Bug 25898: Prohibit indirect object notation
[koha.git] / acqui / invoice.pl
1 #!/usr/bin/perl
2
3 # Copyright 2011 BibLibre SARL
4 # This file is part of Koha.
5 #
6 # Koha is free software; you can redistribute it and/or modify it
7 # under the terms of the GNU General Public License as published by
8 # the Free Software Foundation; either version 3 of the License, or
9 # (at your option) any later version.
10 #
11 # Koha is distributed in the hope that it will be useful, but
12 # WITHOUT ANY WARRANTY; without even the implied warranty of
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 # GNU General Public License for more details.
15 #
16 # You should have received a copy of the GNU General Public License
17 # along with Koha; if not, see <http://www.gnu.org/licenses>.
18
19 =head1 NAME
20
21 invoice.pl
22
23 =head1 DESCRIPTION
24
25 Invoice details
26
27 =cut
28
29 use Modern::Perl;
30
31 use CGI qw ( -utf8 );
32 use C4::Auth;
33 use C4::Output;
34 use C4::Acquisition;
35 use C4::Budgets;
36
37 use Koha::Acquisition::Booksellers;
38 use Koha::Acquisition::Currencies;
39 use Koha::DateUtils;
40 use Koha::Misc::Files;
41 use Koha::Acquisition::Invoice::Adjustments;
42
43 my $input = CGI->new;
44 my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
45     {
46         template_name   => 'acqui/invoice.tt',
47         query           => $input,
48         type            => 'intranet',
49         flagsrequired   => { 'acquisition' => '*' },
50         debug           => 1,
51     }
52 );
53
54 my $logged_in_patron = Koha::Patrons->find( $loggedinuser );
55 my $invoiceid = $input->param('invoiceid');
56 my $op        = $input->param('op');
57
58 output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
59   if $op
60   && ! $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } )
61   && ! $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } )
62   && ! $logged_in_patron->has_permission( { acquisition => 'merge_invoices' } )
63   && ! $logged_in_patron->has_permission( { acquisition => 'delete_invoices' } );
64
65 my $invoice_files;
66 if ( C4::Context->preference('AcqEnableFiles') ) {
67     $invoice_files = Koha::Misc::Files->new(
68         tabletag => 'aqinvoices', recordid => $invoiceid );
69 }
70
71 if ( $op && $op eq 'close' ) {
72     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
73         unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
74     CloseInvoice($invoiceid);
75     my $referer = $input->param('referer');
76     if ($referer) {
77         print $input->redirect($referer);
78         exit 0;
79     }
80 }
81 elsif ( $op && $op eq 'reopen' ) {
82     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
83         unless $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
84
85     ReopenInvoice($invoiceid);
86     my $referer = $input->param('referer');
87     if ($referer) {
88         print $input->redirect($referer);
89         exit 0;
90     }
91 }
92 elsif ( $op && $op eq 'mod' ) {
93     my $shipmentcost       = $input->param('shipmentcost');
94     my $shipment_budget_id = $input->param('shipment_budget_id');
95     my $invoicenumber      = $input->param('invoicenumber');
96     ModInvoice(
97         invoiceid             => $invoiceid,
98         invoicenumber         => $invoicenumber,
99         shipmentdate          => scalar output_pref( { str => scalar $input->param('shipmentdate'), dateformat => 'iso', dateonly => 1 } ),
100         billingdate           => scalar output_pref( { str => scalar $input->param('billingdate'),  dateformat => 'iso', dateonly => 1 } ),
101         shipmentcost          => $shipmentcost,
102         shipmentcost_budgetid => $shipment_budget_id
103     );
104     if ($input->param('reopen')) {
105         ReopenInvoice($invoiceid)
106             if $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
107     } elsif ($input->param('close')) {
108
109         output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
110             unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
111
112         CloseInvoice($invoiceid);
113     } elsif ($input->param('merge')) {
