Merge branch 'master' of git.freeside.biz:/home/git/freeside

8 files changed, 149 insertions, 226 deletions

diff --git a/httemplate/edit/cust_main/billing.html b/httemplate/edit/cust_main/billing.html
index 2925ca87c..da5f0f27f 100644
--- a/httemplate/edit/cust_main/billing.html
+++ b/httemplate/edit/cust_main/billing.html
@@ -444,10 +444,11 @@
 
     <TR><TD>&nbsp;</TD></TR>
 
+%   my $curuser = $FS::CurrentUser::CurrentUser;
 %   my @exempt_groups = grep /\S/, $conf->config('tax-cust_exempt-groups');
-
 %   if (    $conf->exists('cust_class-tax_exempt')
 %        || $conf->exists('tax-cust_exempt-groups-require_individual_nums')
+%        || ! $curuser->access_right('Edit customer tax exemptions')
 %      )
 %   {
 
@@ -461,14 +462,16 @@
 
 %   }
 
-%   foreach my $exempt_group ( @exempt_groups ) {
-%     my $cust_main_exemption = $cust_main->tax_exemption($exempt_group);
-%     #escape $exempt_group for NAME etc.
-%     my $checked = ($cust_main_exemption || $cgi->param("tax_$exempt_group"));
-      <TR>
-        <TD>&nbsp;&nbsp;<INPUT TYPE="checkbox" NAME="tax_<% $exempt_group %>" ID="tax_<% $exempt_group %>" VALUE="Y" <% $checked ? 'CHECKED' : '' %> onChange="tax_changed(this)"> Tax Exempt (<% $exempt_group %> taxes)</TD>
-        <TD> - Exemption number <INPUT TYPE="text" NAME="tax_<% $exempt_group %>_num" ID="tax_<% $exempt_group %>_num" VALUE="<% $cgi->param("tax_$exempt_group".'_num') || ( $cust_main_exemption ? $cust_main_exemption->exempt_number : '' ) |h %>" <% $checked ? '' : 'DISABLED' %>></TD>
-      </TR>
+%   if ( $curuser->access_right('Edit customer tax exemptions') ) {
+%     foreach my $exempt_group ( @exempt_groups ) {
+%       my $cust_main_exemption = $cust_main->tax_exemption($exempt_group);
+%       #escape $exempt_group for NAME etc.
+%       my $checked = ($cust_main_exemption || $cgi->param("tax_$exempt_group"));
+        <TR>
+          <TD>&nbsp;&nbsp;<INPUT TYPE="checkbox" NAME="tax_<% $exempt_group %>" ID="tax_<% $exempt_group %>" VALUE="Y" <% $checked ? 'CHECKED' : '' %> onChange="tax_changed(this)"> Tax Exempt (<% $exempt_group %> taxes)</TD>
+          <TD> - Exemption number <INPUT TYPE="text" NAME="tax_<% $exempt_group %>_num" ID="tax_<% $exempt_group %>_num" VALUE="<% $cgi->param("tax_$exempt_group".'_num') || ( $cust_main_exemption ? $cust_main_exemption->exempt_number : '' ) |h %>" <% $checked ? '' : 'DISABLED' %>></TD>
+        </TR>
+%     }
 %   }
 
 % unless ( $conf->exists('emailinvoiceonly') ) {
@@ -518,7 +521,13 @@
         <% $conf->exists('cust_main-require_invoicing_list_email', $agentnum) 
             ? $r : '' %>Email address(es)
       </TD>
-      <TD WIDTH="408"><INPUT TYPE="text" NAME="invoicing_list" VALUE="<% join(', ', grep { $_ !~ /^(POST|FAX)$/ } @invoicing_list ) %>"></TD>
+      <TD WIDTH="408"><INPUT TYPE="text" NAME="invoicing_list" VALUE="<% join(', ', grep { $_ !~ /^(POST|FAX)$/ } @invoicing_list ) %>">
+      <INPUT TYPE="checkbox" NAME="message_noemail" VALUE="Y" <%
+        ( $cust_main->message_noemail eq 'Y' )
+          ? 'CHECKED'
+          : ''
+        %>> <% emt('Do not send notices') %>
+      </TD>
     </TR>
 % }
 
