Bug 19611: Fix XSS Flaws in supplier.pl
[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / acqui / supplier.tt
1 [% USE KohaDates %]
2 [% BLOCK edit_contact %]
3     <ol id="contact-form">
4         <input type="hidden" name="contact_id" value="[% contact.id %]" />
5         <li><label for="contact_name[% contact.id %]">Contact name: </label>
6             <input type="text" size="40" id="contact_name[% contact.id %]" name="contact_name" value="[% contact.name %]" /></li>
7         <li><label for="contact_position[% contact.id %]">Position: </label>
8             <input type="text" size="40" id="contact_position[% contact.id %]" name="contact_position" value="[% contact.position %]" /></li>
9         <li><label for="contact_phone[% contact.id %]">Phone: </label>
10                 <input type="text" size="20" id="contact_phone[% contact.id %]" name="contact_phone" value="[% contact.phone %]" /> </li>
11         <li><label for="contact_altphone[% contact.id %]">Alternative phone: </label>
12             <input type="text" size="20" id="contact_altphone[% contact.id %]" name="contact_altphone" value="[% contact.altphone %]" /></li>
13         <li><label for="contact_fax[% contact.id %]">Fax: </label>
14             <input type="text" size="20" id="contact_fax[% contact.id %]" name="contact_fax" value="[% contact.fax %]" /></li>
15         <li><label for="contact_email[% contact.id %]">Email: </label>
16             <input type="text" size="40" id="contact_email[% contact.id %]" name="contact_email" value="[% contact.email %]" class="email" /></li>
17         <li><label for="contact_notes[% contact.id %]">Notes: </label>
18             <textarea id="contact_notes[% contact.id %]" name="contact_notes" cols="40" rows="4">[% contact.notes %]</textarea></li>
19         <li><label for="contact_acqprimary[% contact.id %]">Primary acquisitions contact:</label>
20             [% IF contact.acqprimary %]
21                 <input type="checkbox" id="contact_acqprimary[% contact.id %]" class="contact_acqprimary" checked="checked"></input>
22             [% ELSE %]
23                 <input type="checkbox" id="contact_acqprimary[% contact.id %]" class="contact_acqprimary"></input>
24             [% END %]
25             <input type="hidden" class="contact_acqprimary_hidden" name="contact_acqprimary" value="[% contact.acqprimary %]"></input>
26         <li><label for="contact_serialsprimary[% contact.id %]">Primary serials contact:</label>
27             [% IF contact.serialsprimary %]
28                 <input type="checkbox" id="contact_serialsprimary[% contact.id %]" class="contact_serialsprimary" checked="checked"></input>
29             [% ELSE %]
30                 <input type="checkbox" id="contact_serialsprimary[% contact.id %]" class="contact_serialsprimary"></input>
31             [% END %]
32             <input type="hidden" class="contact_serialsprimary_hidden" name="contact_serialsprimary" value="[% contact.serialsprimary %]"></input>
33         <li><label for="contact_orderacquisition[% contact.id %]">Contact when ordering?</label>
34             [% IF contact.orderacquisition %]
35                 <input type="checkbox" id="contact_orderacquisition[% contact.id %]" class="contact_orderacquisition" checked="checked"></input>
36             [% ELSE %]
37                 <input type="checkbox" id="contact_orderacquisition[% contact.id %]" class="contact_orderacquisition"></input>
38             [% END %]
39             <input type="hidden" class="contact_orderacquisition_hidden" name="contact_orderacquisition" value="[% contact.orderacquisition %]"></input>
40         <li><label for="contact_claimacquisition[% contact.id %]">Contact about late orders?</label>
41             [% IF contact.claimacquisition %]
42                 <input type="checkbox" id="contact_claimacquisition[% contact.id %]" class="contact_claimacquisition" checked="checked"></input>
43             [% ELSE %]
44                 <input type="checkbox" id="contact_claimacquisition[% contact.id %]" class="contact_claimacquisition"></input>
45             [% END %]
46             <input type="hidden" class="contact_claimacquisition_hidden" name="contact_claimacquisition" value="[% contact.claimacquisition %]"></input>
47         <li><label for="contact_claimissues[% contact.id %]">Contact about late issues?</label>
48             [% IF contact.claimissues %]
49                 <input type="checkbox" id="contact_claimissues[% contact.id %]" class="contact_claimissues" checked="checked"></input>
50             [% ELSE %]
51                 <input type="checkbox" id="contact_claimissues[% contact.id %]" class="contact_claimissues"></input>
52             [% END %]
53             <input type="hidden" class="contact_claimissues_hidden" name="contact_claimissues" value="[% contact.claimissues %]"></input>
54         </li>
