Bug 25898: Prohibit indirect object notation
[koha.git] / circ / request-article.pl
blob48b1d02e560a88120a7b022f7c4516d0bc261f0c
1 #!/usr/bin/perl
3 # Copyright 2015 ByWater Solutions
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
22 use C4::Output;
23 use C4::Auth;
24 use C4::Utils::DataTables::Members;
25 use C4::Search;
26 use C4::Serials;
27 use Koha::Biblios;
28 use Koha::Patrons;
29 use Koha::ArticleRequests;
31 my $cgi = CGI->new;
33 my ( $template, $borrowernumber, $cookie, $flags ) = get_template_and_user(
35 template_name => "circ/request-article.tt",
36 query => $cgi,
37 type => "intranet",
38 flagsrequired => { circulate => 'circulate_remaining_permissions' },
42 my $action = $cgi->param('action') || q{};
43 my $biblionumber = $cgi->param('biblionumber');
44 my $patron_cardnumber = $cgi->param('patron_cardnumber');
45 my $patron_id = $cgi->param('patron_id');
47 my $biblio = Koha::Biblios->find($biblionumber);
48 output_and_exit( $cgi, $cookie, $template, 'unknown_biblio')
49 unless $biblio;
51 my $patron =
52 $patron_id ? Koha::Patrons->find($patron_id)
53 : $patron_cardnumber ? Koha::Patrons->find( { cardnumber => $patron_cardnumber } )
54 : undef;
56 if ( $action eq 'create' ) {
57 my $borrowernumber = $cgi->param('borrowernumber');
58 my $branchcode = $cgi->param('branchcode');
60 my $itemnumber = $cgi->param('itemnumber') || undef;
61 my $title = $cgi->param('title') || undef;
62 my $author = $cgi->param('author') || undef;
63 my $volume = $cgi->param('volume') || undef;
64 my $issue = $cgi->param('issue') || undef;
65 my $date = $cgi->param('date') || undef;
66 my $pages = $cgi->param('pages') || undef;
67 my $chapters = $cgi->param('chapters') || undef;
68 my $patron_notes = $cgi->param('patron_notes') || undef;
70 my $ar = Koha::ArticleRequest->new(
72 borrowernumber => $borrowernumber,
73 biblionumber => $biblionumber,
74 branchcode => $branchcode,
75 itemnumber => $itemnumber,
76 title => $title,
77 author => $author,
78 volume => $volume,
79 issue => $issue,
80 date => $date,
81 pages => $pages,
82 chapters => $chapters,
83 patron_notes => $patron_notes,
85 )->store();
89 if ( !$patron && $patron_cardnumber ) {
90 my $results = C4::Utils::DataTables::Members::search(
92 searchmember => $patron_cardnumber,
93 dt_params => { iDisplayLength => -1 },
97 my $patrons = $results->{patrons};
99 if ( scalar @$patrons == 1 ) {
100 $patron = Koha::Patrons->find( $patrons->[0]->{borrowernumber} );
102 elsif (@$patrons) {
103 $template->param( patrons => $patrons );
105 else {
106 $template->param( no_patrons_found => $patron_cardnumber );
110 $template->param(
111 biblio => $biblio,
112 patron => $patron,
113 subscriptionsnumber => CountSubscriptionFromBiblionumber($biblionumber),
114 C4::Search::enabled_staff_search_views,
117 output_html_with_http_headers $cgi, $cookie, $template->output;