Bug 25898: Prohibit indirect object notation
[koha.git] / labels / label-edit-batch.pl
blobc6e5930e838f796ee7ee9a83a546c50e3fd30ec0
1 #!/usr/bin/perl
3 # Copyright 2006 Katipo Communications.
4 # Parts Copyright 2009 Foundations Bible College.
6 # This file is part of Koha.
8 # Koha is free software; you can redistribute it and/or modify it
9 # under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # Koha is distributed in the hope that it will be useful, but
14 # WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with Koha; if not, see <http://www.gnu.org/licenses>.
21 use Modern::Perl;
22 use vars qw($debug);
24 use CGI qw ( -utf8 );
26 use C4::Auth qw(get_template_and_user);
27 use C4::Output qw(output_html_with_http_headers);
28 use C4::Creators;
29 use C4::Labels;
31 use Koha::Items;
33 my $cgi = CGI->new;
34 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
36 template_name => "labels/label-edit-batch.tt",
37 query => $cgi,
38 type => "intranet",
39 flagsrequired => { catalogue => 1 },
40 debug => 1,
44 my $err = 0;
45 my $errtype = undef;
46 my $duplicate_count = undef;
47 my $duplicate_message = undef;
48 my $db_rows = {};
49 my $batch = undef;
50 my $display_columns = [ {_label_number => {label => 'Label number', link_field => 0}},
51 {_summary => {label => 'Summary', link_field => 0}},
52 {_item_type => {label => 'Item type', link_field => 0}},
53 {_item_cn => {label => 'Call number', link_field => 0}},
54 {_barcode => {label => 'Barcode', link_field => 0}},
55 {_delete => {label => 'Actions', link_field => 0}},
56 {select => {label => 'Select', value => '_label_id'}},
58 my $op = $cgi->param('op') || 'edit';
59 my @label_ids;
60 my @item_numbers;
61 my $number_list;
62 my $number_type = $cgi->param('number_type') || "barcode";
63 my $batch_id = $cgi->param('element_id') || $cgi->param('batch_id') || 0;
64 my $description = $cgi->param('description') || '';
65 @label_ids = $cgi->multi_param('label_id') if $cgi->param('label_id');
66 @item_numbers = $cgi->multi_param('item_number') if $cgi->param('item_number');
67 $number_list = $cgi->param('number_list') if $cgi->param('number_list');
69 my $branch_code = C4::Context->userenv->{'branch'};
71 if ($op eq 'remove') {
72 $batch = C4::Labels::Batch->retrieve(batch_id => $batch_id);
73 foreach my $label_id (@label_ids) {
74 $err = $batch->remove_item($label_id);
76 $errtype = 'ITEM_NOT_REMOVED' if $err;
77 # Something like this would be nice to avoid problems with the browser's 'refresh' button, but it needs an error handling mechanism...
78 # print $cgi->redirect("label-edit-batch.pl?op=edit&batch_id=$batch_id");
79 # exit;
81 elsif ($op eq 'delete') {
82 $err = C4::Labels::Batch::delete(batch_id => $batch_id, branch_code => $branch_code);
83 $errtype = 'BATCH_NOT_DELETED' if $err;
85 elsif ($op eq 'add') {
86 if ($number_list) {
87 my @numbers_list = split /\n/, $number_list; # Entries are effectively passed in as a <cr> separated list
88 foreach my $number (@numbers_list) {
89 $number =~ s/\r$//; # strip any naughty return chars
90 if( $number_type eq "itemnumber" && Koha::Items->find($number) ) {
91 push @item_numbers, $number;
93 elsif ($number_type eq "barcode" ) { # we must test in case an invalid barcode is passed in; we effectively disgard them atm
94 my $item = Koha::Items->find({barcode => $number});
95 push @item_numbers, $item->itemnumber if $item;
99 if ($batch_id != 0) {$batch = C4::Labels::Batch->retrieve(batch_id => $batch_id);}
100 if ($batch_id == 0 || $batch == -2) {$batch = C4::Labels::Batch->new(branch_code => $branch_code);}
101 $template->param( description => $batch->{description} );
102 if ($branch_code){
103 foreach my $item_number (@item_numbers) {
104 $err = $batch->add_item($item_number);
106 $batch_id = $batch->get_attr('batch_id') if $batch_id == 0; #update batch_id if we added to a new batch
107 $errtype = 'ITEM_NOT_ADDED' if $err;
109 else {
110 $err = 1;
111 $errtype = 'BRANCH_NOT_SET';
114 elsif ($op eq 'new') {
115 $batch = C4::Labels::Batch->new(branch_code => $branch_code);
116 $batch_id = $batch->get_attr('batch_id');
118 elsif ($op eq 'de_duplicate') {
119 $batch = C4::Labels::Batch->retrieve(batch_id => $batch_id);
120 $duplicate_count = $batch->remove_duplicates();
121 $duplicate_message = 1 if $duplicate_count != -1;
122 $errtype = 'BATCH_NOT_DEDUP' if $duplicate_count == -1;
124 else { # edit
125 $batch = C4::Labels::Batch->retrieve(batch_id => $batch_id);
126 $template->param( description => $batch->{description} );
129 my $items = $batch->get_attr('items');
130 $db_rows = get_label_summary(items => $items, batch_id => $batch_id);
132 my $table = html_table($display_columns, $db_rows);
134 $template->param(
135 err => $err,
136 errtype => $errtype,
137 ) if ($err ne 0);
139 $template->param(
140 op => $op,
141 batch_id => $batch_id,
142 table_loop => $table,
143 duplicate_message => $duplicate_message,
144 duplicate_count => $duplicate_count,
147 output_html_with_http_headers $cgi, $cookie, $template->output;