]> git.koha-community.org Git - koha.git/blob - opac/opac-user.pl
Bug 31699: (follow-up) Protect against unauthorized redirects
[koha.git] / opac / opac-user.pl
1 #!/usr/bin/perl
2
3 # This file is part of Koha.
4 # parts copyright 2010 BibLibre
5 #
6 # Koha is free software; you can redistribute it and/or modify it
7 # under the terms of the GNU General Public License as published by
8 # the Free Software Foundation; either version 3 of the License, or
9 # (at your option) any later version.
10 #
11 # Koha is distributed in the hope that it will be useful, but
12 # WITHOUT ANY WARRANTY; without even the implied warranty of
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 # GNU General Public License for more details.
15 #
16 # You should have received a copy of the GNU General Public License
17 # along with Koha; if not, see <http://www.gnu.org/licenses>.
18
19
20 use Modern::Perl;
21
22 use CGI qw ( -utf8 );
23
24 use C4::Auth qw( get_template_and_user );
25 use C4::Koha qw(
26     getitemtypeimagelocation
27     GetNormalizedISBN
28     GetNormalizedUPC
29 );
30 use C4::Circulation qw( CanBookBeRenewed GetRenewCount GetIssuingCharges );
31 use C4::External::BakerTaylor qw( image_url link_url );
32 use C4::Reserves qw( GetReserveStatus );
33 use C4::Members;
34 use C4::Output qw( output_html_with_http_headers );
35 use Koha::Account::Lines;
36 use Koha::Biblios;
37 use Koha::Libraries;
38 use Koha::DateUtils qw( output_pref );
39 use Koha::Holds;
40 use Koha::Database;
41 use Koha::ItemTypes;
42 use Koha::Patron::Attribute::Types;
43 use Koha::Patrons;
44 use Koha::Patron::Messages;
45 use Koha::Patron::Discharge;
46 use Koha::Patrons;
47 use Koha::Ratings;
48 use Koha::Recalls;
49 use Koha::Token;
50
51 use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';
52
53 use Scalar::Util qw( looks_like_number );
54 use Date::Calc qw( Date_to_Days Today );
55
56 my $query = CGI->new;
57
58 # CAS single logout handling
59 # Will print header and exit
60 if ( C4::Context->preference('casAuthentication') ) {
61     require C4::Auth_with_cas;
62     C4::Auth_with_cas::logout_if_required($query);
63 }
64
65 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
66     {
67         template_name   => "opac-user.tt",
68         query           => $query,
69         type            => "opac",
70     }
71 );
72
73 my %renewed = map { $_ => 1 } split( ':', $query->param('renewed') || '' );
74
75 my $show_priority;
76 for ( C4::Context->preference("OPACShowHoldQueueDetails") ) {
77     m/priority/ and $show_priority = 1;
78 }
79
80 my $patronupdate = $query->param('patronupdate');
81 my $canrenew = 1;
82
83 $template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
84
85 # get borrower information ....
