Bug 21993: Display a user-friendly message when the CSRF token is wrong
[koha.git] / authorities / authorities-home.pl
1 #!/usr/bin/perl
2
3 # Copyright 2000-2002 Katipo Communications
4 #
5 # This file is part of Koha.
6 #
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
11 #
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
16 #
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20 use strict;
21 use warnings;
22
23 use CGI qw ( -utf8 );
24 use URI::Escape;
25 use POSIX qw( ceil );
26
27 use C4::Context;
28 use C4::Auth;
29 use C4::Output;
30 use C4::AuthoritiesMarc;
31 use C4::Acquisition;
32 use C4::Koha;
33 use C4::Biblio;
34 use C4::Search::History;
35
36 use Koha::Authority::Types;
37 use Koha::SearchEngine::Search;
38 use Koha::SearchEngine::QueryBuilder;
39 use Koha::Token;
40 use Koha::Z3950Servers;
41
42 my $query = new CGI;
43 my $dbh   = C4::Context->dbh;
44 my $op           = $query->param('op')           || '';
45 my $authtypecode = $query->param('authtypecode') || '';
46 my $authid       = $query->param('authid')       || '';
47
48 my ( $template, $loggedinuser, $cookie );
49
50 my $authority_types = Koha::Authority::Types->search( {}, { order_by => ['authtypetext'] } );
51
52 if ( $op eq "delete" ) {
53     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
54         {
55             template_name   => "authorities/authorities-home.tt",
56             query           => $query,
57             type            => 'intranet',
58             authnotrequired => 0,
59             flagsrequired   => { catalogue => 1 },
60             debug           => 1,
61         }
62     );
63
64     output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
65         unless Koha::Token->new->check_csrf({
66             session_id => scalar $query->cookie('CGISESSID'),
67             token  => scalar $query->param('csrf_token'),
68         });
69
70     DelAuthority({ authid => $authid });
71
72     if ( $query->param('operator') ) {
73         # query contains search params so perform search
74         $op = "do_search";
75     }
76     else {
77         $op = '';
78     }
79 }
80 if ( $op eq "do_search" ) {
81     my $marclist  = $query->param('marclist')  || '';
82     my $and_or    = $query->param('and_or')    || '';
83     my $excluding = $query->param('excluding') || '';
84     my $operator  = $query->param('operator')  || '';
85     my $orderby   = $query->param('orderby')   || '';
86     my $value     = $query->param('value')     || '';
87
88     my $startfrom      = $query->param('startfrom')      || 1;
89     my $resultsperpage = $query->param('resultsperpage') || 20;
90     my $offset = ( $startfrom - 1 ) * $resultsperpage + 1;
91
92     my $builder = Koha::SearchEngine::QueryBuilder->new(
93         { index => $Koha::SearchEngine::AUTHORITIES_INDEX } );
94     my $searcher = Koha::SearchEngine::Search->new(
95         { index => $Koha::SearchEngine::AUTHORITIES_INDEX } );
96     my $search_query = $builder->build_authorities_query_compat(
97         [$marclist], [$and_or], [$excluding], [$operator],
98         [$value], $authtypecode, $orderby
99     );
100     my ( $results, $total ) = $searcher->search_auth_compat(
101         $search_query, $offset, $resultsperpage
102     );
103
104     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
105         {
106             template_name   => "authorities/searchresultlist.tt",
107             query           => $query,
108             type            => 'intranet',
109             authnotrequired => 0,
110             flagsrequired   => { catalogue => 1 },
111             debug           => 1,
112         }
113     );
114
115     $template->param(
116         csrf_token => Koha::Token->new->generate_csrf({
117             session_id => scalar $query->cookie('CGISESSID'),
118         }),
119     );
120
121     # search history
122     if (C4::Context->preference('EnableSearchHistory')) {
123         if ( $startfrom == 1) {
124             my $path_info = $query->url(-path_info=>1);
125             my $query_cgi_history = $query->url(-query=>1);
126             $query_cgi_history =~ s/^$path_info\?//;
127             $query_cgi_history =~ s/;/&/g;
128
129             C4::Search::History::add({
130                 userid => $loggedinuser,
131                 sessionid => $query->cookie("CGISESSID"),
132                 query_desc => $value,
133                 query_cgi => $query_cgi_history,
134                 total => $total,
135                 type => "authority",
136             });
137         }
138     }
139
140     $template->param(
141         marclist       => $marclist,
142         and_or         => $and_or,
143         excluding      => $excluding,
144         operator       => $operator,
145         orderby        => $orderby,
146         value          => $value,
147         authtypecode   => $authtypecode,
148         startfrom      => $startfrom,
149         resultsperpage => $resultsperpage,
150     );
151
152     # we must get parameters once again. Because if there is a mainentry, it
153     # has been replaced by something else during the search, thus the links
154     # next/previous would not work anymore
155
156     # construction of the url of each page
157     my $value_url = uri_escape_utf8($value);
158     my $base_url = "authorities-home.pl?"
159       ."marclist=$marclist"
160       ."&amp;and_or=$and_or"
161       ."&amp;excluding=$excluding"
162       ."&amp;operator=$operator"
163       ."&amp;value=$value_url"
164       ."&amp;resultsperpage=$resultsperpage"
165       ."&amp;type=intranet"
166       ."&amp;op=do_search"
167       ."&amp;authtypecode=$authtypecode"
168       ."&amp;orderby=$orderby";
169
170     my $from = ( $startfrom - 1 ) * $resultsperpage + 1;
171     my $to;
172     if ( !defined $total ) {
173         $total = 0;
174     }
175
176     if ( $total < $startfrom * $resultsperpage ) {
177         $to = $total;
178     }
179     else {
180         $to = $startfrom * $resultsperpage;
181     }
182
183     $template->param( result => $results ) if $results;
184
185     my $max_result_window = $searcher->max_result_window;
186     my $hits_to_paginate = ($max_result_window && $max_result_window < $total) ? $max_result_window : $total;
187
188     $template->param(
189         pagination_bar => pagination_bar(
190             $base_url,  ceil( $hits_to_paginate / $resultsperpage ),
191             $startfrom, 'startfrom'
192         ),
193         total            => $total,
194         hits_to_paginate => $hits_to_paginate,
195         from             => $from,
196         to               => $to,
197         isEDITORS        => $authtypecode eq 'EDITORS',
198     );
199
200 }
201 if ( $op eq '' ) {
202     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
203         {
204             template_name   => "authorities/authorities-home.tt",
205             query           => $query,
206             type            => 'intranet',
207             authnotrequired => 0,
208             flagsrequired   => { catalogue => 1 },
209             debug           => 1,
210         }
211     );
212
213 }
214
215 my $servers = Koha::Z3950Servers->search(
216     {
217         recordtype => 'authority',
218         servertype => ['zed', 'sru'],
219     },
220 );
221
222 $template->param(
223     servers => $servers,
224     authority_types => $authority_types,
225     op            => $op,
226 );
227
228 $template->{VARS}->{marcflavour} = C4::Context->preference("marcflavour");
229
230 # Print the page
231 output_html_with_http_headers $query, $cookie, $template->output;