Bug 19086 XSS in members/member.pl
[koha.git] / catalogue / labeledMARCdetail.pl
blobcd07f73135ac49eaabd39b5c388c19d92f0a7663
1 #!/usr/bin/perl
3 # Copyright 2008-2009 LibLime
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use strict;
21 use warnings;
22 use CGI qw ( -utf8 );
23 use HTML::Entities;
24 use MARC::Record;
25 use C4::Auth;
26 use C4::Context;
27 use C4::Output;
28 use C4::Biblio;
29 use C4::Items;
30 use C4::Members; # to use GetMember
31 use C4::Search; # enabled_staff_search_views
32 use C4::Acquisition qw(GetOrdersByBiblionumber);
34 use Koha::Biblios;
35 use Koha::BiblioFrameworks;
37 my $query = new CGI;
38 my $dbh = C4::Context->dbh;
39 my $biblionumber = $query->param('biblionumber');
40 $biblionumber = HTML::Entities::encode($biblionumber);
41 my $frameworkcode = $query->param('frameworkcode');
42 $frameworkcode = GetFrameworkCode( $biblionumber ) unless ($frameworkcode);
43 my $popup =
44 $query->param('popup')
45 ; # if set to 1, then don't insert links, it's just to show the biblio
47 # open template
48 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
50 template_name => "catalogue/labeledMARCdetail.tt",
51 query => $query,
52 type => "intranet",
53 authnotrequired => 0,
54 flagsrequired => { catalogue => 1 },
55 debug => 1,
59 my $record = GetMarcBiblio($biblionumber);
60 if ( not defined $record ) {
61 # biblionumber invalid -> report and exit
62 $template->param( unknownbiblionumber => 1,
63 biblionumber => $biblionumber
65 output_html_with_http_headers $query, $cookie, $template->output;
66 exit;
69 my $biblio_object = Koha::Biblios->find( $biblionumber ); # FIXME Should replace $biblio
70 my $tagslib = GetMarcStructure(1,$frameworkcode);
71 my $biblio = GetBiblioData($biblionumber);
73 if($query->cookie("holdfor")){
74 my $holdfor_patron = GetMember('borrowernumber' => $query->cookie("holdfor"));
75 $template->param(
76 holdfor => $query->cookie("holdfor"),
77 holdfor_surname => $holdfor_patron->{'surname'},
78 holdfor_firstname => $holdfor_patron->{'firstname'},
79 holdfor_cardnumber => $holdfor_patron->{'cardnumber'},
83 #count of item linked
84 my $itemcount = $biblio_object->items->count;
85 $template->param( count => $itemcount,
86 bibliotitle => $biblio->{title}, );
88 my $frameworks = Koha::BiblioFrameworks->search({}, { order_by => ['frameworktext'] });
89 $template->param(
90 frameworks => $frameworks,
91 frameworkcode => $frameworkcode,
94 my @marc_data;
95 my $prevlabel = '';
96 for my $field ($record->fields)
98 my $tag = $field->tag;
99 next if ! exists $tagslib->{$tag}->{lib};
100 my $label = $tagslib->{$tag}->{lib};
101 if ($label eq $prevlabel)
103 $label = '';
105 else
107 $prevlabel = $label;
109 my $value = $tag < 10
110 ? $field->data
111 : join ' ', map { $_->[1] } $field->subfields;
112 push @marc_data, {
113 label => $label,
114 value => $value,
118 $template->param (
119 marc_data => \@marc_data,
120 biblionumber => $biblionumber,
121 popup => $popup,
122 labeledmarcview => 1,
123 z3950_search_params => C4::Search::z3950_search_args($biblio),
124 C4::Search::enabled_staff_search_views,
125 searchid => scalar $query->param('searchid'),
128 my @allorders_using_biblio = GetOrdersByBiblionumber ($biblionumber);
129 my @deletedorders_using_biblio;
130 my @orders_using_biblio;
131 my @baskets_orders;
132 my @baskets_deletedorders;
134 foreach my $myorder (@allorders_using_biblio) {
135 my $basket = $myorder->{'basketno'};
136 if ((defined $myorder->{'datecancellationprinted'}) and ($myorder->{'datecancellationprinted'} ne '0000-00-00') ){
137 push @deletedorders_using_biblio, $myorder;
138 unless (grep(/^$basket$/, @baskets_deletedorders)){
139 push @baskets_deletedorders,$myorder->{'basketno'};
142 else {
143 push @orders_using_biblio, $myorder;
144 unless (grep(/^$basket$/, @baskets_orders)){
145 push @baskets_orders,$myorder->{'basketno'};
150 my $count_orders_using_biblio = scalar @orders_using_biblio ;
151 $template->param (countorders => $count_orders_using_biblio);
153 my $count_deletedorders_using_biblio = scalar @deletedorders_using_biblio ;
154 $template->param (countdeletedorders => $count_deletedorders_using_biblio);
156 $biblio = Koha::Biblios->find( $biblionumber );
157 my $holds = $biblio->holds;
158 $template->param( holdcount => $holds->count );
160 output_html_with_http_headers $query, $cookie, $template->output;