55         [% IF contact.id %]<li><button class="btn delete-contact"><i class="fa fa-trash"></i> Delete contact</li>[% END %]
56     </ol>
57 [% END %]
58
59 [% BLOCK show_contact %]
60     <h3>[% contact.name |html %]</h3>
61     <p><span class="label">Position: </span>[% contact.position |html %]</p>
62     <p><span class="label">Phone: </span>[% contact.phone |html %]</p>
63     <p><span class="label">Alternative phone: </span>[% contact.altphone |html %]</p>
64     <p><span class="label">Fax: </span>[% contact.fax |html %]</p>
65     [% IF ( contact.email ) %]
66         <p><span class="label">Email: </span><a href="mailto:[% contact.email %]">[% contact.email %]</a></p>
67     [% END %]
68     [% IF ( contact.notes ) %]
69         <p><span class="label">Notes: </span>[% contact.notes |html %]</p>
70     [% END %]
71     [% IF ( contact.acqprimary ) %]
72         <p><span class="label">Primary acquisitions contact</span></p>
73     [% END %]
74     [% IF ( contact.serialsprimary ) %]
75         <p><span class="label">Primary serials contact</span></p>
76     [% END %]
77     [% IF ( contact.orderacquisition ) %]
78         <p><span class="label">Receives orders</span></p>
79     [% END %]
80     [% IF ( contact.claimacquisition ) %]
81         <p><span class="label">Receives claims for late orders</span></p>
82     [% END %]
83     [% IF ( contact.claimissues ) %]
84         <p><span class="label">Receives claims for late issues</span></p>
85     [% END %]
86 [% END %]
87
88 [% INCLUDE 'doc-head-open.inc' %]
89 <title>Koha &rsaquo; Vendor [% name %]</title>
90 <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
91 [% INCLUDE 'doc-head-close.inc' %]
92 [% INCLUDE 'datatables.inc' %]
93
94 <script type="text/javascript">
95 //<![CDATA[
96 function confirm_deletion() {
97     if (confirm(_("Confirm deletion of this vendor ?"))) {
98         window.location="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]&op=delete";
99     }
100 }
101
102 function add_contact() {
103     var new_contact = $('#contact-template').clone();
104     var timestamp = new Date().getTime();
105     $(new_contact).removeAttr('id');
106     $('input, textarea', new_contact).each(function () {
107         $(this).attr('id', $(this).attr('id') + '_' + timestamp);
108     });
109     $('label', new_contact).each(function () {
110         $(this).attr('for', $(this).attr('for') + '_' + timestamp);
111     });
112     $(new_contact).insertBefore(this);
113     if ($('.supplier-contact').length === 2) { // First contact
114         $.each(['.contact_acqprimary', '.contact_serialsprimary', '.contact_orderacquisition', '.contact_claimacquisition', '.contact_claimissues'], function (idx, checkbox) {
115             $(checkbox, new_contact).click();
116         });
117     }
118     $('input[name="contact_name"]', new_contact).focus();
119     return false;
120 }
121
122 function delete_contact(ev) {
123     $(this).parents('.supplier-contact').remove();
124     ev.preventDefault();
125 }
126
127  $(document).ready(function() {
128     var contractst = $("#contractst").dataTable($.extend(true, {}, dataTablesDefaults, {
129         "aoColumnDefs": [
130           { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
131           { "sType": "title-string", "aTargets" : [ "title-string" ] }
132         ],
133         'sDom': 't'
134     } ) );
135     $('body').on('click', '.delete-contact', null, delete_contact);
136     $('#add-contact').click(add_contact);
137     $('body').on('click', '.contact_acqprimary', null, function () {
138         if ($(this).is(':checked')) {
139             $('.contact_acqprimary').filter(':checked').not(this).prop('checked', false);
140             $('.contact_acqprimary_hidden').each(function () {
141                 $(this).val('0');
142             });
143         }
144         $(this).next('.contact_acqprimary_hidden').val('1');
145     });
146     $('body').on('click', '.contact_serialsprimary', null, function () {
147         if ($(this).is(':checked')) {
148             $('.contact_serialsprimary').filter(':checked').not(this).prop('checked', false);
149             $('.contact_serialsprimary_hidden').each(function () {
150                 $(this).val('0');
151             });
152         }
153         $(this).next('.contact_serialsprimary_hidden').val($(this).is(':checked') ? '1' : '0');
154     });
155     $('body').on('click', '.contact_orderacquisition', null, function () {
156         $(this).next('.contact_orderacquisition_hidden').val($(this).is(':checked') ? '1' : '0');
157     });
158     $('body').on('click', '.contact_claimacquisition', null, function () {
159         $(this).next('.contact_claimacquisition_hidden').val($(this).is(':checked') ? '1' : '0');
160     });
161     $('body').on('click', '.contact_claimissues', null, function () {