86 my $patron = Koha::Patrons->find( $borrowernumber );
87
88 if( $query->param('update_arc') && C4::Context->preference("AllowPatronToControlAutorenewal") ){
89     die "Wrong CSRF token"
90         unless Koha::Token->new->check_csrf({
91             session_id => scalar $query->cookie('CGISESSID'),
92             token  => scalar $query->param('csrf_token'),
93         });
94
95     my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');
96     $patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;
97 }
98
99 my $borr = $patron->unblessed;
100
101 my (  $today_year,   $today_month,   $today_day) = Today();
102 my ($warning_year, $warning_month, $warning_day) = split /-/, $borr->{'dateexpiry'};
103
104 my $debar = Koha::Patrons->find( $borrowernumber )->is_debarred;
105 my $userdebarred;
106
107 if ($debar) {
108     $userdebarred = 1;
109     $template->param( 'userdebarred' => $userdebarred );
110     if ( $debar ne "9999-12-31" ) {
111         $borr->{'userdebarreddate'} = $debar;
112     }
113     # FIXME looks like $available is not needed
114     # If a user is discharged they have a validated discharge available
115     my $available = Koha::Patron::Discharge::count({
116         borrowernumber => $borrowernumber,
117         validated      => 1,
118     });
119     $template->param( 'discharge_available' => $available && Koha::Patron::Discharge::is_discharged({borrowernumber => $borrowernumber}) );
120 }
121
122 if ( $userdebarred || $borr->{'gonenoaddress'} || $borr->{'lost'} ) {
123     $borr->{'flagged'} = 1;
124     $canrenew = 0;
125 }
126
127 my $amountoutstanding = $patron->account->balance;
128 my $no_renewal_amt = C4::Context->preference( 'OPACFineNoRenewals' );
129 $no_renewal_amt = undef unless looks_like_number( $no_renewal_amt );
130 my $amountoutstandingfornewal =
131   C4::Context->preference("OPACFineNoRenewalsIncludeCredit")
132   ? $amountoutstanding
133   : $patron->account->outstanding_debits->total_outstanding;
134
135 if (   C4::Context->preference('OpacRenewalAllowed')
136     && defined($no_renewal_amt)
137     && $amountoutstandingfornewal > $no_renewal_amt )
138 {
139     $borr->{'flagged'} = 1;
140     $canrenew = 0;
141     $template->param(
142         renewal_blocked_fines => $no_renewal_amt,
143         renewal_blocked_fines_amountoutstanding => $amountoutstandingfornewal,
144     );
145 }
146
147 my $maxoutstanding = C4::Context->preference('maxoutstanding');
148 if ( $amountoutstanding && ( $amountoutstanding > $maxoutstanding ) ){
149     $borr->{blockedonfines} = 1;
150 }
151
152 # Warningdate is the date that the warning starts appearing
153 if ( $borr->{'dateexpiry'} && C4::Context->preference('NotifyBorrowerDeparture') ) {
154     my $days_to_expiry = Date_to_Days( $warning_year, $warning_month, $warning_day ) - Date_to_Days( $today_year, $today_month, $today_day );
155     if ( $days_to_expiry < 0 ) {
156         #borrower card has expired, warn the borrower
157         $borr->{'warnexpired'} = $borr->{'dateexpiry'};
158     } elsif ( $days_to_expiry < C4::Context->preference('NotifyBorrowerDeparture') ) {
159         # borrower card soon to expire, warn the borrower
160         $borr->{'warndeparture'} = $borr->{dateexpiry};
161         if (C4::Context->preference('ReturnBeforeExpiry')){
162             $borr->{'returnbeforeexpiry'} = 1;
163         }
164     }
165 }
166
167 # pass on any renew errors to the template for displaying
168 my $renew_error = $query->param('renew_error');
169
170 $template->param(
171                     amountoutstanding => $amountoutstanding,
172                     borrowernumber    => $borrowernumber,
173                     patron_flagged    => $borr->{flagged},
174                     OPACMySummaryHTML => (C4::Context->preference("OPACMySummaryHTML")) ? 1 : 0,
175                     surname           => $borr->{surname},
176                     RENEW_ERROR       => $renew_error,
177                     borrower          => $borr,
178                     csrf_token             => Koha::Token->new->generate_csrf({
179                         session_id => scalar $query->cookie('CGISESSID'),
180                     }),
181                 );
182
183 #get issued items ....
