Auftrags-Controller: PDF-Download: nur Dateien aus session_files erlauben.

[mfinanz.git] / SL / Controller / Order.pm

diff --git a/SL/Controller/Order.pm b/SL/Controller/Order.pm
index 8c3ca542724ab7c3e420e8d96c521d1d137ff030..1878cc7a2681bfaf5b38680b4de261fa56bd3bdf 100644 (file)
--- a/SL/Controller/Order.pm
+++ b/SL/Controller/Order.pm
@@ -4,10 +4,10 @@ use strict;
 use parent qw(SL::Controller::Base);
 
 use SL::Helper::Flash;
-use SL::ClientJS;
 use SL::Presenter;
 use SL::Locale::String;
 use SL::SessionFile::Random;
+use SL::PriceSource;
 use SL::Form;
 
 use SL::DB::Order;
@@ -25,10 +25,11 @@ use SL::Helper::CreatePDF qw(:all);
 use List::Util qw(max first);
 use List::MoreUtils qw(none pairwise);
 use English qw(-no_match_vars);
+use File::Spec;
 
 use Rose::Object::MakeMethods::Generic
 (
- 'scalar --get_set_init' => [ qw(order valid_types type cv js p) ],
+ 'scalar --get_set_init' => [ qw(order valid_types type cv p) ],
 );
 
 
@@ -38,6 +39,8 @@ __PACKAGE__->run_before('_check_auth');
 __PACKAGE__->run_before('_recalc',
                         only => [ qw(edit update save save_and_delivery_order create_pdf send_email) ]);
 
+__PACKAGE__->run_before('_get_unalterable_data',
+                        only => [ qw(save save_and_delivery_order create_pdf send_email) ]);
 
 #
 # actions
@@ -91,7 +94,7 @@ sub action_save {
 
   if (scalar @{ $errors }) {
     $self->js->flash('error', $_) foreach @{ $errors };
-    return $self->js->render($self);
+    return $self->js->render();
   }
 
   flash_later('info', $::locale->text('The order has been saved'));
@@ -117,8 +120,9 @@ sub action_create_pdf {
   $sfile->fh->print($pdf);
   $sfile->fh->close;
 
-  my $tmp_filename = $sfile->file_name;
-  my $pdf_filename = t8('Sales Order') . '_' . $self->order->ordnumber . '.pdf';
+  # get temporary session filename with stripped path
+  my (undef, undef, $tmp_filename) = File::Spec->splitpath($sfile->file_name);
+  my $pdf_filename =  t8('Sales Order') . '_' . $self->order->ordnumber . '.pdf';
 
   $self->js
     ->run('download_pdf', $tmp_filename, $pdf_filename)
@@ -128,8 +132,11 @@ sub action_create_pdf {
 sub action_download_pdf {
   my ($self) = @_;
 
+  # given tmp_filename should contain no path, so strip if any
+  my (undef, undef, $tmp_filename) = File::Spec->splitpath($::form->{tmp_filename});
+  my $tmp_filename = File::Spec->catfile(SL::SessionFile->new->get_path, $tmp_filename);
   return $self->send_file(
-    $::form->{tmp_filename},
+    $tmp_filename,
     type => 'application/pdf',
     name => $::form->{pdf_filename},
   );
@@ -183,12 +190,8 @@ sub action_send_email {
     return $self->js->flash('error', t8('Conversion to PDF failed: #1', $errors[0]))->render($self);
   }
 
-  my $sfile = SL::SessionFile::Random->new(mode => "w");
-  $sfile->fh->print($pdf);
-  $sfile->fh->close;
-
-  $mail->{attachments} = [{ "filename" => $sfile->file_name,
-                            "name"     => $::form->{email}->{attachment_filename} }];
+  $mail->{attachments} = [{ "content" => $pdf,
+                            "name"    => $::form->{email}->{attachment_filename} }];
 
   if (my $err = $mail->send) {
     return $self->js->flash('error', t8('Sending E-mail: ') . $err)
@@ -219,7 +222,7 @@ sub action_save_and_delivery_order {
 
   if (scalar @{ $errors }) {
     $self->js->flash('error', $_) foreach @{ $errors };
-    return $self->js->render($self);
+    return $self->js->render();
   }
 
   my $delivery_order = $self->order->convert_to_delivery_order($self->order);
@@ -316,7 +319,7 @@ sub action_add_item {
     ->focus('#add_item_parts_id_name');
 
   $self->_js_redisplay_amounts_and_taxes;
-  $self->js->render($self);
+  $self->js->render();
 }
 
 sub action_recalc_amounts_and_taxes {
@@ -326,7 +329,7 @@ sub action_recalc_amounts_and_taxes {
 
   $self->_js_redisplay_linetotals;
   $self->_js_redisplay_amounts_and_taxes;
-  $self->js->render($self);
+  $self->js->render();
 }
 
 sub _js_redisplay_linetotals {
@@ -387,10 +390,6 @@ sub init_cv {
   return $cv;
 }
 
-sub init_js {
-  SL::ClientJS->new;
-}
-
 sub init_p {
   SL::Presenter->get;
 }
@@ -481,13 +480,34 @@ sub _recalc {
   pairwise { $a->{linetotal} = $b->{linetotal} } @{$self->order->items}, @{$pat{items}};
 }
 
-sub _save {
+
+sub _get_unalterable_data {
   my ($self) = @_;
 
-  # autovivify all cvars that are not in the form (cvars_by_config can do it)
   foreach my $item (@{ $self->order->items }) {
-    $item->cvars_by_config;
+    if ($item->id) {
+      # load data from orderitems (db)
+      my $db_item = SL::DB::OrderItem->new(id => $item->id)->load;
+      $item->$_($db_item->$_) for qw(active_discount_source active_price_source longdescription);
+    } else {
+      # set data from part (or other sources)
+      $item->longdescription($item->part->notes);
+      #$item->active_price_source('');
+      #$item->active_discount_source('');
+    }
+
+    # autovivify all cvars that are not in the form (cvars_by_config can do it).
+    # workaround to pre-parse number-cvars (parse_custom_variable_values does not parse number values).
+    foreach my $var (@{ $item->cvars_by_config }) {
+      $var->unparsed_value($::form->parse_amount(\%::myconfig, $var->{__unparsed_value})) if ($var->config->type eq 'number' && exists($var->{__unparsed_value}));
+    }
+    $item->parse_custom_variable_values;
   }
+}
+
+
+sub _save {
+  my ($self) = @_;
 
   my $errors = [];
   my $db = $self->order->db;
@@ -532,6 +552,8 @@ sub _create_pdf {
   $print_form->{media}    = $params->{media}  || 'file';
 
   $order->flatten_to_form($print_form, format_amounts => 1);
+  # flatten_to_form sets payment_terms from customer/vendor - we do not want that here
+  delete $print_form->{payment_terms} if !$print_form->{payment_id};
 
   my @errors = ();
   $print_form->throw_on_error(sub {
@@ -563,3 +585,22 @@ sub _purchase_order_type {
 }
 
 1;
+
+__END__
+
+=encoding utf-8
+
+=head1 NAME
+
+SL::Controller::Order - controller for orders
+
+=head1 TODO
+
+Testing, PriceSources, pricefactor, units, currency, delivered, delivery order created, ...
+
+=head1 AUTHOR
+
+Bernd Bleßmann E<lt>bernd@kivitendo-premium.deE<gt>
+
+=cut
+