Bug 17901: Fix possible SQL injection in shelf editing
[koha.git] / virtualshelves / shelves.pl
1 #!/usr/bin/perl
2
3 # Copyright 2015 Koha Team
4 #
5 # This file is part of Koha.
6 #
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
11 #
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
16 #
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20 use Modern::Perl;
21 use CGI qw ( -utf8 );
22 use C4::Auth;
23 use C4::Biblio;
24 use C4::Koha;
25 use C4::Items;
26 use C4::Members;
27 use C4::Output;
28 use C4::XSLT;
29
30 use Koha::Biblios;
31 use Koha::Biblioitems;
32 use Koha::CsvProfiles;
33 use Koha::Virtualshelves;
34
35 my $query = new CGI;
36
37 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
38     {   template_name   => "virtualshelves/shelves.tt",
39         query           => $query,
40         type            => "intranet",
41         authnotrequired => 0,
42         flagsrequired   => { catalogue => 1 },
43     }
44 );
45
46 my $op       = $query->param('op')       || 'list';
47 my $referer  = $query->param('referer')  || $op;
48 my $category = $query->param('category') || 1;
49 my ( $shelf, $shelfnumber, @messages );
50
51 if ( $op eq 'add_form' ) {
52     # Nothing to do
53 } elsif ( $op eq 'edit_form' ) {
54     $shelfnumber = $query->param('shelfnumber');
55     $shelf       = Koha::Virtualshelves->find($shelfnumber);
56
57     if ( $shelf ) {
58         $category = $shelf->category;
59         my $patron = GetMember( 'borrowernumber' => $shelf->owner );
60         $template->param( owner => $patron, );
61         unless ( $shelf->can_be_managed( $loggedinuser ) ) {
62             push @messages, { type => 'error', code => 'unauthorized_on_update' };
63             $op = 'list';
64         }
65     } else {
66         push @messages, { type => 'error', code => 'does_not_exist' };
67     }
68 } elsif ( $op eq 'add' ) {
69     eval {
70         $shelf = Koha::Virtualshelf->new(
71             {   shelfname          => scalar $query->param('shelfname'),
72                 sortfield          => scalar $query->param('sortfield'),
73                 category           => scalar $query->param('category'),
74                 allow_add          => scalar $query->param('allow_add'),
75                 allow_delete_own   => scalar $query->param('allow_delete_own'),
76                 allow_delete_other => scalar $query->param('allow_delete_other'),
77                 owner              => scalar $query->param('owner'),
78             }
79         );
80         $shelf->store;
81         $shelfnumber = $shelf->shelfnumber;
82     };
83     if ($@) {
84         push @messages, { type => 'error', code => ref($@), msg => $@ };
85     } elsif ( not $shelf ) {
86         push @messages, { type => 'error', code => 'error_on_insert' };
87     } else {
88         push @messages, { type => 'message', code => 'success_on_insert' };
89         $op = 'view';
90     }
91 } elsif ( $op eq 'edit' ) {
92     $shelfnumber = $query->param('shelfnumber');
93     $shelf       = Koha::Virtualshelves->find($shelfnumber);
94
95     if ( $shelf ) {
96         $op = $referer;
97         my $sortfield = $query->param('sortfield');
98         $sortfield = 'title' unless grep {/^$sortfield$/}qw( title author copyrightdate itemcallnumber );
99         if ( $shelf->can_be_managed( $loggedinuser ) ) {
100             $shelf->shelfname( scalar $query->param('shelfname') );
101             $shelf->sortfield( $sortfield );
102             $shelf->allow_add( scalar $query->param('allow_add') );
103             $shelf->allow_delete_own( scalar $query->param('allow_delete_own') );
104             $shelf->allow_delete_other( scalar $query->param('allow_delete_other') );
105             $shelf->category( scalar $query->param('category') );
106             eval { $shelf->store };
107
108             if ($@) {
109                 push @messages, { type => 'error', code => 'error_on_update' };
110                 $op = 'edit_form';
111             } else {
112                 push @messages, { type => 'message', code => 'success_on_update' };
113             }
114         } else {
115             push @messages, { type => 'error', code => 'unauthorized_on_update' };
116         }
117     } else {
118         push @messages, { type => 'error', code => 'does_not_exist' };
119     }
120 } elsif ( $op eq 'delete' ) {
121     $shelfnumber = $query->param('shelfnumber');
122     $shelf       = Koha::Virtualshelves->find($shelfnumber);
123     if ($shelf) {
124         if ( $shelf->can_be_deleted( $loggedinuser ) ) {
125             eval { $shelf->delete; };
126             if ($@) {
127                 push @messages, { type => 'error', code => ref($@), msg => $@ };
128             } else {
129                 push @messages, { type => 'message', code => 'success_on_delete' };
