Bug 18898 - Some permissions for Reports can be bypassed
[koha.git] / svc / article_request
blob8db68ffdec5ff092920ca7f944ac9b275a1f8db9
1 #!/usr/bin/perl
3 # Copyright 2015 ByWater Solutions
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it under the
8 # terms of the GNU General Public License as published by the Free Software
9 # Foundation; either version 2 of the License, or (at your option) any later
10 # version.
12 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14 # A PARTICULAR PURPOSE. See the GNU General Public License for more details.
16 # You should have received a copy of the GNU General Public License along
17 # with Koha; if not, write to the Free Software Foundation, Inc.,
18 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 use Modern::Perl;
23 use CGI;
24 use JSON qw(to_json);
26 use C4::Auth qw(check_cookie_auth);
27 use Koha::ArticleRequests;
29 my $cgi = new CGI;
31 my ( $auth_status, $sessionID ) =
32 check_cookie_auth( $cgi->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
33 if ( $auth_status ne "ok" ) {
34 exit 0;
37 binmode STDOUT, ':encoding(UTF-8)';
38 print $cgi->header( -type => 'text/plain', -charset => 'UTF-8' );
40 my $id = $cgi->param('id');
41 my $action = $cgi->param('action') || q{};
42 my $notes = $cgi->param('notes');
44 my $ar = Koha::ArticleRequests->find($id);
46 if ($ar) {
47 if ( $action eq 'cancel' ) {
48 $ar = $ar->cancel( $notes );
50 elsif ( $action eq 'process' ) {
51 $ar = $ar->process();
53 elsif ( $action eq 'complete' ) {
54 $ar = $ar->complete();
56 elsif ( $action eq 'update_branchcode' ) {
57 my $branchcode = $cgi->param('branchcode');
58 $ar->branchcode( $branchcode ) if $branchcode;
59 $ar = $ar->store();
63 print to_json( { success => $ar ? 1 : 0 } );