@@ -606,6 +615,23 @@ function toggle(obj) {
       <INPUT TYPE="hidden" NAME="cdr_termination_percentage" VALUE="<% $cust_main->cdr_termination_percentage %>">
 % }
 
+%my @currencies = $conf->config('currencies');
+%if ( scalar(@currencies) ) {
+%  unshift @currencies, ''; #default
+%  my %currency_labels = map { $_ => "$_: ". code2currency($_) } @currencies;
+%  $currency_labels{''} =
+%    'Default: '. code2currency( $conf->config('currency') || 'USD' );
+
+    <& /elements/tr-select.html, 
+         'label'         => emt('Invoicing currency'),
+         'field'         => 'currency',
+         'options'       => \@currencies,
+         'labels'        => \%currency_labels,
+         'curr_value'    => $cust_main->currency,
+    &>
+% }
+
+
 %my @available_locales = $conf->config('available-locales');
 %if ( scalar(@available_locales) ) {
 %  push @available_locales, ''
diff --git a/httemplate/edit/cust_main/bottomfixup.html b/httemplate/edit/cust_main/bottomfixup.html
index 60edcc111..b5d10c467 100644
--- a/httemplate/edit/cust_main/bottomfixup.html
+++ b/httemplate/edit/cust_main/bottomfixup.html
@@ -1,15 +1,9 @@
 <& /elements/init_overlib.html &>
 
 <& /elements/xmlhttp.html,
-  url  => $p.'misc/xmlhttp-cust_main-address_standardize.html',
+  url  => $p.'misc/xmlhttp-address_standardize.html',
   subs => [ 'address_standardize' ],
-  #'method' => 'POST', #could get too long?
-&>
-
-<& /elements/xmlhttp.html,
-  url  => $p.'misc/xmlhttp-cust_main-censustract.html',
-  subs => [ 'censustract' ],
-  #'method' => 'POST', #could get too long?
+  method => 'POST', #could get too long?
 &>
 
 <INPUT TYPE="hidden" NAME="duplicate_of_custnum" VALUE="">
diff --git a/httemplate/edit/cust_main/bottomfixup.js b/httemplate/edit/cust_main/bottomfixup.js
index 77d4294a6..9e18fa0df 100644
--- a/httemplate/edit/cust_main/bottomfixup.js
+++ b/httemplate/edit/cust_main/bottomfixup.js
@@ -7,26 +7,31 @@ my $company_longitude = $conf->config('company_longitude');
 
 my @fixups = ('copy_payby_fields', 'standardize_locations');
 
-push @fixups, 'fetch_censustract'
+push @fixups, 'confirm_censustract'
     if $conf->exists('cust_main-require_censustract');
 
-push @fixups, 'check_unique'
-    if $conf->exists('cust_main-check_unique') and !$opt{'custnum'};
+# currently doesn't work; disable to avoid problems
+#push @fixups, 'check_unique'
+#    if $conf->exists('cust_main-check_unique') and !$opt{'custnum'};
 
 push @fixups, 'do_submit'; # always last
 </%init>
 
 var fixups = <% encode_json(\@fixups) %>;
 var fixup_position;
+var running = false;
 
 %# state machine to deal with all the asynchronous stuff we're doing
 %# call this after each fixup on success:
 function submit_continue() {
-  window[ fixups[fixup_position++] ].call();
+  if ( running ) {
+    window[ fixups[fixup_position++] ].call();
+  }
 }
 
