 0 ; $i < $count ; $i++ ) {
149         my $rrp = $results[$i]->{'listprice'};
150                 my $qty = $results[$i]->{'quantity'};
151         $rrp = ConvertCurrency( $results[$i]->{'currency'}, $rrp );
152         $sub_total_rrp += $qty * $results[$i]->{'rrp'};
153         my $line_total = $qty * $results[$i]->{'ecost'};
154                 # FIXME: what about the "actual cost" field?
155         $sub_total += $line_total;
156         $qty_total += $qty;
157         my %line = %{ $results[$i] };
158                 ($i%2) and $line{toggle} = 1;
159         $line{order_received}= ( $qty eq $results[$i]->{'quantityreceived'} );
160         $line{basketno}      = $basketno;
161         $line{i}             = $i;
162         $line{rrp}           = sprintf( "%.2f", $line{'rrp'} );
163         $line{ecost}         = sprintf( "%.2f", $line{'ecost'} );
164         $line{line_total}    = sprintf( "%.2f", $line_total );
165         $line{odd}           = $i % 2;
166         push @books_loop, \%line;
167     }
168     my $prefgist = C4::Context->preference("gist") || 0;
169     my $gist     = $sub_total     * $prefgist;
170     my $gist_rrp = $sub_total_rrp * $prefgist;
171     $grand_total     = $sub_total_est = $sub_total;
172     $grand_total_est = $sub_total_est;          # FIXME: Too many things that are ALL the SAME
173         my $temp;
174     if ($temp = $bookseller->{'listincgst'}) {
175                 $template->param(listincgst => $temp);
176                 $gist = 0;
177         } else {
178         $grand_total += $gist;
179         $grand_total_est += $sub_total_est * $prefgist;         # same thing as += gist
180     }
181     if ($temp = $bookseller->{'discount'}) {
182                 $template->param(discount => sprintf( "%.2f", $temp ));
183         }
184     $template->param(
185         basketno         => $basketno,
186         creationdate     => format_date( $basket->{creationdate} ),
187         authorisedby     => $basket->{authorisedby},
188         authorisedbyname => $basket->{authorisedbyname},
189         closedate        => format_date( $basket->{closedate} ),
190         active           => $bookseller->{'active'},
191         booksellerid     => $bookseller->{'id'},
192         name             => $bookseller->{'name'},
193         address1         => $bookseller->{'address1'},
194         address2         => $bookseller->{'address2'},
195         address3         => $bookseller->{'address3'},
196         address4         => $bookseller->{'address4'},
197         entrydate        => format_date( $results[0]->{'entrydate'} ),
198         books_loop       => \@books_loop,
199          sort_loop       => \@sort_loop,
200         count            => $count,
201         gist             => $gist ? sprintf( "%.2f", $gist ) : 0,
202         gist_rate        => sprintf( "%.2f", $prefgist * 100) . '%',
203         gist_est         => sprintf( "%.2f", $sub_total_est * $prefgist ),
204         gist_rrp         => sprintf( "%.2f", $gist_rrp),
205           sub_total      => sprintf( "%.2f", $sub_total ),
206         grand_total      => sprintf( "%.2f", $grand_total ),
207           sub_total_est  => sprintf( "%.2f", $sub_total_est),
208         grand_total_est  => sprintf( "%.2f", $grand_total_est),
209           sub_total_rrp  => sprintf( "%.2f", $sub_total_rrp),
210         grand_total_rrp  => sprintf( "%.2f", $sub_total_rrp + $gist_rrp),
211         currency         => $bookseller->{'listprice'},
212         qty_total        => $qty_total,
213         GST              => $prefgist,
214     );
215 }
216 output_html_with_http_headers $query, $cookie, $template->output;