0034089: [Stock validation] Stock Validation not working creating a sales order from a quotation

# HG changeset patch
# User Mario Castello <mario.castello@peoplewalking.com>
# Date 1475526390 21600
#      lun oct 03 14:26:30 2016 -0600
# Node ID 8d9078777883419d9ab14d882bb0c2e0ae326f61
# Parent  f5659c6426a1c7709be95d2d41c7d4edc75ee0bf
Fixed issue 34089: Added a correct validation to prevent wrong results.
Prevent SQL injection.

diff --git a/src/org/openbravo/retail/stockvalidation/OrderFromQuotationStockChecker.java b/src/org/openbravo/retail/stockvalidation/OrderFromQuotationStockChecker.java
--- a/src/org/openbravo/retail/stockvalidation/OrderFromQuotationStockChecker.java
+++ b/src/org/openbravo/retail/stockvalidation/OrderFromQuotationStockChecker.java
@@ -40,10 +40,12 @@
         String hqlQuery = "select sum(ms.quantityOnHand) as qtyonhand "
             + "from MaterialMgmtStorageDetail ms " + "where ms.storageBin.warehouse.id in ("
             + "SELECT ow.warehouse.id " + "FROM OrganizationWarehouse as ow " + "WHERE "
-            + "ow.organization.id = '" + orgId + "') " + "and ms.product.id = '" + productId + "'";
+            + "ow.organization.id = :orgId) and ms.product.id = :productId ";
 
         final Session session = OBDal.getInstance().getSession();
         final Query query = session.createQuery(hqlQuery);
+        query.setString("orgId", orgId);
+        query.setString("productId", productId);
 
         if (query.uniqueResult() != null) {
           unitsFound = new BigDecimal(query.uniqueResult().toString());
@@ -51,9 +53,7 @@
           unitsFound = BigDecimal.ZERO;
         }
 
-        if (unitsFound.compareTo(qtyToBuy) >= 0) {
-          allowSell = true;
-        }
+        allowSell = unitsFound.compareTo(qtyToBuy) >= 0;
 
         JSONObject preFinalResult = new JSONObject();
         preFinalResult.put("allowSell", allowSell);
diff --git a/web/org.openbravo.retail.stockvalidation/js/modals.js b/web/org.openbravo.retail.stockvalidation/js/modals.js
--- a/web/org.openbravo.retail.stockvalidation/js/modals.js
+++ b/web/org.openbravo.retail.stockvalidation/js/modals.js
@@ -124,9 +124,7 @@
                     if (curLine.availableQty <= 0) {
                       me.model.get('order').deleteLine(me.model.get('order').get('lines').at(curLine.index));
                     } else {
-                      me.model.get('order').get('lines').at(curLine.index).set('qty', curLine.availableQty, {
-                        silent: true
-                      });
+                      me.model.get('order').get('lines').at(curLine.index).set('qty', curLine.availableQty);
                     }
                   }, this);
                 },
@@ -146,9 +144,7 @@
                     if (curLine.availableQty <= 0) {
                       me.model.get('order').deleteLine(me.model.get('order').get('lines').at(curLine.index));
                     } else {
-                      me.model.get('order').get('lines').at(curLine.index).set('qty', curLine.availableQty, {
-                        silent: true
-                      });
+                      me.model.get('order').get('lines').at(curLine.index).set('qty', curLine.availableQty);
                     }
                   }, this);
                 }
@@ -167,16 +163,16 @@
       if (!OB.MobileApp.model.hasPermission('OBPOSSV_EnableStockValidation', true)) {
         return;
       }
-      if (!addedModel.get('product').get('stocked') || addedModel.get('qty') < 0 || this.model.get('order').get('orderType') === 1 || this.model.get('order').get('isPaid') === true || this.model.get('order').get('isQuotation') === true) {
-        return;
-      }
-      executeCallToServer(addedModel);
       addedModel.on('change:qty', function (changedModel) {
         if (!addedModel.get('product').get('stocked') || addedModel.get('qty') < 0 || this.model.get('order').get('orderType') === 1 || this.model.get('order').get('isPaid') === true || this.model.get('order').get('isQuotation') === true) {
           return;
         }
         executeCallToServer(changedModel);
       }, this);
+      if (!addedModel.get('product').get('stocked') || addedModel.get('qty') < 0 || this.model.get('order').get('orderType') === 1 || this.model.get('order').get('isPaid') === true || this.model.get('order').get('isQuotation') === true) {
+        return;
+      }
+      executeCallToServer(addedModel);
     }, this);
 