114
115         output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
116             unless $logged_in_patron->has_permission( { acquisition => 'merge_invoices' } );
117
118         my @sources = $input->multi_param('merge');
119         MergeInvoices($invoiceid, \@sources);
120         defined($invoice_files) && $invoice_files->MergeFileRecIds(@sources);
121     }
122     $template->param( modified => 1 );
123 }
124 elsif ( $op && $op eq 'delete' ) {
125
126     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
127         unless $logged_in_patron->has_permission( { acquisition => 'delete_invoices' } );
128
129     DelInvoice($invoiceid);
130     defined($invoice_files) && $invoice_files->DelAllFiles();
131     my $referer = $input->param('referer') || 'invoices.pl';
132     if ($referer) {
133         print $input->redirect($referer);
134         exit 0;
135     }
136 }
137 elsif ( $op && $op eq 'del_adj' ) {
138
139     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
140         unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
141
142     my $adjustment_id  = $input->param('adjustment_id');
143     my $del_adj = Koha::Acquisition::Invoice::Adjustments->find( $adjustment_id );
144     $del_adj->delete() if ($del_adj);
145 }
146 elsif ( $op && $op eq 'mod_adj' ) {
147
148     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
149         unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
150
151     my @adjustment_id  = $input->multi_param('adjustment_id');
152     my @adjustment     = $input->multi_param('adjustment');
153     my @reason         = $input->multi_param('reason');
154     my @note           = $input->multi_param('note');
155     my @budget_id      = $input->multi_param('budget_id');
156     my @encumber_open  = $input->multi_param('encumber_open');
157     my %e_open = map { $_ => 1 } @encumber_open;
158
159     for( my $i=0; $i < scalar @adjustment; $i++ ){
160         if( $adjustment_id[$i] eq 'new' ){
161             next unless ( $adjustment[$i] || $reason[$i] );
162             my $new_adj = Koha::Acquisition::Invoice::Adjustment->new({
163                 invoiceid => $invoiceid,
164                 adjustment => $adjustment[$i],
165                 reason => $reason[$i],
166                 note => $note[$i],
167                 budget_id => $budget_id[$i] || undef,
168                 encumber_open => defined $e_open{ $adjustment_id[$i] } ? 1 : 0,
169             });
170             $new_adj->store();
171         }
172         else {
173             my $old_adj = Koha::Acquisition::Invoice::Adjustments->find( $adjustment_id[$i] );
174             unless ( $old_adj->adjustment == $adjustment[$i] && $old_adj->reason eq $reason[$i] && $old_adj->budget_id == $budget_id[$i] && $old_adj->encumber_open == $e_open{$adjustment_id[$i]} && $old_adj->note eq $note[$i] ){
175                 $old_adj->timestamp(undef);
176                 $old_adj->adjustment( $adjustment[$i] );
177                 $old_adj->reason( $reason[$i] );
178                 $old_adj->note( $note[$i] );
179                 $old_adj->budget_id( $budget_id[$i] || undef );
180                 $old_adj->encumber_open( $e_open{$adjustment_id[$i]} ? 1 : 0 );
181                 $old_adj->update();
182             }
183         }
184     }
185 }
186
187 my $details = GetInvoiceDetails($invoiceid);
188 my $bookseller = Koha::Acquisition::Booksellers->find( $details->{booksellerid} );
189 my @orders_loop = ();
190 my $orders = $details->{'orders'};
191 my @foot_loop;
192 my %foot;
193 my $shipmentcost = $details->{shipmentcost} || 0;
194 my $total_quantity = 0;
195 my $total_tax_excluded = 0;
196 my $total_tax_included = 0;
197 my $total_tax_value = 0;
198 foreach my $order (@$orders) {
199     my $line = get_infos( $order, $bookseller);
200
201     $line->{total_tax_excluded} = get_rounded_price($line->{unitprice_tax_excluded}) * $line->{quantity};
202     $line->{total_tax_included} = get_rounded_price($line->{unitprice_tax_included}) * $line->{quantity};
203
204     $line->{tax_value} = $line->{tax_value_on_receiving};
