Bug 26023: Properly secure the cashup and refund actions
[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / pos / register.tt
1 [% USE raw %]
2 [% USE Asset %]
3 [% USE Koha %]
4 [% USE KohaDates %]
5 [% USE AuthorisedValues %]
6 [% USE Price %]
7 [% SET footerjs = 1 %]
8 [% PROCESS 'accounts.inc' %]
9 [% INCLUDE 'doc-head-open.inc' %]
10 <title>Koha &rsaquo; Cashup</title>
11 [% INCLUDE 'doc-head-close.inc' %]
12 [% Asset.css("lib/jquery/plugins/rowGroup/stylesheets/rowGroup.dataTables.min.css") | $raw %]
13 </head>
14
15 <body id="register" class="pos">
16 [% INCLUDE 'header.inc' %]
17 [% INCLUDE 'circ-search.inc' %]
18
19 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/pos/pay.pl">Point of sale</a> &rsaquo; Register details</div>
20
21 <div class="main container-fluid">
22     <div class="row">
23         <div class="col-sm-10 col-sm-push-2">
24
25             [% IF ( error_registers ) %]
26                 <div id="error_message" class="dialog message">
27                     <p>
28                         You must have at least one cash register associated with the library before you can record payments.
29                     </p>
30                     [% IF ( CAN_user_parameters_manage_cash_registers ) %]
31                         <form action="/cgi-bin/koha/admin/cash_registers.pl" method="get">
32                             <input type="hidden" name="op" value="add_form" />
33                             <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button>
34                         </form>
35                     [% END %]
36                 </div>
37             [% ELSE %]
38
39             [% IF ( error_cashup_permission ) %]
40             <div id="error_message" class="dialog alert">
41                 You do not have permission to perform cashup actions.
42             </div>
43             [% END %]
44
45             [% IF ( error_refund_permission ) %]
46             <div id="error_message" class="dialog alert">
47                 You do not have permission to perform refund actions.
48             </div>
49             [% END %]
50
51             [% IF ( CAN_user_cash_management_cashup ) %]
52             <div id="toolbar" class="btn-toolbar">
53                 <button id="pos_cashup" type="button" class="btn btn-default" data-toggle="modal" data-target="#confirmCashupModal" ><i class="fa fa-money"></i> Record cashup</button>
54             </div>
55             [% END %]
56
57             <h1>Register transaction details for [% register.name | html %]</h1>
58
59             <h2>Summary</h2>
60             <ul>
61                 [% IF register.last_cashup %]
62                 <li>Last cashup: [% register.last_cashup.timestamp | $KohaDates with_hours => 1 %]</li>
63                 [% END %]
64                 <li>Float: [% register.starting_float | $Price %]</li>
65                 <li>Total income (cash): [% accountlines.credits_total * -1 | $Price %] ([% accountlines.credits_total(payment_type => 'CASH') * -1 | $Price %])</li>
66                 <li>Total outgoing (cash): [% accountlines.debits_total * -1 | $Price %] ([% accountlines.debits_total( payment_type => 'CASH') * -1 | $Price %])</li>
67                 <li>Total bankable: [% accountlines.total( payment_type => 'CASH') * -1 | $Price %]</li>
68             </ul>
69
70             [% IF register.last_cashup %]
71             <h2>Transactions since [% register.last_cashup.timestamp | $KohaDates with_hours => 1 %]</h2>
72             [% ELSE %]
73             <h2>Transactions to date</h2>
74             [% END %]
75             <table id="sales" class="table_sales">
76                 <thead>
77                     <th>ID</th>
78                     <th>DATA</th>
79                     <th>Transaction</th>
80                     <th>Description</th>
81                     <th>Price</th>
82                     <th>Total</th>
83                     <th>Actions</th>
84                 </thead>
85                 <tbody>
86                     [% FOREACH accountline IN accountlines %]
87                         [% IF accountline.is_credit %]
88                             [% FOREACH credit IN accountline.credit_offsets %]
89                             [% IF credit.debit %]
90                             <tr>
91                                 <td>[% accountline.accountlines_id | html %]</td>
92                                 <td>{ "type": "credit", "identifier": "[%- accountline.credit_number | html -%]", "description": "[%- PROCESS account_type_description account=accountline -%] ([% accountline.payment_type | html %])", "amount": "[% accountline.amount * -1 | $Price %]" }</td>
93                                 <td></td>
94                                 <td>