162         $(this).next('.contact_claimissues_hidden').val($(this).is(':checked') ? '1' : '0');
163     });
164  });
165 //]]>
166 </script>
167 </head>
168 <body id="acq_supplier" class="acq">
169 [% INCLUDE 'header.inc' %]
170 [% INCLUDE 'acquisitions-search.inc' %]
171
172 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> &rsaquo; Update: [% name |html %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div>
173
174 <div id="doc3" class="yui-t2">
175
176 <div id="bd">
177     <div id="yui-main">
178     <div class="yui-b">
179     [% IF ( enter ) %]
180         [% IF ( booksellerid ) %]
181         <h1>Update: [% name |html %]</h1>
182     [% ELSE %]
183         <h1>Add vendor</h1>
184     [% END %]
185     [% END %]
186 [% UNLESS ( enter ) %][% INCLUDE 'acquisitions-toolbar.inc' %][% END %]
187 [% IF ( enter ) %]
188     <form action="updatesupplier.pl" name="updatesupplier" class="validated" method="post">
189     <div class="yui-g">
190         <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
191         <fieldset class="rows">
192             <legend>Company details</legend>
193             <ol><li><label for="company" class="required">Name:</label>
194                 <input type="text" size="40" id="company" name="company" value="[% name %]" required="required" class="required" /><span class="required">Required</span></li>
195             <li><label for="company_postal">Postal address: </label>
196                     <textarea id="company_postal" name="company_postal" cols="40" rows="3">[% postal %]</textarea></li>
197             <li><label for="physical">Physical address: </label>
198                 <textarea id="physical" name="physical" cols="40" rows="3">[% address1 %][% address2 %][% address3 %][% address4 %]</textarea></li>
199             <li><label for="company_phone">Phone: </label>
200                 <input type="text" size="20" id="company_phone" name="company_phone" value="[% phone %]" /></li>
201             <li><label for="company_fax">Fax: </label>
202                 <input type="text" size="20" id="company_fax" name="company_fax" value="[% fax %]" /></li>
203             <li><label for="website">Website: </label>
204                 <input type="text" size="40" id="website" name="website" value="[% url %]" class="url" /></li>
205             <li><label for="accountnumber">Account number: </label>
206                 <input type="text" size="40" id="accountnumber" name="accountnumber" value="[% accountnumber %]" /></li></ol>
207         </fieldset>
208         <fieldset class="rows">
209             <legend>Contacts</legend>
210             <fieldset id="contact-template" class="supplier-contact">
211                 <legend>Contact details</legend>
212                 [% INCLUDE edit_contact %]
213             </fieldset>
214             [% FOREACH contact IN contacts %]
215                 <fieldset class="supplier-contact">
216                     <legend>Contact details</legend>
217                     [% INCLUDE edit_contact %]
218                 </fieldset>
219             [% END %]
220             <button id="add-contact" class="btn"><i class="fa fa-plus"></i> Add another contact</button>
221         </fieldset>
222     </div>
223         <div class="yui-g">
224         <fieldset class="rows">
225             <legend>Ordering information</legend>
226             <ol class="radio"><li><label for="activestatus" class="radio">Vendor is:</label>
227                     [% IF ( active ) %]
228                         <label for="activestatus">Active</label> <input type="radio" id="activestatus" name="status" value="1" checked="checked" />
229                         <label for="inactivestatus">Inactive</label> <input type="radio" id="inactivestatus" name="status" value="0" />
230                     [% ELSE %]
231                         <label for="activestatus">Active</label> <input type="radio" id="activestatus" name="status" value="1" />
232                         <label for="inactivestatus">Inactive</label> <input type="radio" id="inactivestatus" name="status" value="0" checked="checked" />
233                     [% END %]</li>
234             </ol>
235             <ol>
236             <li><label for="list_currency">List prices are: </label>
237                 <select name="list_currency" id="list_currency">
238                     [% FOREACH c IN currencies %]
239                         [% IF booksellerid and c.currency == listprice or not booksellerid and c.active %]
240                             <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
241                         [% ELSIF not c.archived %]
242                             <option value="[% c.currency %]">[% c.currency %]</option>
243                         [% END %]
244                     [% END %]
245                 </select>
246             </li>
247             <li><label for="invoice_currency">Invoice prices are: </label>
