don't redirect to a GET with sensitive data, RT#26099

[freeside.git] / httemplate / edit / process / cust_main.cgi

diff --git a/httemplate/edit/process/cust_main.cgi b/httemplate/edit/process/cust_main.cgi
index 3d56a82..7241b0a 100755 (executable)
--- a/httemplate/edit/process/cust_main.cgi
+++ b/httemplate/edit/process/cust_main.cgi
@@ -1,7 +1,7 @@
 % if ( $error ) {
 %   $cgi->param('error', $error);
-%
-<% $cgi->redirect(popurl(2). "cust_main.cgi?". $cgi->query_string ) %>
+%   my $query = $m->scomp('/elements/create_uri_query', 'secure'=>1);
+<% $cgi->redirect(popurl(2). "cust_main.cgi?$query" ) %>
 %
 % } else { 
 %
@@ -16,8 +16,8 @@ my $DEBUG = 0;
 </%once>
 <%init>
 
-die "access denied"
-  unless $FS::CurrentUser::CurrentUser->access_right('Edit customer');
+my $curuser = $FS::CurrentUser::CurrentUser;
+die "access denied" unless $curuser->access_right('Edit customer');
 
 my $conf = new FS::Conf;
 
@@ -42,8 +42,11 @@ $cgi->param('payby', $payby);
 
 if ( $payby ) {
   if ( $payby eq 'CHEK' || $payby eq 'DCHK' ) {
-    $cgi->param('payinfo',
-      $cgi->param('payinfo1'). '@'. $cgi->param('payinfo2') );
+      my $payinfo = $cgi->param('payinfo1'). '@';
+      $payinfo .= $cgi->param('payinfo3').'.' 
+            if $conf->config('echeck-country') eq 'CA';
+      $payinfo .= $cgi->param('payinfo2');
+      $cgi->param('payinfo',$payinfo);
   }
   $cgi->param('paydate',
     $cgi->param( 'exp_month' ). '-'. $cgi->param( 'exp_year' ) );
@@ -63,6 +66,35 @@ my $new = new FS::cust_main ( {
   } fields('cust_main')
 } );
 
+$new->invoice_noemail( ($cgi->param('invoice_email') eq 'Y') ? '' : 'Y' );
+
+$cgi->param('duplicate_of_custnum') =~ /^(\d+)$/;
+my $duplicate_of = $1;
+if ( $duplicate_of ) {
+  # then negate all changes to the customer; the only change we should
+  # make is to order a package, if requested
+  $new = qsearchs('cust_main', { 'custnum' => $duplicate_of })
+  # this should never happen
+    or die "nonexistent existing customer (custnum $duplicate_of)";
+}
+
+# if this is enabled, enforce it
+if ( $conf->exists('agent-ship_address', $cgi->param('agentnum')) ) {
+  my $agent = FS::agent->by_key($cgi->param('agentnum'));
+  my $agent_cust_main = $agent->agent_cust_main;
+  if ( $agent_cust_main ) {
+    my $pre = '';
+    $pre = 'ship_' if $agent_cust_main->has_ship_address;
+    foreach (qw(address1 city state zip country latitude longitude)) {
+      $new->set("ship_$_", $agent_cust_main->get($pre.$_));
+    }
+    foreach (qw(first last company)) {
+      $new->set("ship_$_", $cgi->param($_));
+    }
+    $cgi->param('same', '');
+  }
+}
+
 if ( defined($cgi->param('same')) && $cgi->param('same') eq "Y" ) {
   $new->setfield("ship_$_", '') foreach qw(
     last first company address1 address2 city county state zip
@@ -76,9 +108,16 @@ if ( $cgi->param('no_credit_limit') ) {
 
 $new->tagnum( [ $cgi->param('tagnum') ] );
 
-my %usedatetime = ( 'birthdate' => 1 );
+$error ||= $new->set_national_id_from_cgi( $cgi );
+
+my %usedatetime = ( 'birthdate'        => 1,
+                    'spouse_birthdate' => 1,
+                    'anniversary_date' => 1,
+                  );
 
-foreach my $dfield (qw( birthdate signupdate )) {
+foreach my $dfield (qw(
+  signupdate birthdate spouse_birthdate anniversary_date
+)) {
 
   if ( $cgi->param($dfield) && $cgi->param($dfield) =~ /^([ 0-9\-\/]{0,10})$/) {
 
@@ -115,11 +154,17 @@ foreach my $dfield (qw( birthdate signupdate )) {
 $new->setfield('paid', $cgi->param('paid') )
   if $cgi->param('paid');
 
-my @exempt_groups = grep /\S/, $conf->config('tax-cust_exempt-groups');
-my @tax_exempt = grep { $cgi->param("tax_$_") eq 'Y' } @exempt_groups;
+my %options = ();
+if ( $curuser->access_right('Edit customer tax exemptions') ) { 
+  my @exempt_groups = grep /\S/, $conf->config('tax-cust_exempt-groups');
+  my @tax_exempt = grep { $cgi->param("tax_$_") eq 'Y' } @exempt_groups;
+  $options{'tax_exemption'} = {
+    map { $_ => scalar($cgi->param("tax_$_".'_num')) } @tax_exempt
+  };
+}
 
 #perhaps this stuff should go to cust_main.pm
-if ( $new->custnum eq '' ) {
+if ( $new->custnum eq '' or $duplicate_of ) {
 
   my $cust_pkg = '';
   my $svc;
@@ -213,23 +258,31 @@ if ( $new->custnum eq '' ) {
 
   }
 
+
   use Tie::RefHash;
   tie my %hash, 'Tie::RefHash';
   %hash = ( $cust_pkg => [ $svc ] ) if $cust_pkg;
-  $error ||= $new->insert( \%hash, \@invoicing_list,
-                           'tax_exemption'=> \@tax_exempt,
-                           'prospectnum'  => scalar($cgi->param('prospectnum')),
-                         );
+  if ( $duplicate_of ) {
+    # order the package and service normally
+    $error ||= $new->order_pkgs( \%hash ) if $cust_pkg;
+  }
+  else {
+    # create the customer
+    $error ||= $new->insert( \%hash, \@invoicing_list,
+                             %options,
+                             prospectnum => scalar($cgi->param('prospectnum')),
+                           );
 
-  my $conf = new FS::Conf;
-  if ( $conf->exists('backend-realtime') && ! $error ) {
+    my $conf = new FS::Conf;
+    if ( $conf->exists('backend-realtime') && ! $error ) {
 
-    my $berror =    $new->bill
-                 || $new->apply_payments_and_credits
-                 || $new->collect( 'realtime' => 1 );
-    warn "Warning, error billing during backend-realtime: $berror" if $berror;
+      my $berror =    $new->bill
+                   || $new->apply_payments_and_credits
+                   || $new->collect( 'realtime' => 1 );
+      warn "Warning, error billing during backend-realtime: $berror" if $berror;
 
-  }
+    }
+  } #if $duplicate_of
   
 } else { #create old record object
 
@@ -274,7 +327,7 @@ if ( $new->custnum eq '' ) {
   local($FS::Record::DEBUG)    = $DEBUG if $DEBUG;
 
   $error ||= $new->replace( $old, \@invoicing_list,
-                            'tax_exemption' => \@tax_exempt,
+                            %options,
                           );
 
   warn "$me returned from replace" if $DEBUG;