Bug 25898: Prohibit indirect object notation
[koha.git] / clubs / templates-add-modify.pl
blob7e22af14ce2dea5d8fbbd955d84f8d2b1253e553
1 #!/usr/bin/perl
3 # Copyright 2013 ByWater Solutions
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
22 use CGI;
24 use C4::Auth;
25 use C4::Output;
27 use Koha::DateUtils qw(dt_from_string);
28 use Koha::Club::Templates;
29 use Koha::Club::Template::Fields;
30 use Koha::Club::Template::EnrollmentFields;
32 use Koha::Database;
33 my $schema = Koha::Database->new()->schema();
35 my $cgi = CGI->new;
37 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
39 template_name => 'clubs/templates-add-modify.tt',
40 query => $cgi,
41 type => 'intranet',
42 flagsrequired => { clubs => 'edit_templates' },
46 my $id = $cgi->param('id');
48 my $club_template;
49 my $stored;
51 if ( $cgi->param('name') ) { # Update or create club
52 if ($id) {
53 $club_template = Koha::Club::Templates->find($id);
54 $stored = 'updated';
56 else {
57 $club_template = Koha::Club::Template->new();
58 $stored = 'created';
61 $club_template->set(
63 id => $id || undef,
64 name => scalar $cgi->param('name') || undef,
65 description => scalar $cgi->param('description') || undef,
66 branchcode => scalar $cgi->param('branchcode') || undef,
67 date_updated => dt_from_string(),
68 is_email_required => scalar $cgi->param('is_email_required') ? 1 : 0,
69 is_enrollable_from_opac => scalar $cgi->param('is_enrollable_from_opac') ? 1 : 0,
71 )->store();
73 $id ||= $club_template->id();
75 # Update club creation fields
76 my @field_id = $cgi->multi_param('club_template_field_id');
77 my @field_name = $cgi->multi_param('club_template_field_name');
78 my @field_description = $cgi->multi_param('club_template_field_description');
79 my @field_authorised_value_category = $cgi->multi_param('club_template_field_authorised_value_category');
81 my @field_delete = $cgi->multi_param('club_template_field_delete');
83 for ( my $i = 0 ; $i < @field_id ; $i++ ) {
84 my $field_id = $field_id[$i];
85 my $field_name = $field_name[$i];
86 my $field_description = $field_description[$i];
87 my $field_authorised_value_category = $field_authorised_value_category[$i];
89 my $field =
90 $field_id
91 ? Koha::Club::Template::Fields->find($field_id)
92 : Koha::Club::Template::Field->new();
94 if ( grep { $_ eq $field_id } @field_delete ) {
95 $field->delete();
97 else {
98 $field->set(
100 club_template_id => $id,
101 name => $field_name,
102 description => $field_description,
103 authorised_value_category => $field_authorised_value_category,
105 )->store();
109 # Update club enrollment fields
110 @field_id = $cgi->multi_param('club_template_enrollment_field_id');
111 @field_name = $cgi->multi_param('club_template_enrollment_field_name');
112 @field_description = $cgi->multi_param('club_template_enrollment_field_description');
113 @field_authorised_value_category = $cgi->multi_param('club_template_enrollment_field_authorised_value_category');
115 @field_delete = $cgi->multi_param('club_template_enrollment_field_delete');
117 for ( my $i = 0 ; $i < @field_id ; $i++ ) {
118 my $field_id = $field_id[$i];
119 my $field_name = $field_name[$i];
120 my $field_description = $field_description[$i];
121 my $field_authorised_value_category = $field_authorised_value_category[$i];
123 my $field =
124 $field_id
125 ? Koha::Club::Template::EnrollmentFields->find($field_id)
126 : Koha::Club::Template::EnrollmentField->new();
128 if ( grep { $_ eq $field_id } @field_delete ) {
129 $field->delete();
131 else {
132 $field->set(
134 id => $field_id,
135 club_template_id => $id,
136 name => $field_name,
137 description => $field_description,
138 authorised_value_category => $field_authorised_value_category,
140 )->store();
144 print $cgi->redirect("/cgi-bin/koha/clubs/clubs.pl?stored=$stored&club_template_id=$id");
145 exit;
148 $club_template ||= Koha::Club::Templates->find($id);
149 $template->param( club_template => $club_template );
151 output_html_with_http_headers( $cgi, $cookie, $template->output );