95                                     [%- PROCESS account_type_description account=credit.debit -%]
96                                     [%- IF credit.debit.description -%] ([% credit.debit.description | html %])[%- END -%]
97                                     [%- IF ( credit.debit.itemnumber ) -%] (<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% credit.debit.item.biblionumber | uri %]&amp;itemnumber=[% credit.debit.itemnumber | uri %]">[% credit.debit.item.biblio.title | html %]</a>)[%- END -%]
98                                 </td>
99                                 <td>[% credit.debit.amount | $Price %]</td>
100                                 <td></td>
101                                 <td>
102                                     [% IF CAN_user_cash_management_anonymous_refund && !(credit.debit.status == 'REFUNDED' ) %]
103                                     <button type="button" class="btn btn-default btn-xs" data-toggle="modal" data-target="#issueRefundModal" data-item="[%- PROCESS account_type_description account=credit.debit -%]" data-accountline="[% credit.debit.accountlines_id | html %]" data-amount="[% credit.debit.amount | $Price %]" data-quantity="[% credit.debit.note | html %]"><i class="fa fa-money"></i> Issue refund</button>
104                                     [% ELSIF CAN_user_updatecharges_refund && !(credit.debit.status == 'REFUNDED') && credit.debit.borrowernumber %]
105                                     <button type="button" class="btn btn-default btn-xs" data-toggle="modal" data-target="#issueRefundModal" data-item="[%- PROCESS account_type_description account=credit.debit -%]" data-accountline="[% credit.debit.accountlines_id | html %]" data-amount="[% credit.debit.amount | $Price %]" data-quantity="[% credit.debit.note | html %]"><i class="fa fa-money"></i> Issue refund</button>
106                                     [% END %]
107                                 </td>
108                             </tr>
109                             [% END %]
110                             [% END %]
111                         [% ELSE %]
112                             [% FOREACH debit IN accountline.debit_offsets %]
113                             [% IF debit.credit %]
114                             <tr>
115                                 <td>[% accountline.accountlines_id | html %]</td>
116                                 <td>{ "type": "debit", "identifier": "[%- accountline.credit_number | html -%]", "description": "[%- PROCESS account_type_description account=accountline -%] ([% accountline.payment_type | html %])", "amount": "[% accountline.amount * -1 | $Price %]" }</td>
117                                 <td></td>
118                                 <td>[%- PROCESS account_type_description account=debit.credit -%]</td>
119                                 <td>
120                                     [%- IF debit.credit.description %][% debit.credit.description | html %][%- END -%]
121                                     [%- IF ( debit.credit.itemnumber ) -%] (<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% debit.credit.item.biblionumber | uri %]&amp;itemnumber=[% debit.credit.itemnumber | uri %]">[% debit.credit.item.biblio.title | html %]</a>)[%- END -%]
122                                 </td>
123                                 <td>[% debit.credit.amount | $Price %]</td>
124                                 <td></td>
125                             </tr>
126                             [% END %]
127                             [% END %]
128                         [% END %]
129                     [% END %]
130                 </tbody>
131                 <tfoot>
132                     <tr>
133                         <td colspan="5">Total income: </td>
134                         <td>[% accountlines.total * -1 | $Price %]</td>
135                         <td></td>
136                     </tr>
137                 </tfoot>
138             </table>
139             [% END %]
140
141             [% IF register.cashups %]
142             <h2>Older transactions</h2>
143             <form method="GET" action="/cgi-bin/koha/pos/register.pl">
144                 <fieldset class="rows">
145                     Please select a date range to display transactions for:
146                     <ol>
147                         <li>
148                             <label for="trange_f">From: </label>
149                             <input type="text" size="10" id="from" class="datepickerfrom" name="trange_f" value="[% trange_f | html %]"/>
150                             <label class="inline" for="trange_t">To: </label>
151                             <input type="text" size="10" id="to" class="datepickerto" name="trange_t" value="[% trange_t | html %]" />
