fix for lack of input validation - RT#15405
[freeside.git] / httemplate / edit / process / part_event.html
1 <% include( 'elements/process.html',
2     #'debug'          => 1,
3     'table'          => 'part_event',
4     'viewall_dir'    => 'browse',
5     'process_m2name' =>
6       {
7         'link_table'    => 'part_event_condition',
8         'num_col'       => 'eventpart',
9         'name_col'      => 'conditionname',
10         'names_list'    => [ FS::part_event_condition->all_conditionnames() ],
11         'param_style'   => 'name_colN values',
12         'args_callback' => sub { # FS/FS/m2name_Common.pm
13           my( $object, $prefix, $params, $listref ) = @_;
14           #warn "$object $prefix $params $listref\n";
15
16           my $cond = $object->conditionname;
17
18           my %option_fields = $object->option_fields;
19
20           push @$listref, map {
21                                 my $field = $_;
22
23                                 my $cgi_field = "$prefix$cond.$field";
24
25                                 my $value = $params->{$cgi_field};
26
27                                 my $info = $option_fields{$_};
28                                 $info = { label=>$info, type=>'text' }
29                                   unless ref($info);
30
31                                 if ( $info->{'type'} =~
32                                        /^(select|checkbox)-?multiple$/
33                                      or $info->{'type'} =~ /^select/
34                                         && $info->{'multiple'}
35                                    )
36                                 {
37                                   #special processing for compound fields
38                                   $value = { map { $_ => 1 }
39                                                  split(/\0/, $value)
40                                            };
41                                 } elsif ( $info->{'type'} eq 'freq' ) {
42                                   $value = '0' if !length($value);
43                                   $value .= $params->{$cgi_field.'_units'};
44                                 }
45
46                                 #warn "value of $cgi_field is $value\n";
47
48                                 ( $field => $value );
49                               }
50                               keys %option_fields;
51         },
52       },
53
54     'args_callback' => sub {
55
56       my( $cgi, $object ) = @_;
57
58       my $prefix = $object->action.'.';
59
60       map { my $option = $_;
61             #my $value = scalar( $cgi->param( "$prefix$option" ) );
62             my $value = join(',', $cgi->param( "$prefix$option" ) );
63
64             if ( $option eq 'reasonnum' && $value == -1 ) {
65               $value = {
66                 'typenum' => scalar( $cgi->param( "new$prefix${option}T" ) ),
67                 'reason'  => scalar( $cgi->param( "new$prefix${option}"  ) ),
68               };
69             }
70
71             ( $option => $value );
72           }
73           @{ $object->option_fields_listref };
74
75     },
76     'precheck_callback' => sub {
77       my $cgi = shift;
78       my $action = $cgi->param('action') or return;
79       my %actionfields = map { $_ =~ /^$action\.(.*)/; $1 => $cgi->param($_) }
80                          grep { /^$action\./ } $cgi->param;
81       if ( exists($actionfields{'reasonnum'}) and 
82            length($actionfields{'reasonnum'}) == 0 ) {
83         return 'Reason required';
84       }
85       if ( $cgi->param('_initialize') ) {
86         $cgi->param('disabled', 'Y');
87       }
88
89       my $balance_age_rx = qr/^(condition.+)\.balance_age\.age$/;
90
91       foreach my $param ( keys %{ $cgi->Vars() } ){
92
93         next unless ( $param =~ /$balance_age_rx/ );
94         next unless $cgi->param($1) eq 'balance_age';
95
96         my $errstr = FS::part_event::Condition::balance_age->
97           check_options( { age       => $cgi->param($param),
98                            age_units => $cgi->param("${param}_units") } );
99
100         return $errstr if $errstr;
101       }
102
103       return '';
104     },
105     'noerror_callback' => sub {
106       my ($cgi, $new) = @_;
107       if ( $cgi->param('_initialize') ) {
108         my $job = new FS::queue { 
109           'job' => 'FS::part_event::process_initialize'
110         };
111         my $error = $job->insert('eventpart' => $new->eventpart);
112         warn "error queueing job: $error\n" if $error; # can't do anything else
113       }
114     },
115
116     'agent_virt'       => 1,
117     'agent_null_right' => 'Edit global billing events',
118 )
119 %>
120 <%init>
121
122 die "access denied"
123   unless $FS::CurrentUser::CurrentUser->access_right('Edit billing events')
124       || $FS::CurrentUser::CurrentUser->access_right('Edit global billing events');
125
126 </%init>