130             }
131         } else {
132             push @messages, { type => 'error', code => 'unauthorized_on_delete' };
133         }
134     } else {
135         push @messages, { type => 'error', code => 'does_not_exist' };
136     }
137     $op = 'list';
138 } elsif ( $op eq 'add_biblio' ) {
139     $shelfnumber = $query->param('shelfnumber');
140     $shelf = Koha::Virtualshelves->find($shelfnumber);
141     if ($shelf) {
142         if( my $barcode = $query->param('barcode') ) {
143             my $item = GetItem( 0, $barcode);
144             if (defined $item && $item->{itemnumber}) {
145                 my $biblio = GetBiblioFromItemNumber( $item->{itemnumber} );
146                 if ( $shelf->can_biblios_be_added( $loggedinuser ) ) {
147                     my $added = eval { $shelf->add_biblio( $biblio->{biblionumber}, $loggedinuser ); };
148                     if ($@) {
149                         push @messages, { type => 'error', code => ref($@), msg => $@ };
150                     } elsif ( $added ) {
151                         push @messages, { type => 'message', code => 'success_on_add_biblio' };
152                     } else {
153                         push @messages, { type => 'message', code => 'error_on_add_biblio' };
154                     }
155                 } else {
156                     push @messages, { type => 'error', code => 'unauthorized_on_add_biblio' };
157                 }
158             } else {
159                 push @messages, { type => 'error', code => 'item_does_not_exist' };
160             }
161         }
162     } else {
163         push @messages, { type => 'error', code => 'does_not_exist' };
164     }
165     $op = $referer;
166 } elsif ( $op eq 'remove_biblios' ) {
167     $shelfnumber = $query->param('shelfnumber');
168     $shelf = Koha::Virtualshelves->find($shelfnumber);
169     my @biblionumbers = $query->multi_param('biblionumber');
170     if ($shelf) {
171         if ( $shelf->can_biblios_be_removed( $loggedinuser ) ) {
172             my $number_of_biblios_removed = eval {
173                 $shelf->remove_biblios(
174                     {
175                         biblionumbers => \@biblionumbers,
176                         borrowernumber => $loggedinuser,
177                     }
178                 );
179             };
180             if ($@) {
181                 push @messages, { type => 'error', code => ref($@), msg => $@ };
182             } elsif ( $number_of_biblios_removed ) {
183                 push @messages, { type => 'message', code => 'success_on_remove_biblios' };
184             } else {
185                 push @messages, { type => 'error', code => 'no_biblio_removed' };
186             }
187         } else {
188             push @messages, { type => 'error', code => 'unauthorized_on_remove_biblios' };
189         }
190     } else {
191         push @messages, { type => 'error', code => 'does_not_exist' };
192     }
193     $op = $referer;
194 }
195
196 if ( $op eq 'view' ) {
197     $shelfnumber ||= $query->param('shelfnumber');
198     $shelf = Koha::Virtualshelves->find($shelfnumber);
199     if ( $shelf ) {
200         if ( $shelf->can_be_viewed( $loggedinuser ) ) {
201             my $sortfield = $query->param('sortfield') || $shelf->sortfield || 'title';    # Passed in sorting overrides default sorting
202             $sortfield = 'title' unless grep {/^$sortfield$/}qw( title author copyrightdate itemcallnumber );
203             my $direction = $query->param('direction') || 'asc';
204             $direction = 'asc' if $direction ne 'asc' and $direction ne 'desc';
205             my ( $rows, $page );
206             unless ( $query->param('print') ) {
207                 $rows = C4::Context->preference('numSearchResults') || 20;
208                 $page = ( $query->param('page') ? $query->param('page') : 1 );
209             }
210
211             my $order_by = $sortfield eq 'itemcallnumber' ? 'items.itemcallnumber' : $sortfield;
212             my $contents = $shelf->get_contents->search(
213                 {},
214                 {
215                     prefetch => [ { 'biblionumber' => { 'biblioitems' => 'items' } } ],
216                     page     => $page,
217                     rows     => $rows,
218                     order_by => { "-$direction" => $order_by },
219                 }
220             );
221
222             my $borrower = GetMember( borrowernumber => $loggedinuser );
223
224             my $xslfile = C4::Context->preference('XSLTListsDisplay');
225             my $lang   = $xslfile ? C4::Languages::getlanguage()  : undef;
226             my $sysxml = $xslfile ? C4::XSLT::get_xslt_sysprefs() : undef;
227
228             my @items;
229             while ( my $content = $contents->next ) {
230                 my $this_item;