     this.model.get('order').on('orderCreatedFromQuotation', function () {

# HG changeset patch
# User Mario Castello <mario.castello@peoplewalking.com>
# Date 1475612555 21600
#      mar oct 04 14:22:35 2016 -0600
# Node ID bb826c4f6caf5cc1773b4e64b3ec877cd08a59ed
# Parent  51b22728f5a5400ac9c39878a5dcc2ad96f45577
Related to issue 34089: Added automated test

diff --git a/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationAllowNegativeStock.java b/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationAllowNegativeStock.java
new file mode 100644
--- /dev/null
+++ b/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationAllowNegativeStock.java
@@ -0,0 +1,91 @@
+/*
+ *************************************************************************
+ * The contents of this file are subject to the Openbravo  Public  License
+ * Version  1.0  (the  "License"),  being   the  Mozilla   Public  License
+ * Version 1.1  with a permitted attribution clause; you may not  use this
+ * file except in compliance with the License. You  may  obtain  a copy of
+ * the License at http://www.openbravo.com/legal/license.html
+ * Software distributed under the License  is  distributed  on  an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
+ * License for the specific  language  governing  rights  and  limitations
+ * under the License.
+ * The Original Code is Openbravo ERP.
+ * The Initial Developer of the Original Code is Openbravo S.L.U.
+ * All portions are Copyright (C) 2016 Openbravo S.L.U.
+ * All Rights Reserved.
+ * Contributor(s):
+ ************************************************************************
+ *
+ * @author = MCA
+ *
+ */
+
+package org.openbravo.test.mobile.quarantine.extmodules.MCA.stockvalidation;
+
+import org.junit.Test;
+import org.openbravo.test.mobile.common.junit.TestClassAnnotations;
+import org.openbravo.test.mobile.retail.extmodules.selenium.TestIdExtModules;
+import org.openbravo.test.mobile.retail.extmodules.selenium.terminals.WebPOSExtModulesTerminalHelper;
+import org.openbravo.test.mobile.retail.pack.selenium.TestIdPack;
+
+@TestClassAnnotations(isHighVolumeCompatible = true)
+public class I34089_OrderFromQuotationAllowNegativeStock extends WebPOSExtModulesTerminalHelper {
+
+  public I34089_OrderFromQuotationAllowNegativeStock() {
+    super("VBS1001", "vallblanca", "openbravo");
+  }
+
+  /**
+   * Default test to check that stock validation works when order has been created from quotation.
+   * This test checks that 'canceling' the "Not enough stock" popup effectively removes the product
+   * from the ticket, and that 'proceeding' leaves the product on the ticket.
+   */
+  @Test
+  public void test() {
+    tap(TestIdExtModules.BUTTON_MENU);
+    tap(TestIdExtModules.BUTTON_MENU_CREATEQUOTATION);
+    verify(TestIdExtModules.LABEL_RECEIPT_TYPE, "Quotation - Draft");
+
+    addProduct();
+    verify(TestIdExtModules.LABEL_RECEIPT_ROW1_QTY, "1");
+    verify(TestIdExtModules.LABEL_RECEIPT_ROW2_QTY, "100");
+    verify(TestIdExtModules.LABEL_RECEIPT_TOTAL_QTY, "101");
+
+    tap(TestIdExtModules.BUTTON_PAY);
+    verify(TestIdExtModules.LABEL_RECEIPT_TYPE, "Quotation - Under Evaluation");
+
+    tap(TestIdExtModules.BUTTON_MENU);
+    tap(TestIdExtModules.BUTTON_MENU_CREATEORDERFROMQUOTATION);
