Bug 14423: XSS bug in lateorders
[koha.git] / acqui / booksellers.pl
blob43dc024897833324878d783b3d1db59f798298b8
1 #!/usr/bin/perl
3 #script to show suppliers and orders
5 # Copyright 2000-2002 Katipo Communications
6 # Copyright 2008-2009 BibLibre SARL
7 # Copyright 2010 PTFS Europe
9 # This file is part of Koha.
11 # Koha is free software; you can redistribute it and/or modify it
12 # under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # Koha is distributed in the hope that it will be useful, but
17 # WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with Koha; if not, see <http://www.gnu.org/licenses>.
24 =head1 NAME
26 booksellers.pl
28 =head1 DESCRIPTION
30 this script displays the list of suppliers & baskets like C<$supplier> given on input arg.
31 thus, this page brings differents features like to display supplier's details,
32 to add an order for a specific supplier or to just add a new supplier.
34 =head1 CGI PARAMETERS
36 =over 4
38 =item supplier
40 C<$supplier> is the string with which we search for a supplier
42 =back
44 =over 4
46 =item id or booksellerid
48 The id of the supplier whose baskets we will display
50 =back
52 =cut
54 use strict;
55 use warnings;
56 use C4::Auth;
57 use C4::Biblio;
58 use C4::Budgets;
59 use C4::Output;
60 use CGI qw ( -utf8 );
62 use C4::Acquisition qw/ GetBasketsInfosByBookseller CanUserManageBasket /;
63 use C4::Members qw/GetMember/;
64 use C4::Context;
66 use Koha::Acquisition::Bookseller;
68 my $query = CGI->new;
69 my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
70 { template_name => 'acqui/booksellers.tt',
71 query => $query,
72 type => 'intranet',
73 authnotrequired => 0,
74 flagsrequired => { acquisition => '*' },
75 debug => 1,
79 #parameters
80 my $supplier = $query->param('supplier');
81 my $booksellerid = $query->param('booksellerid');
82 my $allbaskets= $query->param('allbaskets')||0;
83 my @suppliers;
85 if ($booksellerid) {
86 push @suppliers, Koha::Acquisition::Bookseller->fetch({ id => $booksellerid });
87 } else {
88 @suppliers = Koha::Acquisition::Bookseller->search({ name => $supplier });
91 my $supplier_count = @suppliers;
92 if ( $supplier_count == 1 ) {
93 $template->param(
94 supplier_name => $suppliers[0]->{'name'},
95 booksellerid => $suppliers[0]->{'id'},
96 basketcount => $suppliers[0]->{'basketcount'}
100 my $uid;
101 if ($loggedinuser) {
102 $uid = GetMember( borrowernumber => $loggedinuser )->{userid};
105 my $userenv = C4::Context::userenv;
106 my $viewbaskets = C4::Context->preference('AcqViewBaskets');
108 my $userbranch = $userenv->{branch};
110 my $budgets = GetBudgetHierarchy;
111 my $has_budgets = 0;
112 foreach my $r (@{$budgets}) {
113 if (!defined $r->{budget_amount} || $r->{budget_amount} == 0) {
114 next;
116 next unless (CanUserUseBudget($loggedinuser, $r, $userflags));
118 $has_budgets = 1;
119 last;
122 #build result page
123 my $loop_suppliers = [];
125 for my $vendor (@suppliers) {
126 my $baskets = GetBasketsInfosByBookseller( $vendor->{id}, $allbaskets );
128 my $loop_basket = [];
130 for my $basket ( @{$baskets} ) {
131 if (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
132 my $member = GetMember( borrowernumber => $basket->{authorisedby} );
133 foreach (qw(total_items total_biblios expected_items)) {
134 $basket->{$_} ||= 0;
136 if($member) {
137 $basket->{authorisedby_firstname} = $member->{firstname};
138 $basket->{authorisedby_surname} = $member->{surname};
140 if ($basket->{basketgroupid}) {
141 my $basketgroup = C4::Acquisition::GetBasketgroup($basket->{basketgroupid});
142 if ($basketgroup) {
143 $basket->{basketgroup} = $basketgroup;
146 push @{$loop_basket}, $basket;
150 push @{$loop_suppliers},
151 { loop_basket => $loop_basket,
152 booksellerid => $vendor->{id},
153 name => $vendor->{name},
154 active => $vendor->{active},
158 $template->param(
159 loop_suppliers => $loop_suppliers,
160 supplier => ( $booksellerid || $supplier ),
161 count => $supplier_count,
162 has_budgets => $has_budgets,
164 $template->{VARS}->{'allbaskets'} = $allbaskets;
166 output_html_with_http_headers $query, $cookie, $template->output;