Bug 17900: Fix possible SQL injection in patron cards template editing
[koha.git] / help.pl
blobad86a2da298222b989e60d08c781a9e881f6a065
1 #!/usr/bin/perl
3 # Copyright 2010 Koha Development team
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use strict;
21 use warnings;
22 use C4::Templates;
23 use C4::Output;
24 # use C4::Auth;
25 use C4::Context;
26 use CGI qw ( -utf8 );
28 sub _help_template_file_of_url {
29 my $url = shift;
30 my $file;
31 if ($url =~ /koha\/(.*)\.pl/) {
32 $file = $1;
33 } else {
34 $file = 'mainpage';
36 $file =~ s/[^a-zA-Z0-9_\-\/]*//g;
37 return "help/$file.tt";
40 my $query = new CGI;
42 # Init the interface to get the correct language.
43 # This is usually set by get_template_and_user
44 C4::Context->interface('intranet');
46 # find the script that called the online help using the CGI referer()
47 our $refer = $query->param('url');
48 $refer = $query->referer() if !$refer || $refer eq 'undefined';
49 my $from = _help_template_file_of_url($refer);
50 my $htdocs = C4::Context->config('intrahtdocs');
53 # checking that the help file exist, otherwise, display nohelp.tt page
55 my ( $theme, $lang ) = C4::Templates::themelanguage( $htdocs, $from, "intranet", $query );
56 unless ( -e "$htdocs/$theme/$lang/modules/$from" ) {
57 $from = "help/nohelp.tt";
58 ( $theme, $lang ) = C4::Templates::themelanguage( $htdocs, $from, "intranet", $query );
61 my $template = C4::Templates::gettemplate($from, 'intranet', $query);
62 $template->param(
63 referer => $refer,
64 intranetstylesheet => C4::Context->preference("intranetstylesheet"),
65 intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"),
68 my $help_version = C4::Context->preference("Version");
69 if ( $help_version =~ m|^(\d+)\.(\d{2}).*$| ) {
70 my $version = $1;
71 my $major = $2;
72 unless ( $major % 2 ) { $major-- };
73 $major = sprintf("%02d", $major);
74 $help_version = "$version.$major";
76 $template->param( helpVersion => $help_version );
78 output_html_with_http_headers $query, "", $template->output;