 %# or on failure:
 function submit_abort() {
+  running = false;
   fixup_position = 0;
   document.CustomerForm.submitButton.disabled = false;
   cClick();
@@ -35,6 +40,7 @@ function submit_abort() {
 function bottomfixup(what) {
   fixup_position = 0;
   document.CustomerForm.submitButton.disabled = true;
+  running = true;
   submit_continue();
 }
 
@@ -63,112 +69,11 @@ function copy_payby_fields() {
   submit_continue();
 }
 
-%# call submit_continue() on completion...
-%# otherwise not touching standardize_locations for now
-<% include( '/elements/standardize_locations.js',
-            'callback' => 'submit_continue();',
-            'main_prefix' => 'bill_',
-            'no_company' => 1,
-          )
-%>
-
-var prefix;
-function fetch_censustract() {
-
-  //alert('fetch census tract data');
-  prefix = document.getElementById('same').checked ? 'bill_' : 'ship_';
-  var cf = document.CustomerForm;
-  var state_el = cf.elements[prefix + 'state'];
-  var census_data = new Array(
-    'year',     <% $conf->config('census_year') || '2012' %>,
-    'address1', cf.elements[prefix + 'address1'].value,
-    'city',     cf.elements[prefix + 'city'].value,
-    'state',    state_el.options[ state_el.selectedIndex ].value,
-    'zip',      cf.elements[prefix + 'zip'].value
-  );
-
-  censustract( census_data, update_censustract );
-
-}
-
-var set_censustract;
-
-function update_censustract(arg) {
-
-  var argsHash = eval('(' + arg + ')');
-
-  var cf = document.CustomerForm;
-
-/*  var msacode    = argsHash['msacode'];
-  var statecode  = argsHash['statecode'];
-  var countycode = argsHash['countycode'];
-  var tractcode  = argsHash['tractcode'];
-  
-  var newcensus = 
-    new String(statecode)  +
-    new String(countycode) +
-    new String(tractcode).replace(/\s$/, '');  // JSON 1 workaround */
-  var error      = argsHash['error'];
-  var newcensus  = argsHash['censustract'];
-
-  set_censustract = function () {
-
-    cf.elements[prefix + 'censustract'].value = newcensus;
-    submit_continue();
-
-  }
-
-  if (error || cf.elements[prefix + 'censustract'].value != newcensus) {
-    // popup an entry dialog
-
-    if (error) { newcensus = error; }
-    newcensus.replace(/.*ndefined.*/, 'Not found');
-
-    var latitude = cf.elements[prefix + 'latitude'].value 
-                   || '<% $company_latitude %>';
-    var longitude= cf.elements[prefix + 'longitude'].value 
-                   || '<% $company_longitude %>';
-
-    var choose_censustract =
-      '<CENTER><BR><B>Confirm censustract</B><BR>' +
-      '<A href="http://maps.ffiec.gov/FFIECMapper/TGMapSrv.aspx?' +
-      'census_year=<% $conf->config('census_year') || '2012' %>' +
-      '&latitude=' + latitude +
-      '&longitude=' + longitude +
-      '" target="_blank">Map service module location</A><BR>' +
-      '<A href="http://maps.ffiec.gov/FFIECMapper/TGMapSrv.aspx?' +
-      'census_year=<% $conf->config('census_year') || '2012' %>' +
-      '&zip_code=' + cf.elements[prefix + 'zip'].value +
-      '" target="_blank">Map zip code center</A><BR><BR>' +
-      '<TABLE>';
-    
-    choose_censustract = choose_censustract + 
-      '<TR><TH style="width:50%">Entered census tract</TH>' +
-        '<TH style="width:50%">Calculated census tract</TH></TR>' +
-      '<TR><TD>' + cf.elements[prefix + 'censustract'].value +
-        '</TD><TD>' + newcensus + '</TD></TR>' +
-        '<TR><TD>&nbsp;</TD><TD>&nbsp;</TD></TR>';
-
-    choose_censustract = choose_censustract +
-      '<TR><TD ALIGN="center">' +
-        '<BUTTON TYPE="button" onClick="submit_continue();"><IMG SRC="<%$p%>images/error.png" ALT=""> Use entered census tract </BUTTON>' + 
-      '</TD><TD ALIGN="center">' +
-        '<BUTTON TYPE="button" onClick="set_censustract();"><IMG SRC="<%$p%>images/tick.png" ALT=""> Use calculated census tract </BUTTON>' + 
-      '</TD></TR>' +
-      '<TR><TD COLSPAN=2 ALIGN="center">' +
-        '<BUTTON TYPE="button" onClick="submit_abort();"><IMG SRC="<%$p%>images/cross.png" ALT=""> Cancel submission</BUTTON></TD></TR>' +
-        
-      '</TABLE></CENTER>';
-
-    overlib( choose_censustract, CAPTION, 'Confirm censustract', STICKY, AUTOSTATUSCAP, CLOSETEXT, '', MIDX, 0, MIDY, 0, DRAGGABLE, WIDTH, 576, HEIGHT, 268, BGCOLOR, '#333399', CGCOLOR, '#333399', TEXTSIZE, 3 );
-
-  } else {
-
-    submit_continue();
-
-  }
-
-}
+<& /elements/standardize_locations.js,
+  'callback' => 'submit_continue();',
+  'billship' => 1,
+  'with_census' => 1, # no with_firm, apparently
+&>
 
