Bug 25898: Prohibit indirect object notation
[koha.git] / opac / opac-suggestions.pl
blob2c7dbfb7c7284f9d4ffc2eacfb7a80192a1b4b68
1 #!/usr/bin/perl
3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # Koha is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
18 use Modern::Perl;
21 use CGI qw ( -utf8 );
22 use Encode qw( encode );
23 use C4::Auth; # get_template_and_user
24 use C4::Members;
25 use C4::Koha;
26 use C4::Output;
27 use C4::Suggestions;
28 use C4::Koha;
29 use C4::Scrubber;
30 use C4::Search qw( FindDuplicate );
32 use Koha::AuthorisedValues;
33 use Koha::Libraries;
34 use Koha::Patrons;
36 use Koha::DateUtils;
38 my $input = CGI->new;
39 my $op = $input->param('op') || 'else';
40 my $biblionumber = $input->param('biblionumber');
41 my $suggestion = $input->Vars;
42 my $negcaptcha = $input->param('negcap');
43 my $suggested_by_anyone = $input->param('suggested_by_anyone') || 0;
44 my $need_confirm = 0;
46 # If a spambot accidentally populates the 'negcap' field in the sugesstions form, then silently skip and return.
47 if ($negcaptcha ) {
48 print $input->redirect("/cgi-bin/koha/opac-suggestions.pl");
49 exit;
52 #If suggestions are turned off we redirect to 404 error. This will also redirect guest suggestions
53 if ( ! C4::Context->preference('suggestion') ) {
54 print $input->redirect("/cgi-bin/koha/errors/404.pl");
55 exit;
58 my ( $template, $borrowernumber, $cookie, @messages );
59 my $deleted = $input->param('deleted');
60 my $submitted = $input->param('submitted');
62 if ( ( C4::Context->preference("AnonSuggestions") and Koha::Patrons->find( C4::Context->preference("AnonymousPatron") ) ) or ( C4::Context->preference("OPACViewOthersSuggestions") and $op eq 'else' ) ) {
63 ( $template, $borrowernumber, $cookie ) = get_template_and_user(
65 template_name => "opac-suggestions.tt",
66 query => $input,
67 type => "opac",
68 authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
72 else {
73 ( $template, $borrowernumber, $cookie ) = get_template_and_user(
75 template_name => "opac-suggestions.tt",
76 query => $input,
77 type => "opac",
82 # don't pass 'negcap' column to DB, else DBI::Class will error
83 # DBIx::Class::Row::store_column(): No such column 'negcap' on Koha::Schema::Result::Suggestion at Koha/C4/Suggestions.pm
84 delete $suggestion->{negcap};
85 delete $suggestion->{$_} foreach qw<op suggested_by_anyone confirm>;
87 if ( $op eq 'else' ) {
88 if ( C4::Context->preference("OPACViewOthersSuggestions") ) {
89 if ( $borrowernumber ) {
90 # A logged in user is able to see suggestions from others
91 $suggestion->{suggestedby} = $suggested_by_anyone
92 ? undef
93 : $borrowernumber;
95 else {
96 # Non logged in user is able to see all suggestions
97 $suggestion->{suggestedby} = undef;
100 else {
101 if ( $borrowernumber ) {
102 $suggestion->{suggestedby} = $borrowernumber;
104 else {
105 $suggestion->{suggestedby} = -1;
108 } else {
109 if ( $borrowernumber ) {
110 $suggestion->{suggestedby} = $borrowernumber;
112 else {
113 $suggestion->{suggestedby} = C4::Context->preference("AnonymousPatron");
117 if ( $op eq "add_validate" && not $biblionumber ) { # If we are creating the suggestion from an existing record we do not want to search for duplicates
118 $op = 'add_confirm';
119 my $biblio = MarcRecordFromNewSuggestion($suggestion);
120 if ( my ($duplicatebiblionumber, $duplicatetitle) = FindDuplicate($biblio) ) {
121 push @messages, { type => 'error', code => 'biblio_exists', id => $duplicatebiblionumber, title => $duplicatetitle };
122 $need_confirm = 1;
123 $op = 'add';
127 my $patrons_pending_suggestions_count = 0;
128 my $patrons_total_suggestions_count = 0;
129 if ( $borrowernumber ){
130 if ( C4::Context->preference("MaxTotalSuggestions") ne '' && C4::Context->preference("NumberOfSuggestionDays") ne '' ) {
131 my $suggesteddate_from = dt_from_string()->subtract(days=>C4::Context->preference("NumberOfSuggestionDays"));
132 $suggesteddate_from = output_pref({ dt => $suggesteddate_from, dateformat => 'iso', dateonly => 1 });
133 $patrons_total_suggestions_count = Koha::Suggestions->search({ suggestedby => $borrowernumber, suggesteddate => { '>=' => $suggesteddate_from } })->count;
136 if ( C4::Context->preference("MaxOpenSuggestions") ne '' ) {
137 $patrons_pending_suggestions_count = Koha::Suggestions->search({ suggestedby => $borrowernumber, STATUS => 'ASKED' } )->count ;
141 if ( $op eq "add_confirm" ) {