248                 <select name="invoice_currency" id="invoice_currency">
249                     [% FOREACH c IN currencies %]
250                         [% IF booksellerid and c.currency == invoiceprice or not booksellerid and c.active %]
251                             <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
252                         [% ELSIF not c.archived %]
253                             <option value="[% c.currency %]">[% c.currency %]</option>
254                         [% END %]
255                     [% END %]
256                 </select>
257             </li>
258             </ol>
259             <ol class="radio">
260             <li><label for="gstyes" class="radio">Tax number registered:</label>
261                 [% IF ( gstreg ) %]
262                     <label for="gstyes">Yes</label> <input type="radio" name="gst" id="gstyes" value="1" checked="checked" />
263                     <label for="gstno">No</label> <input type="radio" name="gst" id="gstno" value="0" />
264                 [% ELSE %]
265                     <label for="gstyes">Yes</label> <input type="radio" name="gst" id="gstyes" value="1" />
266                     <label for="gstno">No</label> <input type="radio" name="gst" id="gstno" value="0" checked="checked" />
267                 [% END %]</li>
268             
269             <li><label for="list_gstyes" class="radio">List prices:</label>
270                 [% IF ( listincgst ) %]
271                     <label for="list_gstyes">Include tax</label> <input type="radio" id="list_gstyes" name="list_gst" value="1" checked="checked" />
272                     <label for="list_gstno">Don't include tax</label> <input type="radio" id="list_gstno" name="list_gst" value="0" />
273                 [% ELSE %]
274                     <label for="list_gstyes">Include tax</label> <input type="radio" id="list_gstyes" name="list_gst" value="1" />
275                     <label for="list_gstno">Don't include tax</label> <input type="radio" id="list_gstno" name="list_gst" value="0" checked="checked" />
276                 [% END %]</li>
277             
278             <li><label for="invoice_gstyes" class="radio">Invoice prices:</label>
279                 [% IF ( invoiceincgst ) %]
280                     <label for="invoice_gstyes">Include tax</label> <input type="radio" id="invoice_gstyes" name="invoice_gst" value="1" checked="checked" />
281                     <label for="invoice_gstno">Don't include tax</label> <input type="radio" id="invoice_gstno" name="invoice_gst" value="0" />
282                     [% ELSE %]
283                     <label for="invoice_gstyes">Include tax</label> <input type="radio" id="invoice_gstyes" name="invoice_gst" value="1" />
284                     <label for="invoice_gstno">Don't include tax</label> <input type="radio" id="invoice_gstno" name="invoice_gst" value="0" checked="checked" />
285                 [% END %]</li>
286             </ol>
287             [% IF gst_values %]
288                 <ol>
289                   <li>
290                     <label for="tax_rate">Tax rate: </label>
291                     <select name="tax_rate" id="tax_rate">
292                     [% FOREACH gst IN gst_values %]
293                       [% IF ( tax_rate == gst.option ) %]
294                         <option value="[% gst.option %]" selected="selected">[% gst.option * 100 %] %</option>
295                       [% ELSE %]
296                         <option value="[% gst.option %]">[% gst.option * 100 %] %</option>
297                       [% END %]
298                     [% END %]
299                     </select>
300                   </li>
301                 </ol>
302             [% ELSE %]
303                 <input type="hidden" name="tax_rate" value="0" />
304             [% END %]
305             <ol>
306             <li><label for="discount">Discount: </label>
307                 <input type="text" size="6" id="discount" name="discount" value="[% discount | format ("%.1f") %]" />%</li>
308             <li>
309                 <label for="deliverytime">Delivery time: </label>
310                 <input type="text" size="2" id="deliverytime" name="deliverytime" value="[% deliverytime %]" /> days
311             </li>
312             <li><label for="notes">Notes: </label>
313                 <textarea cols="40" rows="4" id="notes" name="notes" >[% notes %]</textarea></li></ol>
314         </fieldset>
315         <fieldset class="action"><input type="submit" value="Save" /> [% IF ( booksellerid ) %]
316         <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% ELSE %]<a class="cancel" href="/cgi-bin/koha/acqui/acqui-home.pl">
317         [% END %]Cancel</a></fieldset>
318         </div>
319     </form>
320 [% ELSE %]
321     <h1>[% name |html %]</h1>
322         <div class="yui-g">