152                             <span class="hint">[% INCLUDE 'date-format.inc' %]</span>
153                         </li>
154                     </ol>
155                 </fieldset>
156
157                 <div class="action">
158                     <input type="hidden" name="registerid" value="[% register.id | html %]">
159                     <input type="submit" value="Display" />
160                 </div>
161             </form>
162
163             [% IF trange_f %]
164             <table id="past_sales" class="past_sales_table">
165                 <thead>
166                     <th>ID</th>
167                     <th>DATA</th>
168                     <th>Transaction</th>
169                     <th>Description</th>
170                     <th>Price</th>
171                     <th>Total</th>
172                     <th>Actions</th>
173                 </thead>
174                 <tbody>
175                     [% FOREACH accountline IN past_accountlines %]
176                         [% IF accountline.is_credit %]
177                             [% FOREACH credit IN accountline.credit_offsets %]
178                             [% IF credit.debit %]
179                             <tr>
180                                 <td>[% accountline.accountlines_id | html %]</td>
181                                 <td>{ "type": "credit", "identifier": "[%- accountline.credit_number | html -%]", "description": "[%- PROCESS account_type_description account=accountline -%] ([% accountline.payment_type | html %])", "amount": "[% accountline.amount * -1 | $Price %]" }</td>
182                                 <td></td>
183                                 <td>
184                                     [%- PROCESS account_type_description account=credit.debit -%]
185                                     [%- IF credit.debit.description -%] ([% credit.debit.description | html %])[%- END -%]
186                                     [%- IF ( credit.debit.itemnumber ) -%] (<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% credit.debit.item.biblionumber | uri %]&amp;itemnumber=[% credit.debit.itemnumber | uri %]">[% credit.debit.item.biblio.title | html %]</a>)[%- END -%]
187                                 </td>
188                                 <td>[% credit.debit.amount | $Price %]</td>
189                                 <td></td>
190                                 <td>
191                                     [% IF CAN_user_cash_management_refund_cash_registers && !(credit.debit.status == 'REFUNDED' ) %]
192                                     <button type="button" class="btn btn-default btn-xs pos_refund" data-toggle="modal" data-target="#issueRefundModal" data-item="[%- PROCESS account_type_description account=credit.debit -%]" data-accountline="[% credit.debit.accountlines_id | html %]" data-amount="[% credit.debit.amount | $Price %]" data-quantity="[% credit.debit.note | html %]"><i class="fa fa-money"></i> Issue refund</button>
193                                     [% END %]
194                                 </td>
195                             </tr>
196                             [% END %]
197                             [% END %]
198                         [% ELSE %]
199                             [% FOREACH debit IN accountline.debit_offsets %]
200                             [% IF debit.credit %]
201                             <tr>
202                                 <td>[% accountline.accountlines_id | html %]</td>
203                                 <td>{ "type": "debit", "identifier": "[%- accountline.credit_number | html -%]", "description": "[%- PROCESS account_type_description account=accountline -%] ([% accountline.payment_type | html %])", "amount": "[% accountline.amount * -1 | $Price %]" }</td>
204                                 <td></td>
205                                 <td>[%- PROCESS account_type_description account=debit.credit -%]</td>
206                                 <td>[%- IF debit.credit.description %][% debit.credit.description | html %][% END %]
207         &nbsp;[% IF ( debit.credit.itemnumber ) %]<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% debit.credit.item.biblionumber | uri %]&amp;itemnumber=[% debit.credit.itemnumber | uri %]">[% debit.credit.item.biblio.title | html %]</a>[% END %]</td>
208                                 <td>[% debit.credit.amount | $Price %]</td>
209                                 <td></td>
210                             </tr>
211                             [% END %]
212                             [% END %]
213                         [% END %]
214                     [% END %]
215                 </tbody>
216                 <tfoot>