231                 my $biblionumber = $content->biblionumber;
232                 my $record       = GetMarcBiblio($biblionumber);
233
234                 if ( $xslfile ) {
235                     $this_item->{XSLTBloc} = XSLTParse4Display( $biblionumber, $record, "XSLTListsDisplay",
236                                                                 1, undef, $sysxml, $xslfile, $lang);
237                 }
238
239                 my $marcflavour = C4::Context->preference("marcflavour");
240                 my $itemtype = Koha::Biblioitems->search({ biblionumber => $content->biblionumber })->next->itemtype;
241                 my $itemtypeinfo = getitemtypeinfo( $itemtype, 'intranet' );
242                 my $biblio = Koha::Biblios->find( $content->biblionumber );
243                 $this_item->{title}             = $biblio->title;
244                 $this_item->{author}            = $biblio->author;
245                 $this_item->{dateadded}         = $content->dateadded;
246                 $this_item->{imageurl}          = $itemtypeinfo->{imageurl};
247                 $this_item->{description}       = $itemtypeinfo->{description};
248                 $this_item->{notforloan}        = $itemtypeinfo->{notforloan};
249                 $this_item->{'coins'}           = GetCOinSBiblio($record);
250                 $this_item->{'subtitle'}        = GetRecordValue( 'subtitle', $record, GetFrameworkCode( $biblionumber ) );
251                 $this_item->{'normalized_upc'}  = GetNormalizedUPC( $record, $marcflavour );
252                 $this_item->{'normalized_ean'}  = GetNormalizedEAN( $record, $marcflavour );
253                 $this_item->{'normalized_oclc'} = GetNormalizedOCLCNumber( $record, $marcflavour );
254                 $this_item->{'normalized_isbn'} = GetNormalizedISBN( undef, $record, $marcflavour );
255
256                 unless ( defined $this_item->{size} ) {
257
258                     #TT has problems with size
259                     $this_item->{size} = q||;
260                 }
261
262                 # Getting items infos for location display
263                 my @items_infos = &GetItemsLocationInfo( $biblionumber );
264                 $this_item->{'ITEM_RESULTS'} = \@items_infos;
265                 $this_item->{biblionumber} = $biblionumber;
266                 push @items, $this_item;
267             }
268
269             my $some_private_shelves = Koha::Virtualshelves->get_some_shelves(
270                 {
271                     borrowernumber => $loggedinuser,
272                     add_allowed    => 1,
273                     category       => 1,
274                 }
275             );
276             my $some_public_shelves = Koha::Virtualshelves->get_some_shelves(
277                 {
278                     borrowernumber => $loggedinuser,
279                     add_allowed    => 1,
280                     category       => 2,
281                 }
282             );
283
284             $template->param(
285                 add_to_some_private_shelves => $some_private_shelves,
286                 add_to_some_public_shelves  => $some_public_shelves,
287                 can_manage_shelf   => $shelf->can_be_managed($loggedinuser),
288                 can_remove_shelf   => $shelf->can_be_deleted($loggedinuser),
289                 can_remove_biblios => $shelf->can_biblios_be_removed($loggedinuser),
290                 can_add_biblios    => $shelf->can_biblios_be_added($loggedinuser),
291                 sortfield          => $sortfield,
292                 itemsloop          => \@items,
293                 sortfield          => $sortfield,
294                 direction          => $direction,
295             );
296             if ( $page ) {
297                 my $pager = $contents->pager;
298                 $template->param(
299                     pagination_bar => pagination_bar(
300                         q||, $pager->last_page - $pager->first_page + 1,
301                         $page, "page", { op => 'view', shelfnumber => $shelf->shelfnumber, sortfield => $sortfield, direction => $direction, }
302                     ),
303                 );
304             }
305         } else {
306             push @messages, { type => 'error', code => 'unauthorized_on_view' };
307             undef $shelf;
308         }
309     } else {
310         push @messages, { type => 'error', code => 'does_not_exist' };
311     }
312 }
313
314 $template->param(
315     op       => $op,
316     referer  => $referer,
317     shelf    => $shelf,
318     messages => \@messages,
319     category => $category,
320     print    => scalar $query->param('print') || 0,
321     csv_profiles => [ Koha::CsvProfiles->search({ type => 'marc' }) ],
322 );
323
324 output_html_with_http_headers $query, $cookie, $template->output;