Bug 25898: Prohibit indirect object notation
[koha.git] / svc / club / enroll
blob014ca4c6d40afc474c8385c32eaf7c8bce0c5a14
1 #!/usr/bin/perl
3 # Copyright 2014 ByWater Solutions
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
21 use Modern::Perl;
23 use CGI;
24 use JSON qw(to_json);
26 use C4::Auth qw(check_cookie_auth);
27 use Koha::Club::Enrollment::Fields;
28 use Koha::Club::Enrollments;
29 use Koha::Clubs;
31 my $cgi = CGI->new;
33 my ( $auth_status, $sessionID ) =
34 check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
35 if ( $auth_status ne "ok" ) {
36 exit 0;
39 my $id = $cgi->param('id');
40 my $borrowernumber = $cgi->param('borrowernumber');
42 my $club = Koha::Clubs->find($id);
44 my $enrollment;
45 if ($club) {
46 $enrollment = Koha::Club::Enrollment->new(
48 club_id => $club->id(),
49 borrowernumber => $borrowernumber,
50 date_enrolled => \'NOW()',
51 date_created => \'NOW()',
52 branchcode => C4::Context->userenv ? C4::Context->userenv->{'branch'} : undef,
54 )->store();
56 if ($enrollment) {
57 my @enrollment_fields = $club->club_template()->club_template_enrollment_fields();
59 foreach my $e (@enrollment_fields) {
60 my $club_enrollment_field = Koha::Club::Enrollment::Field->new(
62 club_enrollment_id => $enrollment->id(),
63 club_template_enrollment_field_id => $e->id(),
64 value => $cgi->param( $e->id() ),
66 )->store();
71 binmode STDOUT, ':encoding(UTF-8)';
72 print $cgi->header( -type => 'text/plain', -charset => 'UTF-8' );
74 print to_json( { success => $enrollment ? 1 : 0 } );