217                     <tr>
218                         <td colspan="5">Total income: </td>
219                         <td>[% past_accountlines.total * -1 | $Price %]</td>
220                         <td></td>
221                     </tr>
222                 </tfoot>
223             </table>
224             [% END %]
225
226             [% END %]
227         </div>
228
229         <div class="col-sm-2 col-sm-pull-10">
230             <aside>
231                 [% INCLUDE 'pos-menu.inc' %]
232             </aside>
233         </div>
234     </div><!-- /.row -->
235
236     <!-- Confirm cashup modal -->
237     <div class="modal" id="confirmCashupModal" tabindex="-1" role="dialog" aria-labelledby="confirmCashupLabel">
238         <div class="modal-dialog" role="document">
239             <div class="modal-content">
240                 <div class="modal-header">
241                     <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
242                     <h4 class="modal-title" id="confirmCashupLabel">Confirm cashup of <em>[% register.description | html %]</em></h4>
243                 </div>
244                 <div class="modal-body">
245                     Please confirm that you have removed [% accountlines.total( payment_type => 'CASH') * -1 | $Price %] from the cash register and left a float of [% register.starting_float | $Price %].
246                 </div> <!-- /.modal-body -->
247                 <div class="modal-footer">
248                     <a href="/cgi-bin/koha/pos/register.pl?op=cashup" class="btn btn-default" id="pos_cashup_confirm">Confirm</a>
249                     <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
250                 </div> <!-- /.modal-footer -->
251             </div> <!-- /.modal-content -->
252         </div> <!-- /.modal-dialog -->
253     </div> <!-- /#confirmCashupModal -->
254
255     <!-- Issue refund modal -->
256     <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel">
257         <form id="refund_form" method="post" enctype="multipart/form-data" class="validated">
258             <input type="hidden" name="accountline" value="" id="refundline">
259             <div class="modal-dialog" role="document">
260                 <div class="modal-content">
261                     <div class="modal-header">
262                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
263                         <h4 class="modal-title" id="issueRefundLabel">Issue refund from <em>[% register.description | html %]</em></h4>
264                     </div>
265                     <div class="modal-body">
266                         <fieldset class="rows">
267                             <ol>
268                                 <li>
269                                     <span id="item" class="label">Item: </span><span></span>
270                                 </li>
271                                 <li>
272                                     <span id="paid" class="label">Amount paid: </span><span></span>
273                                 </li>
274                                 <li>
275                                     <label class="required" for="amount">Returned to patron: </label>
276                                     <input type="number" step="0.01" id="returned" name="amount" min="0.00" required="required">
277                                     <span class="required">Required</span>
278                                 </li>
279                                 [% SET payment_types = [] %]
280                                 [% FOR pt IN AuthorisedValues.GetAuthValueDropbox('PAYMENT_TYPE') %]
281                                     [% NEXT IF pt.authorised_value.grep("^SIP[[:digit:]]{2}$").size() %]
282                                     [% payment_types.push(pt) %]
283                                 [% END %]
284                                 <li>
285                                     <label for="transaction_type">Transaction type: </label>
286                                     <select name="transaction_type" id="transaction_type">
287                                         [% FOREACH pt IN payment_types %]
288                                             <option value="[% pt.authorised_value | html %]">[% pt.lib | html %]</option>
289                                         [% END %]
290                                     </select>
291                                 </li>
292                             </ol>
293                         </fieldset> <!-- /.rows -->
294                     </div> <!-- /.modal-body -->
295                     <div class="modal-footer">
296                         <input type="hidden" name="registerid" value="[% register.id | html %]">
