Bug 25898: Prohibit indirect object notation
[koha.git] / acqui / ajax-getauthvaluedropbox.pl
blob2693a2504266f3fdc8eacc925660b9b4ed0d9b92
1 #!/usr/bin/perl
3 # This file is part of Koha.
5 # Copyright 2012 BibLibre
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 =head1 NAME
22 ajax-getauthvaluedropbox.pl - returns an authorised values dropbox
24 =head1 DESCRIPTION
26 this script returns an authorised values dropbox
28 =head1 CGI PARAMETERS
30 =over 4
32 =item name
34 The name of the dropbox.
36 =item category
38 The category of authorised values.
40 =item default
42 Default value for the dropbox.
44 =back
46 =cut
48 use Modern::Perl;
50 use CGI qw ( -utf8 );
51 use C4::Charset;
52 use C4::Auth qw/check_api_auth/;
53 use Koha::AuthorisedValues;
55 my $query = CGI->new();
56 binmode STDOUT, ':encoding(UTF-8)';
58 my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '*'} );
59 unless ($status eq "ok") {
60 print $query->header(-type => 'text/plain', -status => '403 Forbidden');
61 print '<option></option>';
62 exit 0;
65 my $input = CGI->new;
66 my $name = $input->param('name');
67 my $category = $input->param('category');
68 my $default = $input->param('default');
69 $default = C4::Charset::NormalizeString($default);
70 my $branch_limit = C4::Context->userenv ? C4::Context->userenv->{"branch"} : "";
72 my $avs = Koha::AuthorisedValues->search(
74 branchcode => $branch_limit,
75 category => $category,
78 order_by => [ 'category', 'lib', 'lib_opac' ],
81 my $html = qq|<select id="$name" name="$name">|;
82 while ( my $av = $avs->next ) {
83 if ( $av->authorised_value eq $default ) {
84 $html .= q|<option value="| . $av->authorised_value . q|" selected="selected">| . $av->lib . q|</option>|;
85 } else {
86 $html .= q|<option value="| . $av->authorised_value . q|">| . $av->lib . q|</option>|;
89 $html .= qq|</select>|;
91 binmode STDOUT, ':encoding(UTF-8)';
92 print $input->header(-type => 'text/plain', -charset => 'UTF-8');
93 print $html;