Bug 25898: Prohibit indirect object notation
[koha.git] / svc / problem_reports
blob9df283efb50aeb61d8f8aa723de718a3f74ba14f
1 #!/usr/bin/perl
3 # This file is part of Koha.
5 # Copyright 2020 Aleisha Amohia <aleisha@catalyst.net.nz>
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
22 use JSON qw( to_json );
23 use CGI;
24 use C4::Service;
25 use C4::Auth qw /check_cookie_auth/;
26 use C4::Output qw(:DEFAULT :ajax);
27 use Koha::ProblemReports;
29 =head1 NAME
31 svc/problem_reports - Web service for managing OPAC problem reports
33 =head1 DESCRIPTION
35 =cut
37 # AJAX requests
38 my $is_ajax = is_ajax();
39 my $query = CGI->new;
40 my ( $auth_status, $sessionID ) = check_cookie_auth( $query->cookie('CGISESSID'), { problem_reports => 1 } );
41 if ( $auth_status ne "ok" ) {
42 exit 0;
44 if ($is_ajax) {
45 my $report_id = $query->param('report_id');
46 my $report = Koha::ProblemReports->find($report_id);
47 my $action = $query->param('action');
48 my $status = 'success';
49 if ( $action eq 'viewed' ) {
50 $report->set({ status => 'Viewed' })->store;
51 if ( $report->status ne 'Viewed' ) {
52 $status = 'failure';
54 } elsif ( $action eq 'closed' ) {
55 $report->set({ status => 'Closed' })->store;
56 if ( $report->status ne 'Closed' ) {
57 $status = 'failure';
59 } elsif ( $action eq 'new' ) {
60 $report->set({ status => 'New' })->store;
61 if ( $report->status ne 'New' ) {
62 $status = 'failure';
65 my $json = to_json ( { status => $status } );
66 output_with_http_headers $query, undef, $json, 'js';
67 exit;