 function copyelement(from, to) {
   if ( from == undefined ) {
@@ -192,6 +97,40 @@ function copyelement(from, to) {
   //alert(from + " (" + from.type + "): " + to.name + " => " + to.value);
 }
 
+% # the value in pre+'censustract' is the confirmed censustract; if it's set,
+% # do nothing here
+function confirm_censustract() {
+  var cf = document.CustomerForm;
+  var pre = cf.elements['same'].checked ? 'bill_' : 'ship_';
+  if ( cf.elements[pre+'censustract'].value == '' ) {
+    var address_info = form_address_info();
+    address_info[pre+'latitude']  = cf.elements[pre+'latitude'].value;
+    address_info[pre+'longitude'] = cf.elements[pre+'longitude'].value;
+    OLpostAJAX(
+        '<%$p%>/misc/confirm-censustract.html',
+        'q=' + encodeURIComponent(JSON.stringify(address_info)),
+        function() {
+          overlib( OLresponseAJAX, CAPTION, 'Confirm censustract', STICKY,
+            AUTOSTATUSCAP, CLOSETEXT, '', MIDX, 0, MIDY, 0, DRAGGABLE, WIDTH,
+            576, HEIGHT, 268, BGCOLOR, '#333399', CGCOLOR, '#333399',
+            TEXTSIZE, 3 );
+        },
+        0);
+  } else submit_continue();
+}
+
+%# called from confirm-censustract.html
+function set_censustract(tract, year) {
+  var cf = document.CustomerForm;
+  var pre = 'ship_';
+  if ( cf.elements['same'].checked ) {
+    pre = 'bill_';
+  }
+  cf.elements[pre + 'censustract'].value = tract;
+  cf.elements[pre + 'censusyear'].value = year;
+  submit_continue();
+}
+
 function check_unique() {
   var search_hash = new Object;
 % foreach ($conf->config('cust_main-check_unique')) {
diff --git a/httemplate/edit/cust_main/choose_tax_location.html b/httemplate/edit/cust_main/choose_tax_location.html
deleted file mode 100644
index ac475c54b..000000000
--- a/httemplate/edit/cust_main/choose_tax_location.html
+++ /dev/null
@@ -1,87 +0,0 @@
-<FORM NAME="choosegeocodeform">
-<CENTER><BR><B>Choose tax location</B><BR><BR>
-<P>the geocode is:<% $header %></P>
-<P STYLE="<% $style %>"><% $header %></P>
-
-<SELECT NAME='geocodes' ID='geocodes' STYLE="<% $style %>">
-% foreach my $location (@cust_tax_location) {
-%   my %value = ( zip => $zip5,
-%                 map { $_ => $location->$_ }
-%                   qw ( city state geocode )
-%               );
-%   map { $value{$_} = $location{$_} } qw ( city state )
-%     if $location{country} eq 'CA';
-%
-%   my $value = encode_entities(objToJson({ %value })
-%                              );
-%   my $content = '';
-%   $content .= $location->$_. '&nbsp;' x ( $max{$_} - length($location->$_) )
-%     foreach qw( city county state );