142 my $suggestions_loop = &SearchSuggestion($suggestion);
143 if ( C4::Context->preference("MaxTotalSuggestions") ne '' && $patrons_total_suggestions_count >= C4::Context->preference("MaxTotalSuggestions") )
145 push @messages, { type => 'error', code => 'total_suggestions' };
147 elsif ( C4::Context->preference("MaxOpenSuggestions") ne '' && $patrons_pending_suggestions_count >= C4::Context->preference("MaxOpenSuggestions") ) #only check limit for signed in borrowers
149 push @messages, { type => 'error', code => 'too_many' };
151 elsif ( @$suggestions_loop >= 1 ) {
153 #some suggestion are answering the request Donot Add
154 for my $suggestion (@$suggestions_loop) {
155 push @messages,
157 type => 'error',
158 code => 'already_exists',
159 id => $suggestion->{suggestionid}
161 last;
164 else {
165 my $scrubber = C4::Scrubber->new();
166 foreach my $suggest ( keys %$suggestion ) {
168 # Don't know why the encode is needed for Perl v5.10 here
169 $suggestion->{$suggest} = Encode::encode( "utf8",
170 $scrubber->scrub( $suggestion->{$suggest} ) );
172 $suggestion->{suggesteddate} = dt_from_string;
173 $suggestion->{branchcode} = $input->param('branchcode') || C4::Context->userenv->{"branch"};
175 &NewSuggestion($suggestion);
176 $patrons_pending_suggestions_count++;
177 $patrons_total_suggestions_count++;
179 # delete empty fields, to avoid filter in "SearchSuggestion"
180 foreach my $field ( qw( title author publishercode copyrightdate place collectiontitle isbn STATUS ) ) {
181 delete $suggestion->{$field}; #clear search filters (except borrower related) to show all suggestions after placing a new one
183 $suggestions_loop = &SearchSuggestion($suggestion);
185 push @messages, { type => 'info', code => 'success_on_inserted' };
188 $op = 'else';
191 my $suggestions_loop = &SearchSuggestion({suggestedby => $suggestion->{suggestedby}});
192 if ( $op eq "delete_confirm" ) {
193 my @delete_field = $input->multi_param("delete_field");
194 foreach my $delete_field (@delete_field) {
195 &DelSuggestion( $borrowernumber, $delete_field );
197 $op = 'else';
198 print $input->redirect("/cgi-bin/koha/opac-suggestions.pl?op=else");
199 exit;
202 map{
203 my $s = $_;
204 my $library = Koha::Libraries->find($s->{branchcodesuggestedby});
205 $library ? $s->{branchcodesuggestedby} = $library->branchname : ()
206 } @$suggestions_loop;
208 foreach my $suggestion(@$suggestions_loop) {
209 if($suggestion->{'suggestedby'} == $borrowernumber) {
210 $suggestion->{'showcheckbox'} = $borrowernumber;
211 } else {
212 $suggestion->{'showcheckbox'} = 0;
214 if($suggestion->{'patronreason'}){
215 my $av = Koha::AuthorisedValues->search({ category => 'OPAC_SUG', authorised_value => $suggestion->{patronreason} });
216 $suggestion->{'patronreason'} = $av->count ? $av->next->opac_description : '';
220 my $patron_reason_loop = GetAuthorisedValues("OPAC_SUG");
222 my @mandatoryfields;
224 last unless ($op eq 'add');
225 my $fldsreq_sp = C4::Context->preference("OPACSuggestionMandatoryFields") || 'title';
226 @mandatoryfields = sort split(/\s*\,\s*/, $fldsreq_sp);
227 foreach (@mandatoryfields) {
228 $template->param( $_."_required" => 1);
230 if ( $biblionumber ) {
231 my $biblio = Koha::Biblios->find($biblionumber);
232 $template->param(
233 biblionumber => $biblio->biblionumber,
234 title => $biblio->title,
235 author => $biblio->author,
236 copyrightdate => $biblio->copyrightdate,
237 isbn => $biblio->biblioitem->isbn,
238 publishercode => $biblio->biblioitem->publishercode,
239 collectiontitle => $biblio->biblioitem->collectiontitle,
240 place => $biblio->biblioitem->place,
245 my @unwantedfields;
247 last unless ($op eq 'add');
248 my $fldsreq_sp = C4::Context->preference("OPACSuggestionUnwantedFields");
249 @unwantedfields = sort split(/\s*\,\s*/, $fldsreq_sp);
250 foreach (@unwantedfields) {
251 $template->param( $_."_hidden" => 1);
255 $template->param(
256 %$suggestion,
257 suggestions_loop => $suggestions_loop,
258 patron_reason_loop => $patron_reason_loop,
259 "op_$op" => 1,
260 $op => 1,
261 messages => \@messages,
262 suggestionsview => 1,
263 suggested_by_anyone => $suggested_by_anyone,
264 patrons_pending_suggestions_count => $patrons_pending_suggestions_count,
265 need_confirm => $need_confirm,
266 patrons_total_suggestions_count => $patrons_total_suggestions_count,
269 output_html_with_http_headers $input, $cookie, $template->output, undef, { force_no_caching => 1 };