Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)
[koha.git] / acqui / newordersubscription.pl
blob7353dc92d0f7377bf9984ca7b7d6494cf97c196c
1 #!/usr/bin/perl
3 # Copyright 2012 BibLibre
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
21 use CGI qw ( -utf8 );
22 use C4::Acquisition;
23 use C4::Auth;
24 use C4::Branch;
25 use C4::Context;
26 use C4::Output;
27 use C4::Serials;
29 use Koha::Acquisition::Bookseller;
31 my $query = new CGI;
32 my $title = $query->param('title_filter');
33 my $ISSN = $query->param('ISSN_filter');
34 my $EAN = $query->param('EAN_filter');
35 my $publisher = $query->param('publisher_filter');
36 my $supplier = $query->param('supplier_filter');
37 my $branch = $query->param('branch_filter');
38 my $routing = $query->param('routing') || C4::Context->preference("RoutingSerials");
39 my $searched = $query->param('searched');
40 my $biblionumber = $query->param('biblionumber');
42 my $basketno = $query->param('basketno');
43 my $booksellerid = $query->param('booksellerid');
45 my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
46 { template_name => "acqui/newordersubscription.tt",
47 query => $query,
48 type => "intranet",
49 authnotrequired => 0,
50 flagsrequired => { acquisition => 'order_manage' },
54 my $basket = GetBasket($basketno);
55 $booksellerid = $basket->{booksellerid} unless $booksellerid;
56 my $bookseller = Koha::Acquisition::Bookseller->fetch({ id => $booksellerid });
58 my @subscriptions;
59 if ($searched) {
60 @subscriptions = SearchSubscriptions({
61 title => $title,
62 issn => $ISSN,
63 ean => $EAN,
64 publisher => $publisher,
65 bookseller => $supplier,
66 branch => $branch
67 });
70 foreach my $sub (@subscriptions) {
71 $sub->{alreadyOnOrder} = subscriptionCurrentlyOnOrder $sub->{subscriptionid};
73 # to toggle between create or edit routing list options
74 if ($routing) {
75 $sub->{routingedit} = check_routing( $sub->{subscriptionid} );
79 my $branches = GetBranches();
80 my @branches_loop;
81 foreach (sort keys %$branches){
82 my $selected = 0;
83 $selected = 1 if defined $branch && $branch eq $_;
84 push @branches_loop, {
85 branchcode => $_,
86 branchname => $branches->{$_}->{branchname},
87 selected => $selected,
91 $template->param(
92 subs_loop => \@subscriptions,
93 title_filter => $title,
94 ISSN_filter => $ISSN,
95 EAN_filter => $EAN,
96 publisher_filter => $publisher,
97 supplier_filter => $supplier,
98 branch_filter => $branch,
99 branches_loop => \@branches_loop,
100 done_searched => $searched,
101 routing => $routing,
102 booksellerid => $booksellerid,
103 basketno => $basket->{basketno},
104 basketname => $basket->{basketname},
105 booksellername => $bookseller->{name},
107 output_html_with_http_headers $query, $cookie, $template->output;