-%   $content .=   $location->cityflag eq 'I' ? 'Y' : 'N' ;
-%   my $selected = '' ;
-%   if ($geocode && $location->geocode eq $geocode) {
-%     $selected = 'SELECTED';
-%   }
-  <OPTION VALUE="<% $value %>" STYLE="<% $style %>" <% $selected %>><% $content %>
-% }
-</SELECT><BR><BR>
-
-<TABLE><TR>
-  <TD> <BUTTON TYPE="button" onClick="set_geocode(document.getElementById('geocodes'));"><IMG SRC="<%$p%>images/tick.png" ALT=""> Set location </BUTTON></TD>
-  <TD><BUTTON TYPE="button" onClick="document.CustomerForm.submitButton.disabled=false; parent.cClick();"><IMG SRC="<%$p%>images/cross.png" ALT=""> Cancel submission </BUTTON></TD>
-</TR>
-</TABLE>
-
-</CENTER>
-</FORM>
-<%init>
-
-my $conf = new FS::Conf;
-
-my %location = ();
-
-($location{data_vendor}) = $cgi->param('data_vendor') =~ /^([-\w]+)$/;
-($location{city})        = $cgi->param('city')        =~ /^([\w ]+)$/;
-($location{state})       = $cgi->param('state')       =~ /^(\w+)$/;
-($location{zip})         = $cgi->param('zip')         =~ /^([-\w ]+)$/;
-($location{country})     = $cgi->param('country')     =~ /^([\w ]+)$/;
-
-my($geocode)             = $cgi->param('geocode')     =~ /^([\w]+)$/;
-
-my($zip5, $zip4) = split('-', $location{zip});
-
-#only support US & CA
-my $hashref = { 'data_vendor' => $location{data_vendor} };
-$hashref->{zip} = $location{country} eq 'CA' ? substr($zip5,0,1) : $zip5,
-
-my @keys = keys(%$hashref);
-my @cust_tax_location = ();
-until ( @cust_tax_location ) {
-  @cust_tax_location = qsearch({ table    => 'cust_tax_location',
-                                 hashref  =>  $hashref,
-                                 order_by =>  'LIMIT 50',
-                              });
-  last unless scalar(@keys);
-  delete $hashref->{ shift @keys };
-} 
-
-my %max = ( city => 4, county => 6, state => 5);
-foreach my $location (@cust_tax_location) {
-  foreach ( qw( city county state ) ) {
-    my $length = length($location->$_);
-    $max{$_} = ($length > $max{$_}) ? $length : $max{$_};
-  }
-}
-foreach ( qw( city county state ) ) {
-  $max{$_} = $location{$_} if $location{$_} > $max{$_};
-  $max{$_}++;
-}
-
-my $header = '&nbsp;&nbsp;';
-$header .= $_. '&nbsp;' x ( $max{lc($_)} - length($_) )
-  foreach qw( City County State );
-$header .=   "In city?";
-
-my $style = "font-family:monospace;";
-
-</%init>
diff --git a/httemplate/edit/cust_main/contact.html b/httemplate/edit/cust_main/contact.html
index 57490b962..4140ec1ea 100644
--- a/httemplate/edit/cust_main/contact.html
+++ b/httemplate/edit/cust_main/contact.html
@@ -174,9 +174,7 @@ $cust_main->set('stateid_state', $cust_main->state )
 