323             <div id="supplier-company-details" class="yui-u first">
324                 <h2>Vendor details</h2>
325                 <p><span class="label">Company name: </span>[% name |html %]</p>
326                 <p><span class="label">Postal address: </span>[% postal |html %]</p>
327                 <p><span class="label">Physical address: </span>[% address1 |html %][% address2 |html %][% address3 |html %][% address4 |html %]</p>
328                 <p><span class="label">Phone: </span>[% phone |html %]</p>
329                 <p><span class="label">Fax: </span>[% fax |html %]</p>
330                 [% IF ( url ) %]
331                     <p><span class="label">Website: </span><a href="[% url %]">[% url %]</a></p>
332                 [% END %]
333                 [% IF ( accountnumber ) %]
334                     <p><span class="label">Account number: </span>[% accountnumber |html %]</p>
335                 [% END %]
336
337             <div id="supplier-ordering-information">
338             <h2>Ordering information</h2>
339                 <p><strong>Vendor is: </strong>
340                         [% IF ( active ) %]
341                             Active
342                         [% ELSE %]
343                             Inactive
344                         [% END %]</p>
345                 <p><strong>List prices are: </strong>[% listprice %]</p>
346                 <p><strong>Invoice prices are: </strong>[% invoiceprice %]</p>
347                 [% IF ( tax_rate ) %]<p><strong>Tax number registered: </strong>
348                         [% IF ( gstreg ) %]Yes[% ELSE %]No[% END %]</p>
349                 <p><strong>List item price includes tax: </strong>
350                         [% IF ( listincgst ) %]Yes[% ELSE %]No[% END %]</p>
351                 <p><strong>Invoice item price includes tax: </strong>
352                         [% IF ( invoiceincgst ) %]Yes[% ELSE %]No[% END %]</p>[% END %]
353                 <p><strong>Discount: </strong>
354                     [% discount | format("%.1f") %] %</p>
355                 <p><strong>Tax rate: </strong>
356                     [% ( tax_rate || 0 ) * 100 %] %</p>
357                 [% IF deliverytime.defined %]
358                     <p><strong>Delivery time: </strong>
359                         [% deliverytime %] days</p>
360                 [% END %]
361                 [% IF ( notes ) %]<p><strong>Notes: </strong>
362                     [% notes |html %]</p>[% END %]
363             </div>
364             </div>
365
366             <div class="supplier-contact-details yui-u">
367                 <h2>Contact</h2>
368                 [% FOREACH contact IN contacts %]
369                     [% INCLUDE show_contact %]
370                 [% END %]
371             </div>
372
373         </div>
374
375         [% IF ( contracts ) %]
376             <div id="supplier-contracts" class="yui-g">
377                 <h2>Contract(s)</h2>
378                 <table id="contractst">
379                   <thead>
380                     <tr>
381                         <th scope="col">Name</th>
382                         <th scope="col">Description</th>
383                         <th scope="col" class="title-string">Start date</th>
384                         <th scope="col" class="title-string">End date</th>
385                         <th scope="col">Actions</th>
386                     </tr>
387                   </thead>
388                   <tbody>
389                     [% FOREACH contract IN contracts %]
390                         <tr>
391                         <td>
392                             <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]">[% contract.contractname %]</a>
393                         </td>
394                         <td>[% contract.contractdescription %]</td>
395                         <td><span title="[% contract.contractstartdate %]">[% contract.contractstartdate | $KohaDates %]</span></td>
396                         <td><span title="[% contract.contractenddate %]">[% contract.contractenddate | $KohaDates %]</span></td>
397                         <td class="actions">
398                             <a class="btn btn-mini" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]"><i class="fa fa-pencil"></i> Edit</a>
399                             <a class="btn btn-mini" href="/cgi-bin/koha/admin/aqcontract.pl?op=delete_confirm&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]"><i class="fa fa-trash"></i> Delete</a>
400                         </td>
401                         </tr>
402                     [% END %]
403                   </tbody>
404                 </table>
405             </div>
406         [% END %]
407
408 [% END %]
409
410 </div>
411 </div>
412 <div class="yui-b">
413 [% INCLUDE 'vendor-menu.inc' %]
414 </div>
415 </div>
416 [% INCLUDE 'intranet-bottom.inc' %]