184
185 my $count          = 0;
186 my $overdues_count = 0;
187 my @overdues;
188 my @issuedat;
189 my $itemtypes = { map { $_->{itemtype} => $_ } @{ Koha::ItemTypes->search_with_localization->unblessed } };
190 my $pending_checkouts = $patron->pending_checkouts->search({}, { order_by => [ { -desc => 'date_due' }, { -asc => 'issue_id' } ] });
191 my $are_renewable_items = 0;
192 if ( $pending_checkouts->count ) { # Useless test
193     while ( my $c = $pending_checkouts->next ) {
194         my $issue = $c->unblessed_all_relateds;
195         # check for reserves
196         my $restype = GetReserveStatus( $issue->{'itemnumber'} );
197         if ( $restype ) {
198             $issue->{'reserved'} = 1;
199         }
200
201         # Must be moved in a module if reused
202         my $charges = Koha::Account::Lines->search(
203             {
204                 borrowernumber    => $patron->borrowernumber,
205                 amountoutstanding => { '>' => 0 },
206                 debit_type_code   => [ 'OVERDUE', 'LOST' ],
207                 itemnumber        => $issue->{itemnumber}
208             },
209         );
210         $issue->{charges} = $charges->total_outstanding;
211
212         my $rental_fines = Koha::Account::Lines->search(
213             {
214                 borrowernumber    => $patron->borrowernumber,
215                 amountoutstanding => { '>' => 0 },
216                 debit_type_code   => { 'LIKE' => 'RENT_%' },
217                 itemnumber        => $issue->{itemnumber}
218             }
219         );
220         $issue->{rentalfines} = $rental_fines->total_outstanding;
221
222         # check if item is renewable
223         my ($status,$renewerror,$info) = CanBookBeRenewed( $borrowernumber, $issue->{'itemnumber'} );
224         (
225             $issue->{'renewcount'},
226             $issue->{'renewsallowed'},
227             $issue->{'renewsleft'},
228             $issue->{'unseencount'},
229             $issue->{'unseenallowed'},
230             $issue->{'unseenleft'}
231         ) = GetRenewCount($borrowernumber, $issue->{'itemnumber'});
232         ( $issue->{'renewalfee'}, $issue->{'renewalitemtype'} ) = GetIssuingCharges( $issue->{'itemnumber'}, $borrowernumber );
233         $issue->{itemtype_object} = Koha::ItemTypes->find( Koha::Items->find( $issue->{itemnumber} )->effective_itemtype );
234         if($status && C4::Context->preference("OpacRenewalAllowed")){
235             $are_renewable_items = 1;
236             $issue->{'status'} = $status;
237         }
238
239         $issue->{'renewed'} = $renewed{ $issue->{'itemnumber'} };
240
241         if ($renewerror) {
242             $issue->{'too_many'}       = 1 if $renewerror eq 'too_many';
243             $issue->{'too_unseen'}     = 1 if $renewerror eq 'too_unseen';
244             $issue->{'on_reserve'}     = 1 if $renewerror eq 'on_reserve';
245             $issue->{'norenew_overdue'} = 1 if $renewerror eq 'overdue';
246             $issue->{'auto_renew'}     = 1 if $renewerror eq 'auto_renew';
247             $issue->{'auto_too_soon'}  = 1 if $renewerror eq 'auto_too_soon';
248             $issue->{'auto_too_late'}  = 1 if $renewerror eq 'auto_too_late';
249             $issue->{'auto_too_much_oweing'}  = 1 if $renewerror eq 'auto_too_much_oweing';
250             $issue->{'item_denied_renewal'}  = 1 if $renewerror eq 'item_denied_renewal';
251
252             if ( $renewerror eq 'too_soon' ) {
253                 $issue->{'too_soon'}         = 1;
254                 $issue->{'soonestrenewdate'} = $info->{soonest_renew_date};
255             }
256         }
257
258         if ( $c->is_overdue ) {
259             push @overdues, $issue;
260             $overdues_count++;