 $opt{geocode} ||= $cust_main->get('geocode');
 
-if ( $conf->exists('cust_main-require_censustract') ) {
-  $opt{censustract} ||= $cust_main->censustract;
-}
+$opt{censustract} ||= $cust_main->censustract;
 
 $daytime_label = FS::Msgcat::_gettext('daytime') =~ /^(daytime)?$/
                    ? 'Day'
diff --git a/httemplate/edit/cust_main/first_pkg/select-part_pkg.html b/httemplate/edit/cust_main/first_pkg/select-part_pkg.html
index 709a8ad6c..4f8914065 100644
--- a/httemplate/edit/cust_main/first_pkg/select-part_pkg.html
+++ b/httemplate/edit/cust_main/first_pkg/select-part_pkg.html
@@ -111,7 +111,7 @@
 &>
 
 <SCRIPT TYPE="text/javascript">
-  pkgpart_svcpart_changed_too( document.CustomerForm.pkgpart_svcpart,
+  pkgpart_svcpart_changed_too( document.<% $opt{form_name} || 'CustomerForm' %>.pkgpart_svcpart,
                                <% $opt{saved_domsvc} %>
                              );
 </SCRIPT>
diff --git a/httemplate/edit/cust_main/first_pkg/svc_acct.html b/httemplate/edit/cust_main/first_pkg/svc_acct.html
index b1ccc137c..717bf5025 100644
--- a/httemplate/edit/cust_main/first_pkg/svc_acct.html
+++ b/httemplate/edit/cust_main/first_pkg/svc_acct.html
@@ -5,7 +5,7 @@
     <TD>
       <INPUT TYPE      = "text"
              NAME      = "username"
-             VALUE     = "<% $opt{'username'} %>"
+             VALUE     = "<% $opt{'username'} |h %>"
              SIZE      = <% $ulen2 %>
              MAXLENGTH = <% $ulen %>
       >
@@ -26,7 +26,7 @@
     <TD>
       <INPUT TYPE      = "text"
              NAME      = "_password"
-             VALUE     = "<% $opt{'password'} %>"
+             VALUE     = "<% $opt{'password'} |h %>"
              SIZE      = <% $pmax2 %>
              MAXLENGTH = <% $passwordmax %>>
 %     unless ( $opt{'password_verify'} ) {
@@ -41,7 +41,7 @@
       <TD>
         <INPUT TYPE      = "text"
                NAME      = "_password2"
-               VALUE     = "<% $opt{'password2'} %>"
+               VALUE     = "<% $opt{'password2'} |h %>"
                SIZE      = <% $pmax2 %>
                MAXLENGTH = <% $passwordmax %>>
       </TD>
@@ -51,7 +51,7 @@
 % if ( $conf->exists('security_phrase') ) {
     <TR>
       <TD ALIGN="right"><% mt('Security Phrase') |h %></TD>
-      <TD><INPUT TYPE="text" NAME="sec_phrase" VALUE="<% $opt{'sec_phrase'} %>">
+      <TD><INPUT TYPE="text" NAME="sec_phrase" VALUE="<% $opt{'sec_phrase'} |h %>">
       </TD>
     </TR>
 % } else {
diff --git a/httemplate/edit/cust_main/top_misc.html b/httemplate/edit/cust_main/top_misc.html
index 7ce283c6c..b7e86ba78 100644
--- a/httemplate/edit/cust_main/top_misc.html
+++ b/httemplate/edit/cust_main/top_misc.html
@@ -32,6 +32,44 @@
       document.getElementById('contacts_div').style.display = 'none';
     }
   }
+
+  var ship_locked_agents = <% encode_json(\%ship_locked_agents) %>;
+  var ship_fields = ['address1', 'city', 'state', 'zip', 'country', 
+    'latitude', 'longitude', 'district'];
+  function agent_changed(what) {
+    var agentnum = what.value;
+    var f = what.form;
+    if ( ship_locked_agents[agentnum] ) {
+%     # For this agent, the service location (except address2)
+%     # should be locked to the agent's location.
+%     # Set the ship_ fields to those values (just for display) and
+%     # then disable them.
+      for(var x in ship_locked_agents[agentnum]) {
+        f['ship_'+x].value = ship_locked_agents[agentnum][x];
+        f['ship_'+x].disabled = true;
+      }
+      f['same'].checked = false;
+      f['same'].disabled = true;
+    } else {
+%     # Unlock the ship_ location fields.  If they were previously
+%     # disabled, then they contain some agent's address, which is 
+%     # no longer meaningful.  So set them back to the customer's 
+%     # current location.
+      for(var i=0; i<ship_fields.length; i++) {
+        x = ship_fields[i];
+        if ( f['ship_'+x].disabled )  {
+          f['ship_'+x].value  = f['old_ship_'+x].value;
+        }
+        f['ship_'+x].disabled = false;
+      }
+      f['same'].disabled = false;
+    }
+    samechanged(f['same']);
+  }
+  window.onload = function() {
+    agent_changed(document.getElementById('agentnum'));
+  }
+ 
 </SCRIPT>
 