+    tap(TestIdExtModules.BUTTON_POPUP_CREATEORDER);
+    TestIdExtModules.CONFIRMATION_POPUP.enyoNode().waitUntilIsReady();
+    verify(TestIdExtModules.LABEL_POPUP_TITLE, "Not enough stock");
+    tap(TestIdExtModules.BUTTON_POPUP_CANCEL);
+    verify(TestIdExtModules.LABEL_RECEIPT_ROW1_QTY, "61");
+    verify(TestIdExtModules.LABEL_RECEIPT_TOTAL_QTY, "61");
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "9,180.50");
+
+    tap(TestIdExtModules.BUTTON_DELETERECEIPT);
+    tap(TestIdExtModules.BUTTON_DELETERECEIPT_CONFIRM);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "0.00");
+  }
+
+  private void addProduct() {
+    tap(TestIdExtModules.BUTTON_SEARCH);
+    write(TestIdExtModules.FIELD_SEARCH_TEXT, "Adhesive body warmers");
+    tap(TestIdExtModules.BUTTON_SEARCH_EXECUTE);
+    tap(TestIdExtModules.BUTTON_SEARCHPRODUCT_BACKPACKSANDTRAVEL_ADHESIVEBODYWARNMERS);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "3.60");
+
+    write(TestIdExtModules.FIELD_SEARCH_TEXT, "Avalanche transceiver");
+    tap(TestIdExtModules.BUTTON_SEARCH_EXECUTE);
+    tap(TestIdExtModules.BUTTON_SEARCHPRODUCT_AVALANCHETRANSCEIVEREXT);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "154.10");
+    // changes quantity
+    tap(TestIdPack.BUTTON_RECEIPT_ROW2);
+    tap(TestIdPack.BUTTON_KEYPAD_1);
+    tap(TestIdPack.BUTTON_KEYPAD_0);
+    tap(TestIdPack.BUTTON_KEYPAD_0);
+    tap(TestIdPack.BUTTON_KEYPAD_QUANTITY);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "15,053.60");
+  }
+}
diff --git a/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationNotAllowNegativeStock.java b/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationNotAllowNegativeStock.java
new file mode 100644
--- /dev/null
+++ b/src-test/org/openbravo/test/mobile/quarantine/extmodules/MCA/stockvalidation/I34089_OrderFromQuotationNotAllowNegativeStock.java
@@ -0,0 +1,109 @@
+/*
+ *************************************************************************
+ * The contents of this file are subject to the Openbravo  Public  License
+ * Version  1.0  (the  "License"),  being   the  Mozilla   Public  License
+ * Version 1.1  with a permitted attribution clause; you may not  use this
+ * file except in compliance with the License. You  may  obtain  a copy of
+ * the License at http://www.openbravo.com/legal/license.html
+ * Software distributed under the License  is  distributed  on  an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
+ * License for the specific  language  governing  rights  and  limitations
+ * under the License.
+ * The Original Code is Openbravo ERP.
+ * The Initial Developer of the Original Code is Openbravo S.L.U.
+ * All portions are Copyright (C) 2016 Openbravo S.L.U.
+ * All Rights Reserved.
+ * Contributor(s):
+ ************************************************************************
+ *
+ * @author = MCA
+ *
+ */
+
+package org.openbravo.test.mobile.quarantine.extmodules.MCA.stockvalidation;
+
+import org.junit.Test;
+import org.openbravo.test.mobile.common.junit.TestClassAnnotations;
+import org.openbravo.test.mobile.common.selenium.SeleniumHelper;
+import org.openbravo.test.mobile.retail.extmodules.selenium.TestIdExtModules;
+import org.openbravo.test.mobile.retail.extmodules.selenium.terminals.WebPOSExtModulesTerminalHelper;
+import org.openbravo.test.mobile.retail.pack.selenium.TestIdPack;