261             $issue->{'overdue'} = 1;
262         }
263         else {
264             $issue->{'issued'} = 1;
265         }
266         # imageurl:
267         my $itemtype = $issue->{'itemtype'};
268         if ( $itemtype ) {
269             $issue->{'imageurl'}    = getitemtypeimagelocation( 'opac', $itemtypes->{$itemtype}->{'imageurl'} );
270             $issue->{'description'} = $itemtypes->{$itemtype}->{'description'};
271         }
272
273         if ( C4::Context->preference('OpacStarRatings') eq 'all' ) {
274             my $ratings = Koha::Ratings->search({ biblionumber => $issue->{biblionumber} });
275             $issue->{ratings} = $ratings;
276             $issue->{my_rating} = $borrowernumber ? $ratings->search({ borrowernumber => $borrowernumber })->next : undef;
277         }
278
279         my $biblio_object = Koha::Biblios->find($issue->{biblionumber});
280         $issue->{biblio_object} = $biblio_object;
281         push @issuedat, $issue;
282         $count++;
283
284         my $isbn = GetNormalizedISBN($issue->{'isbn'});
285         $issue->{normalized_isbn} = $isbn;
286         my $marcrecord = $biblio_object->metadata->record({ embed_items => 1, opac => 1, patron => $patron,});
287         $issue->{normalized_upc} = GetNormalizedUPC( $marcrecord, C4::Context->preference('marcflavour') );
288
289                 # My Summary HTML
290                 if (my $my_summary_html = C4::Context->preference('OPACMySummaryHTML')){
291                     $issue->{author} ? $my_summary_html =~ s/{AUTHOR}/$issue->{author}/g : $my_summary_html =~ s/{AUTHOR}//g;
292                     $issue->{title} =~ s/\/+$//; # remove trailing slash
293                     $issue->{title} =~ s/\s+$//; # remove trailing space
294                     $issue->{title} ? $my_summary_html =~ s/{TITLE}/$issue->{title}/g : $my_summary_html =~ s/{TITLE}//g;
295                     $issue->{isbn} ? $my_summary_html =~ s/{ISBN}/$isbn/g : $my_summary_html =~ s/{ISBN}//g;
296                     $issue->{biblionumber} ? $my_summary_html =~ s/{BIBLIONUMBER}/$issue->{biblionumber}/g : $my_summary_html =~ s/{BIBLIONUMBER}//g;
297                     $issue->{MySummaryHTML} = $my_summary_html;
298                 }
299
300         if ( C4::Context->preference('UseRecalls') ) {
301             my $maybe_recalls = Koha::Recalls->search({ biblio_id => $issue->{biblionumber}, item_id => [ undef, $issue->{itemnumber} ], completed => 0 });
302             while( my $recall = $maybe_recalls->next ) {
303                 if ( $recall->checkout and $recall->checkout->issue_id == $issue->{issue_id} ) {
304                     $issue->{recall} = 1;
305                     last;
306                 }
307             }
308         }
309     }
310 }
311 my $overduesblockrenewing = C4::Context->preference('OverduesBlockRenewing');
312 $canrenew = 0 if ($overduesblockrenewing ne 'allow' and $overdues_count == $count) || !$are_renewable_items;
313
314 $template->param( ISSUES       => \@issuedat );
315 $template->param( issues_count => $count );
316 $template->param( canrenew     => $canrenew );
317 $template->param( OVERDUES       => \@overdues );
318 $template->param( overdues_count => $overdues_count );
319
320 my $show_barcode = Koha::Patron::Attribute::Types->search( # FIXME we should not need this search
321     { code => ATTRIBUTE_SHOW_BARCODE } )->count;
322 if ($show_barcode) {
323     my $patron_show_barcode = $patron->get_extended_attribute(ATTRIBUTE_SHOW_BARCODE);
324     undef $show_barcode if $patron_show_barcode and not $patron_show_barcode->attribute;
325 }
326 $template->param( show_barcode => 1 ) if $show_barcode;
327
328 # now the reserved items....
