Bug 19125 - XSS - members.pl
[koha.git] / clubs / clubs-add-modify.pl
blobdabac245fab6061d22b633b95b35d810120c5b1b
1 #!/usr/bin/perl
3 # Copyright 2013 ByWater Solutions
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
22 use CGI;
24 use C4::Auth;
25 use C4::Output;
26 use Koha::Database;
27 use Koha::DateUtils qw(dt_from_string);
28 use Koha::Clubs;
29 use Koha::Club::Fields;
31 my $cgi = new CGI;
33 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
35 template_name => 'clubs/clubs-add-modify.tt',
36 query => $cgi,
37 type => 'intranet',
38 authnotrequired => 0,
39 flagsrequired => { clubs => 'edit_clubs' },
43 my $schema = Koha::Database->new()->schema();
45 my $id = $cgi->param('id');
46 my $club = $id ? Koha::Clubs->find($id) : Koha::Club->new();
48 my $stored =
49 $cgi->param('name')
50 ? $id
51 ? 'updated'
52 : 'stored'
53 : undef;
55 my $club_template_id = $cgi->param('club_template_id');
56 my $club_template = $club->club_template() || Koha::Club::Templates->find($club_template_id);
57 $club_template_id ||= $club_template->id();
59 my $date_start = $cgi->param('date_start');
60 $date_start = $date_start ? dt_from_string($date_start) : undef;
61 my $date_end = $cgi->param('date_end');
62 $date_end = $date_end ? dt_from_string($date_end) : undef;
64 if ( $cgi->param('name') ) { # Update or create club
65 $club->set(
67 club_template_id => scalar $cgi->param('club_template_id') || undef,
68 name => scalar $cgi->param('name') || undef,
69 description => scalar $cgi->param('description') || undef,
70 branchcode => scalar $cgi->param('branchcode') || undef,
71 date_start => $date_start,
72 date_end => $date_end,
73 date_updated => dt_from_string(),
75 )->store();
77 my @club_template_field_id = $cgi->multi_param('club_template_field_id');
78 my @club_field_id = $cgi->multi_param('club_field_id');
79 my @club_field = $cgi->multi_param('club_field');
81 for ( my $i = 0 ; $i < @club_template_field_id ; $i++ ) {
82 my $club_template_field_id = $club_template_field_id[$i] || undef;
83 my $club_field_id = $club_field_id[$i] || undef;
84 my $club_field = $club_field[$i] || undef;
86 my $field =
87 $club_field_id
88 ? Koha::Club::Fields->find($club_field_id)
89 : Koha::Club::Field->new();
91 $field->set(
93 club_id => $club->id(),
94 club_template_field_id => $club_template_field_id,
95 value => $club_field,
97 )->store();
100 $id ||= $club->id();
102 print $cgi->redirect("/cgi-bin/koha/clubs/clubs.pl?stored=$stored&club_id=$id");
103 exit;
106 $club = Koha::Clubs->find($id);
108 $template->param(
109 club_template => $club_template,
110 club => $club,
113 output_html_with_http_headers( $cgi, $cookie, $template->output );