Bug 19061: Avoid SQL Injection vulnerability
[koha.git] / members / readingrec.pl
blobb0b563c816296983f2280e923e921c344f908b08
1 #!/usr/bin/perl
3 # written 27/01/2000
4 # script to display borrowers reading record
6 # Copyright 2000-2002 Katipo Communications
8 # This file is part of Koha.
10 # Koha is free software; you can redistribute it and/or modify it
11 # under the terms of the GNU General Public License as published by
12 # the Free Software Foundation; either version 3 of the License, or
13 # (at your option) any later version.
15 # Koha is distributed in the hope that it will be useful, but
16 # WITHOUT ANY WARRANTY; without even the implied warranty of
17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 # GNU General Public License for more details.
20 # You should have received a copy of the GNU General Public License
21 # along with Koha; if not, see <http://www.gnu.org/licenses>.
23 use strict;
24 use warnings;
26 use CGI qw ( -utf8 );
28 use C4::Auth;
29 use C4::Output;
30 use C4::Members;
31 use List::MoreUtils qw/any uniq/;
32 use Koha::DateUtils;
33 use C4::Members::Attributes qw(GetBorrowerAttributes);
35 use Koha::Patrons;
36 use Koha::Patron::Categories;
38 my $input = CGI->new;
40 #get borrower details
41 my $data = undef;
42 my $borrowernumber = undef;
43 my $cardnumber = undef;
45 my ($template, $loggedinuser, $cookie)= get_template_and_user({template_name => "members/readingrec.tt",
46 query => $input,
47 type => "intranet",
48 authnotrequired => 0,
49 flagsrequired => {borrowers => 1},
50 debug => 1,
51 });
53 my $op = $input->param('op') || '';
54 my $patron;
55 if ($input->param('cardnumber')) {
56 $cardnumber = $input->param('cardnumber');
57 $patron = Koha::Patrons->find( { cardnumber => $cardnumber } );
58 $data = $patron->unblessed;
59 $borrowernumber = $data->{'borrowernumber'}; # we must define this as it is used to retrieve other data about the patron
61 if ($input->param('borrowernumber')) {
62 $borrowernumber = $input->param('borrowernumber');
63 $patron = Koha::Patrons->find( $borrowernumber );
64 $data = $patron->unblessed;
67 my $order = 'date_due desc';
68 my $limit = 0;
69 my $issues = ();
70 # Do not request the old issues of anonymous patron
71 if ( $borrowernumber eq C4::Context->preference('AnonymousPatron') ){
72 # use of 'eq' in the above comparison is intentional -- the
73 # system preference value could be blank
74 $template->param( is_anonymous => 1 );
75 } else {
76 $issues = GetAllIssues($borrowernumber,$order,$limit);
79 # barcode export
80 if ( $op eq 'export_barcodes' ) {
81 if ( $data->{'privacy'} < 2) {
82 my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 });
83 my @barcodes =
84 map { $_->{barcode} } grep { $_->{returndate} =~ m/^$today/o } @{$issues};
85 my $borrowercardnumber = $data->{cardnumber};
86 my $delimiter = "\n";
87 binmode( STDOUT, ":encoding(UTF-8)" );
88 print $input->header(
89 -type => 'application/octet-stream',
90 -charset => 'utf-8',
91 -attachment => "$today-$borrowercardnumber-checkinexport.txt"
94 my $content = join $delimiter, uniq(@barcodes);
95 print $content;
96 exit;
100 if ( $data->{'category_type'} eq 'C') {
101 my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
102 $template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1;
103 $template->param( 'catcode' => $patron_categories->next ) if $patron_categories->count == 1;
106 $template->param( adultborrower => 1 ) if ( $data->{'category_type'} eq 'A' || $data->{'category_type'} eq 'I' );
107 if (! $limit){
108 $limit = 'full';
111 $template->param( picture => 1 ) if $patron->image;
113 if (C4::Context->preference('ExtendedPatronAttributes')) {
114 my $attributes = GetBorrowerAttributes($borrowernumber);
115 $template->param(
116 ExtendedPatronAttributes => 1,
117 extendedattributes => $attributes
121 $template->param(%$data);
123 $template->param(
124 readingrecordview => 1,
125 borrowernumber => $borrowernumber,
126 privacy => $data->{'privacy'},
127 categoryname => $data->{description},
128 is_child => ( $data->{category_type} eq 'C' ),
129 loop_reading => $issues,
130 RoutingSerials => C4::Context->preference('RoutingSerials'),
132 output_html_with_http_headers $input, $cookie, $template->output;