 % foreach my $field ($cust_main->virtual_fields) {
@@ -51,12 +89,13 @@
 %   $cust_main->agentnum($agentnum);
 
     <INPUT TYPE="hidden" NAME="lock_agentnum" VALUE="<% $agentnum %>">
-    <INPUT TYPE="hidden" NAME="agentnum"      VALUE="<% $agentnum %>">
+    <INPUT TYPE="hidden" NAME="agentnum"      ID="agentnum" 
+      VALUE="<% $agentnum %>">
     <TR>
       <TD ALIGN="right"><% mt('Agent') |h %></TD>
       <TD CLASS="fsdisabled"><% $cust_main->agent->agent |h %></TD>
     </TR>
- 
+
 % } else {
 
   <& /elements/tr-select-agent.html, 
@@ -65,6 +104,7 @@
                 'empty_label'   => emt('Select agent'),
                 'disable_empty' => ( $cust_main->agentnum ? 1 : 0 ),
                 'viewall_right' => emt('None'), 
+                'onchange'      => 'agent_changed(this)',
   &>
 
 % }
@@ -114,7 +154,7 @@
   <TR>
     <TD ALIGN="right"><% mt('Referring customer') |h %></TD>
     <TD>
-      <A HREF="<% popurl(1) %>/cust_main.cgi?<% $cust_main->referral_custnum %>"><% $cust_main->referral_custnum %>: <% $referring_cust_main->name %></A>
+      <A HREF="<% popurl(1) %>/cust_main.cgi?<% $cust_main->referral_custnum %>"><% $cust_main->referral_custnum %>: <% $referring_cust_main->name |h %></A>
     </TD>
   </TR>
   <INPUT TYPE="hidden" NAME="referral_custnum" VALUE="<% $cust_main->referral_custnum %>">
@@ -201,4 +241,17 @@ my $curuser = $FS::CurrentUser::CurrentUser;
 
 my $r = qq!<font color="#ff0000">*</font>&nbsp;!;
 
+# which agents lock the service address, if any
+my %ship_locked_agents;
+foreach (qsearch('agent',{})) {
+  my $agentnum = $_->agentnum;
+  next unless $conf->exists('agent-ship_address', $_->agentnum);
+  my $cust_main = $_->agent_cust_main or next;
+  my $agent_ship_location = $cust_main->ship_location;
+  $ship_locked_agents{$agentnum} = +{
+    map { $_ => $agent_ship_location->$_ }
+    qw(address1 city state zip country latitude longitude district)
+  };
+}
+
 </%init>