+
+@TestClassAnnotations(isHighVolumeCompatible = true)
+public class I34089_OrderFromQuotationNotAllowNegativeStock extends WebPOSExtModulesTerminalHelper {
+
+  public I34089_OrderFromQuotationNotAllowNegativeStock() {
+    super("VBS1001", "vallblanca", "openbravo");
+  }
+
+  /**
+   * Default test to check that stock validation works when order has been created from quotation.
+   * This test checks that 'canceling' the "Not enough stock" popup effectively removes the product
+   * from the ticket, and that 'proceeding' leaves the product on the ticket.
+   */
+  @Test
+  public void test() {
+    boolean isTestSuccessful = false;
+    try {
+      enablePermission(false);
+      tap(TestIdExtModules.BUTTON_MENU);
+      tap(TestIdExtModules.BUTTON_MENU_CREATEQUOTATION);
+      verify(TestIdExtModules.LABEL_RECEIPT_TYPE, "Quotation - Draft");
+
+      addProduct();
+      verify(TestIdExtModules.LABEL_RECEIPT_ROW1_QTY, "1");
+      verify(TestIdExtModules.LABEL_RECEIPT_ROW2_QTY, "100");
+      verify(TestIdExtModules.LABEL_RECEIPT_TOTAL_QTY, "101");
+
+      tap(TestIdExtModules.BUTTON_PAY);
+      verify(TestIdExtModules.LABEL_RECEIPT_TYPE, "Quotation - Under Evaluation");
+
+      tap(TestIdExtModules.BUTTON_MENU);
+      tap(TestIdExtModules.BUTTON_MENU_CREATEORDERFROMQUOTATION);
+      tap(TestIdExtModules.BUTTON_POPUP_CREATEORDER);
+      TestIdExtModules.CONFIRMATION_POPUP.enyoNode().waitUntilIsReady();
+      verify(TestIdExtModules.LABEL_POPUP_TITLE, "Not enough stock");
+      tap(TestIdExtModules.BUTTON_POPUP_CONFIRMATION_OK);
+      verify(TestIdExtModules.LABEL_TOTALTOPAY, "9,180.50");
+      verify(TestIdExtModules.LABEL_RECEIPT_ROW1_QTY, "61");
+      verify(TestIdExtModules.LABEL_RECEIPT_TOTAL_QTY, "61");
+      verify(TestIdExtModules.LABEL_TOTALTOPAY, "9,180.50");
+
+      tap(TestIdExtModules.BUTTON_DELETERECEIPT);
+      tap(TestIdExtModules.BUTTON_DELETERECEIPT_CONFIRM);
+      verify(TestIdExtModules.LABEL_TOTALTOPAY, "0.00");
+      enablePermission(true);
+      isTestSuccessful = true;
+    } finally {
+      if (!isTestSuccessful) {
+        // Restore changes
+        enablePermission(true);
+      }
+    }
+  }
+
+  private void addProduct() {
+    tap(TestIdExtModules.BUTTON_SEARCH);
+    write(TestIdExtModules.FIELD_SEARCH_TEXT, "Adhesive body warmers");
+    tap(TestIdExtModules.BUTTON_SEARCH_EXECUTE);
+    tap(TestIdExtModules.BUTTON_SEARCHPRODUCT_BACKPACKSANDTRAVEL_ADHESIVEBODYWARNMERS);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "3.60");
+
+    write(TestIdExtModules.FIELD_SEARCH_TEXT, "Avalanche transceiver");
+    tap(TestIdExtModules.BUTTON_SEARCH_EXECUTE);
+    tap(TestIdExtModules.BUTTON_SEARCHPRODUCT_AVALANCHETRANSCEIVEREXT);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "154.10");
+    // changes quantity
+    tap(TestIdPack.BUTTON_RECEIPT_ROW2);
+    tap(TestIdPack.BUTTON_KEYPAD_1);
+    tap(TestIdPack.BUTTON_KEYPAD_0);
+    tap(TestIdPack.BUTTON_KEYPAD_0);
+    tap(TestIdPack.BUTTON_KEYPAD_QUANTITY);
+    verify(TestIdExtModules.LABEL_TOTALTOPAY, "15,053.60");
+  }
+
+  private void enablePermission(final boolean isActive) {
+    SeleniumHelper.executeScript(String.format(
+        "OB.MobileApp.model.attributes.obpossv_negativeStockAllowed = %s", isActive));
+  }
+}