Bug 19086 XSS in members/member.pl
[koha.git] / svc / members / search
blob4f798ab871eb3b264a305780bf3e9bc5703bf062
1 #!/usr/bin/perl
3 # Copyright 2013 BibLibre
5 # This file is part of Koha
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
21 use CGI;
23 use C4::Auth qw( get_template_and_user haspermission get_user_subpermissions );
24 use C4::Output qw( output_with_http_headers );
25 use C4::Utils::DataTables qw( dt_get_params );
26 use C4::Utils::DataTables::Members qw( search );
27 use Koha::DateUtils qw( output_pref dt_from_string );
29 my $input = new CGI;
31 exit unless $input->param('template_path');
33 my ($template, $user, $cookie) = get_template_and_user({
34 template_name => scalar $input->param('template_path'),
35 query => $input,
36 type => "intranet",
37 authnotrequired => 0,
38 flagsrequired => { borrowers => 1 }
39 });
41 my $searchmember = $input->param('searchmember');
42 my $firstletter = $input->param('firstletter');
43 my $categorycode = $input->param('categorycode');
44 my $branchcode = $input->param('branchcode');
45 my $searchtype = $input->param('searchtype');
46 my $searchfieldstype = $input->param('searchfieldstype') || 'standard';
47 my $has_permission = $input->param('has_permission');
48 my $selection_type = $input->param('selection_type');
50 # variable information for DataTables (id)
51 my $sEcho = $input->param('sEcho');
53 my %dt_params = dt_get_params($input);
54 foreach (grep {$_ =~ /^mDataProp/} keys %dt_params) {
55 $dt_params{$_} =~ s/^dt_//;
58 my $results;
59 # If the user filled a term, maybe it's a cardnumber.
60 # This cannot be the case if a first letter is given.
61 if ( $searchmember
62 and not $firstletter
63 and $searchfieldstype
64 and $searchfieldstype eq 'standard' )
66 my $member = C4::Members::GetMember( cardnumber => $searchmember );
67 $results = {
68 iTotalRecords => 1,
69 iTotalDisplayRecords => 1,
70 patrons => [ $member ],
71 } if $member;
74 # Perform the patrons search
75 $results = C4::Utils::DataTables::Members::search(
77 searchmember => $searchmember,
78 firstletter => $firstletter,
79 categorycode => $categorycode,
80 branchcode => $branchcode,
81 searchtype => $searchtype,
82 searchfieldstype => $searchfieldstype,
83 dt_params => \%dt_params,
85 ) unless $results;
87 # It is not recommanded to use the has_permission param if you use the pagination
88 # The filter is done AFTER requested the data
89 if ($has_permission) {
90 my ( $permission, $subpermission ) = split /\./, $has_permission;
91 my @patrons_with_permission;
92 for my $patron ( @{ $results->{patrons} } ) {
93 my $perms = haspermission( $patron->{userid} );
94 if ( $perms->{superlibrarian} == 1
95 or $perms->{$permission} == 1 )
97 push @patrons_with_permission, $patron;
98 next;
101 if ($subpermission) {
102 my $subperms = get_user_subpermissions( $patron->{userid} );
103 push @patrons_with_permission, $patron
104 if $subperms->{$permission}->{$subpermission};
107 $results->{patrons} = \@patrons_with_permission;
108 $results->{iTotalDisplayRecords} = scalar( @patrons_with_permission );
111 $template->param(
112 sEcho => $sEcho,
113 iTotalRecords => $results->{iTotalRecords},
114 iTotalDisplayRecords => $results->{iTotalDisplayRecords},
115 aaData => $results->{patrons},
116 selection_type => $selection_type,
119 output_with_http_headers $input, $cookie, $template->output, 'json';
121 __END__
123 =head1 NAME
125 search - a search script for finding patrons
127 =head1 SYNOPSIS
129 This script provides a service for template for patron search using DataTables
131 =head2 Performing a search
133 Call this script from a DataTables table my $searchmember = $input->param('searchmember');
134 All following params are optional:
135 searchmember => the search terms
136 firstletter => search patrons with surname begins with this pattern (currently only used for 1 letter)
137 categorycode and branchcode => search patrons belong to a given categorycode or a branchcode
138 searchtype: can be 'contain' or 'start_with'
139 searchfieldstype: Can be 'standard', 'email', 'borrowernumber', 'userid', 'phone' or 'address'
141 =cut
143 =back
145 =head1 LICENSE
147 Copyright 2013 BibLibre
149 This file is part of Koha.
151 Koha is free software; you can redistribute it and/or modify it under the
152 terms of the GNU General Public License as published by the Free Software
153 Foundation; either version 2 of the License, or (at your option) any later
154 version.
156 Koha is distributed in the hope that it will be useful, but WITHOUT ANY
157 WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
158 A PARTICULAR PURPOSE. See the GNU General Public License for more details.
160 You should have received a copy of the GNU General Public License along
161 with Koha; if not, write to the Free Software Foundation, Inc.,
162 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.