297                         <input type="hidden" name="op" value="refund">
298                         <button type="submit" class="btn btn-default" id="pos_refund_confirm">Confirm</button>
299                         <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
300                     </div> <!-- /.modal-footer -->
301                 </div> <!-- /.modal-content -->
302             </div> <!-- /.modal-dialog -->
303         </form> <!-- /#refund_form -->
304     </div> <!-- /#issueRefundModal -->
305
306 [% MACRO jsinclude BLOCK %]
307     [% INCLUDE 'datatables.inc' %]
308     [% Asset.js("lib/jquery/plugins/rowGroup/dataTables.rowGroup.min.js") | $raw %]
309     [% INCLUDE 'calendar.inc' %]
310     <script>
311         var sales_table = $("#sales").dataTable($.extend(true, {}, dataTablesDefaults, {
312             orderFixed: [ 0, 'asc'],
313             columnDefs: [ {
314                 targets: [ 0, 1 ],
315                 visible: false
316             }],
317             rowGroup: {
318                 dataSrc: 0,
319                 startRender: function ( rows, group ) {
320                     var details = JSON.parse(rows.data().pluck(1).pop());
321                     var identifier = details.identifier || group;
322                     return $('<tr class="'+details.type+'"/>')
323                         .append( '<td>'+identifier+'</td>' )
324                         .append( '<td colspan="2">'+details.description+'</td>' )
325                         .append( '<td>'+details.amount+'</td>' )
326                         .append( '<td><button class="printReceipt btn btn-default btn-xs" data-accountline="'+group+'"><i class="fa fa-print"></i> ' + _("Print receipt") + '</button></td>');
327                 },
328                 endRender: null,
329             }
330         }));
331
332         var past_sales_table = $("#past_sales").dataTable($.extend(true, {}, dataTablesDefaults, {
333             orderFixed: [ 0, 'asc'],
334             columnDefs: [ {
335                 targets: [ 0, 1 ],
336                 visible: false
337             }],
338             rowGroup: {
339                 dataSrc: 0,
340                 startRender: function ( rows, group ) {
341                     var details = JSON.parse(rows.data().pluck(1).pop());
342                     var identifier = details.identifier || group;
343                     return $('<tr class="'+details.type+'"/>')
344                         .append( '<td>'+identifier+'</td>' )
345                         .append( '<td colspan="2">'+details.description+'</td>' )
346                         .append( '<td>'+details.amount+'</td>' )
347                         .append( '<td><button class="printReceipt btn btn-default btn-xs" data-accountline="'+group+'"><i class="fa fa-print"></i> Print receipt</button></td>');
348                 },
349                 endRender: null,
350             }
351         }));
352
353         $("#issueRefundModal").on("shown.bs.modal", function(e){
354            var button = $(e.relatedTarget);
355            var item = button.data('item');
356            $("#item + span").replaceWith(item);
357            var accountline = button.data('accountline');
358            $('#refundline').val(accountline);
359            var amount = button.data('amount');
360            $("#paid + span").replaceWith(amount);
361            $("#returned").attr({ "value": amount, "max": amount });
362            $("#returned, #transaction_type").focus();
363         });
364
365         $(".printReceipt").click(function() {
366             var accountlines_id = $(this).data('accountline');
367             var win = window.open('/cgi-bin/koha/pos/printreceipt.pl?action=print&accountlines_id=' + accountlines_id, '_blank');
368             win.focus();
369         });
370
371         $(document).ready(function() {
372             // http://jqueryui.com/demos/datepicker/#date-range
373             var dates = $( "#from, #to" ).datepicker({
374                 changeMonth: true,
375                 numberOfMonths: 1,
376                 onSelect: function( selectedDate ) {
377                     var option = this.id == "from" ? "minDate" : "maxDate",
378                         instance = $( this ).data( "datepicker" );
379                         date = $.datepicker.parseDate(
380                             instance.settings.dateFormat ||
381                             $.datepicker._defaults.dateFormat,
382                             selectedDate, instance.settings );
383                     dates.not( this ).datepicker( "option", option, date );
384                 }
385             });
386         });
387     </script>
388 [% END %]
389
390 [% INCLUDE 'intranet-bottom.inc' %]