205     $line->{tax_rate} = $line->{tax_rate_on_receiving};
206
207     $foot{$$line{tax_rate}}{tax_rate} = $$line{tax_rate};
208     $foot{$$line{tax_rate}}{tax_value} += get_rounded_price($$line{tax_value});
209     $total_tax_value += $$line{tax_value};
210     $foot{$$line{tax_rate}}{quantity}  += $$line{quantity};
211     $total_quantity += $$line{quantity};
212     $foot{$$line{tax_rate}}{total_tax_excluded} += get_rounded_price($$line{total_tax_excluded});
213     $total_tax_excluded += get_rounded_price($$line{total_tax_excluded});
214     $foot{$$line{tax_rate}}{total_tax_included} += get_rounded_price($$line{total_tax_included});
215     $total_tax_included += get_rounded_price($$line{total_tax_included});
216
217     $line->{orderline} = $line->{parent_ordernumber};
218     push @orders_loop, $line;
219 }
220
221 push @foot_loop, map {$_} values %foot;
222
223 my $shipmentcost_budgetid = $details->{shipmentcost_budgetid};
224
225 # build budget list
226 my $budget_loop = [];
227 my $budgets     = GetBudgetHierarchy();
228 foreach my $r ( @{$budgets} ) {
229     next unless ( CanUserUseBudget( $loggedinuser, $r, $flags ) );
230
231     my $selected = $shipmentcost_budgetid ? $r->{budget_id} eq $shipmentcost_budgetid : 0;
232
233     push @{$budget_loop},
234       {
235         b_id     => $r->{budget_id},
236         b_txt    => $r->{budget_name},
237         b_active => $r->{budget_period_active},
238         selected => $selected,
239       };
240 }
241
242 @{$budget_loop} =
243   sort { uc( $a->{b_txt} ) cmp uc( $b->{b_txt} ) } @{$budget_loop};
244
245 my $adjustments = Koha::Acquisition::Invoice::Adjustments->search({ invoiceid => $details->{'invoiceid'} });
246 if ( $adjustments ) { $template->param( adjustments => $adjustments ); }
247
248 $template->param(
249     invoiceid                   => $details->{'invoiceid'},
250     invoicenumber               => $details->{'invoicenumber'},
251     suppliername                => $details->{'suppliername'},
252     booksellerid                => $details->{'booksellerid'},
253     shipmentdate                => $details->{'shipmentdate'},
254     billingdate                 => $details->{'billingdate'},
255     invoiceclosedate            => $details->{'closedate'},
256     shipmentcost                => $shipmentcost,
257     orders_loop                 => \@orders_loop,
258     foot_loop                   => \@foot_loop,
259     total_quantity              => $total_quantity,
260     total_tax_excluded          => $total_tax_excluded,
261     total_tax_included          => $total_tax_included,
262     total_tax_value             => $total_tax_value,
263     total_tax_excluded_shipment => $total_tax_excluded + $shipmentcost,
264     total_tax_included_shipment => $total_tax_included + $shipmentcost,
265     invoiceincgst               => $bookseller->invoiceincgst,
266     currency                    => Koha::Acquisition::Currencies->get_active,
267     budgets                     => $budget_loop,
268     budget                      => GetBudget( $shipmentcost_budgetid ),
269 );
270
271 defined( $invoice_files ) && $template->param( files => $invoice_files->GetFilesInfo() );
272
273 # FIXME
274 # Fonction dupplicated from basket.pl
275 # Code must to be exported. Where ??
276 sub get_infos {
277     my $order = shift;
278     my $bookseller = shift;
279     my $qty = $order->{'quantity'} || 0;
280     if ( !defined $order->{quantityreceived} ) {
281         $order->{quantityreceived} = 0;
282     }
283     my $budget = GetBudget( $order->{'budget_id'} );
284
285     my %line = %{ $order };
286     $line{order_received} = ( $qty == $order->{'quantityreceived'} );
287     $line{budget_name}    = $budget->{budget_name};
288
289     if ( $line{'title'} ) {
290         my $volume      = $order->{'volume'};
291         my $seriestitle = $order->{'seriestitle'};
292         $line{'title'} .= " / $seriestitle" if $seriestitle;
293         $line{'title'} .= " / $volume"      if $volume;
294     }
295
296     return \%line;
297 }
298
299 output_html_with_http_headers $input, $cookie, $template->output;