diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl index 42ec0d136d..b21393d527 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl @@ -1,15 +1,71 @@ -Koha Online Catalog › Library Home for + Catalog › Comments on - - - -
+ + + + +
+ +
+ +

+ Note: your comment contained illegal markup code. + It has been saved with the markup removed, as below. + You can edit the comment further, or cancel to retain the comment as is. + + Error! Your comment was entirely illegal markup code. It has NOT been added. + Error! You cannot add an empty comment. Please add content or cancel. +

+ + Note: this window will close automatically in 5 seconds +
+
" /> - " />
Comments on by
@@ -17,30 +73,6 @@

Note: Your comment must be approved by a librarian.

Cancel
-
- - diff --git a/opac/opac-review.pl b/opac/opac-review.pl index 9f9722e27a..52f96e7be6 100755 --- a/opac/opac-review.pl +++ b/opac/opac-review.pl @@ -18,20 +18,19 @@ # Suite 330, Boston, MA 02111-1307 USA use strict; -require Exporter; +use warnings; use CGI; use C4::Auth; use C4::Koha; use C4::Output; -use C4::Circulation; use C4::Review; use C4::Biblio; +use C4::Scrubber; +use C4::Debug; my $query = new CGI; my $biblionumber = $query->param('biblionumber'); -my $type = $query->param('type'); my $review = $query->param('review'); -my $reviewid = $query->param('reviewid'); my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { template_name => "opac-review.tmpl", @@ -41,22 +40,41 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( } ); -my $biblio = GetBiblioData( $biblionumber); +# FIXME: need to allow user to delete their own comment(s) -my $savedreview = getreview( $biblionumber, $borrowernumber ); -if ( $type eq 'save' ) { - savereview( $biblionumber, $borrowernumber, $review ); +my $biblio = GetBiblioData($biblionumber); +my $savedreview = getreview($biblionumber,$borrowernumber); +my ($clean, @errors); +if (defined $review) { + if ($review !~ /\S/) { + push @errors, {empty=>1}; + } else { + $clean = C4::Scrubber->new('comment')->scrub($review); + if ($clean !~ /\S/) { + push @errors, {scrubbed_all=>1}; + } else { + if ($clean ne $review) { + push @errors, {scrubbed=>$clean}; + my $js_ok_review = $clean; + $js_ok_review =~ s/"/"/g; # probably redundant w/ TMPL ESCAPE=JS + $template->param(clean_review=>$js_ok_review); + } + if ($savedreview) { + updatereview($biblionumber, $borrowernumber, $clean); + } else { + savereview($biblionumber, $borrowernumber, $clean); + } + unless (@errors){ $template->param(WINDOW_CLOSE=>1); } + } + } } -elsif ( $type eq 'update' ) { - updatereview( $biblionumber, $borrowernumber, $review ); -} -$type = ($savedreview) ? "update" : "save"; +(@errors ) and $template->param( ERRORS=>\@errors); +($cgi_debug) and $template->param(cgi_debug=>1 ); $template->param( 'biblionumber' => $biblionumber, 'borrowernumber' => $borrowernumber, - 'type' => $type, - 'review' => $savedreview->{'review'}, - 'reviewid' => $reviewid, + 'review' => $clean || $savedreview->{'review'}, + 'reviewid' => $query->param('reviewid') || 0, 'title' => $biblio->{'title'}, );