329 my $reserves = $patron->holds->filter_out_has_cancellation_requests;
330
331 $template->param(
332     RESERVES       => $reserves,
333     showpriority   => $show_priority,
334 );
335
336 if ( C4::Context->preference('UseRecalls') ) {
337     my $recalls = Koha::Recalls->search( { patron_id => $borrowernumber, completed => 0 } );
338     $template->param( RECALLS => $recalls );
339 }
340
341 if (C4::Context->preference('BakerTaylorEnabled')) {
342     $template->param(
343         BakerTaylorEnabled  => 1,
344         BakerTaylorImageURL => &image_url(),
345         BakerTaylorLinkURL  => &link_url(),
346         BakerTaylorBookstoreURL => C4::Context->preference('BakerTaylorBookstoreURL'),
347     );
348 }
349
350 if (C4::Context->preference("OPACAmazonCoverImages") or 
351     C4::Context->preference("GoogleJackets") or
352     C4::Context->preference("BakerTaylorEnabled") or
353     C4::Context->preference("SyndeticsCoverImages") or
354     ( C4::Context->preference('OPACCustomCoverImages') and C4::Context->preference('CustomCoverImagesURL') )
355 ) {
356         $template->param(JacketImages=>1);
357 }
358
359 $template->param(
360     OverDriveCirculation => C4::Context->preference('OverDriveCirculation') || 0,
361     overdrive_error      => scalar $query->param('overdrive_error') || undef,
362     overdrive_tab        => scalar $query->param('overdrive_tab') || 0,
363     RecordedBooksCirculation => C4::Context->preference('RecordedBooksClientSecret') && C4::Context->preference('RecordedBooksLibraryID'),
364 );
365
366 my $patron_messages = Koha::Patron::Messages->search(
367     {
368         borrowernumber => $borrowernumber,
369         message_type => 'B',
370     }
371 );
372
373 if (   C4::Context->preference('AllowPatronToSetCheckoutsVisibilityForGuarantor')
374     || C4::Context->preference('AllowStaffToSetCheckoutsVisibilityForGuarantor') )
375 {
376     my @relatives;
377     # Filter out guarantees that don't want guarantor to see checkouts
378     foreach my $gr ( $patron->guarantee_relationships->as_list ) {
379         my $g = $gr->guarantee;
380         push( @relatives, $g ) if $g->privacy_guarantor_checkouts;
381     }
382     $template->param( relatives => \@relatives );
383 }
384
385 if (   C4::Context->preference('AllowPatronToSetFinesVisibilityForGuarantor')
386     || C4::Context->preference('AllowStaffToSetFinesVisibilityForGuarantor') )
387 {
388     my @relatives_with_fines;
389     # Filter out guarantees that don't want guarantor to see checkouts
390     foreach my $gr ( $patron->guarantee_relationships->as_list ) {
391         my $g = $gr->guarantee;
392         push( @relatives_with_fines, $g ) if $g->privacy_guarantor_fines;
393     }
394     $template->param( relatives_with_fines => \@relatives_with_fines );
395 }
396
397 if ( C4::Context->preference("ArticleRequests") ) {
398     $template->param(
399         current_article_requests => [$patron->article_requests->filter_by_current->as_list],
400     );
401 }
402
403 $template->param(
404     patron_messages          => $patron_messages,
405     opacnote                 => $borr->{opacnote},
406     patronupdate             => $patronupdate,
407     OpacRenewalAllowed       => C4::Context->preference("OpacRenewalAllowed"),
408     userview                 => 1,
409     SuspendHoldsOpac         => C4::Context->preference('SuspendHoldsOpac'),
410     AutoResumeSuspendedHolds => C4::Context->preference('AutoResumeSuspendedHolds'),
411     OpacHoldNotes            => C4::Context->preference('OpacHoldNotes'),
412     failed_holds             => scalar $query->param('failed_holds'),
413 );
414
415 # if not an empty string this indicates to return
416 # back to the opac-results page
417 my $search_query = $query->param('has-search-query');
418
419 if ($search_query) {
420
421     print $query->redirect(
422         -uri    => "/cgi-bin/koha/opac-search.pl?$search_query",
423         -cookie => $cookie,
424     );
425 }
426
427 # if not an empty string this indicates to return
428 # back to the page we triggered the login from
429 my $return = $query->param('return');
430 if ( $return ) {
431     my $uri = C4::Context->preference('OPACBaseURL');
432     $uri .= $return;
433     print $query->redirect(
434         -uri    => $uri,
435         -cookie => $cookie,
436     );
437 }
438
439 output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };