Bug 25898: Prohibit indirect object notation
[koha.git] / authorities / authorities-home.pl
1 #!/usr/bin/perl
2
3 # Copyright 2000-2002 Katipo Communications
4 #
5 # This file is part of Koha.
6 #
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
11 #
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
16 #
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20 use Modern::Perl;
21
22 use CGI qw ( -utf8 );
23 use URI::Escape;
24 use POSIX qw( ceil );
25
26 use C4::Context;
27 use C4::Auth;
28 use C4::Output;
29 use C4::AuthoritiesMarc;
30 use C4::Acquisition;
31 use C4::Koha;
32 use C4::Biblio;
33 use C4::Search::History;
34
35 use Koha::Authority::Types;
36 use Koha::SearchEngine::Search;
37 use Koha::SearchEngine::QueryBuilder;
38 use Koha::Token;
39 use Koha::Z3950Servers;
40
41 my $query = CGI->new;
42 my $dbh   = C4::Context->dbh;
43 my $op           = $query->param('op')           || '';
44 my $authtypecode = $query->param('authtypecode') || '';
45 my $authid       = $query->param('authid')       || '';
46
47 my ( $template, $loggedinuser, $cookie );
48
49 my $authority_types = Koha::Authority::Types->search( {}, { order_by => ['authtypetext'] } );
50
51 if ( $op eq "delete" ) {
52     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
53         {
54             template_name   => "authorities/authorities-home.tt",
55             query           => $query,
56             type            => 'intranet',
57             flagsrequired   => { catalogue => 1 },
58             debug           => 1,
59         }
60     );
61
62     output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
63         unless Koha::Token->new->check_csrf({
64             session_id => scalar $query->cookie('CGISESSID'),
65             token  => scalar $query->param('csrf_token'),
66         });
67
68     DelAuthority({ authid => $authid });
69
70     if ( $query->param('operator') ) {
71         # query contains search params so perform search
72         $op = "do_search";
73     }
74     else {
75         $op = '';
76     }
77 }
78 if ( $op eq "do_search" ) {
79     my $marclist  = $query->param('marclist')  || '';
80     my $and_or    = $query->param('and_or')    || '';
81     my $excluding = $query->param('excluding') || '';
82     my $operator  = $query->param('operator')  || '';
83     my $orderby   = $query->param('orderby')   || '';
84     my $value     = $query->param('value')     || '';
85
86     my $startfrom      = $query->param('startfrom')      || 1;
87     my $resultsperpage = $query->param('resultsperpage') || 20;
88     my $offset = ( $startfrom - 1 ) * $resultsperpage + 1;
89
90     my $builder = Koha::SearchEngine::QueryBuilder->new(
91         { index => $Koha::SearchEngine::AUTHORITIES_INDEX } );
92     my $searcher = Koha::SearchEngine::Search->new(
93         { index => $Koha::SearchEngine::AUTHORITIES_INDEX } );
94     my $search_query = $builder->build_authorities_query_compat(
95         [$marclist], [$and_or], [$excluding], [$operator],
96         [$value], $authtypecode, $orderby
97     );
98     my ( $results, $total ) = $searcher->search_auth_compat(
99         $search_query, $offset, $resultsperpage
100     );
101
102     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
103         {
104             template_name   => "authorities/searchresultlist.tt",
105             query           => $query,
106             type            => 'intranet',
107             flagsrequired   => { catalogue => 1 },
108             debug           => 1,
109         }
110     );
111
112     $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
113     $template->param(
114         csrf_token => Koha::Token->new->generate_csrf({
115             session_id => scalar $query->cookie('CGISESSID'),
116         }),
117     );
118
119     # search history
120     if (C4::Context->preference('EnableSearchHistory')) {
121         if ( $startfrom == 1) {
122             my $path_info = $query->url(-path_info=>1);
123             my $query_cgi_history = $query->url(-query=>1);
124             $query_cgi_history =~ s/^$path_info\?//;
125             $query_cgi_history =~ s/;/&/g;
126
127             C4::Search::History::add({
128                 userid => $loggedinuser,
129                 sessionid => $query->cookie("CGISESSID"),
130                 query_desc => $value,
131                 query_cgi => $query_cgi_history,
132                 total => $total,
133                 type => "authority",
134             });
135         }
136     }
137
138     $template->param(
139         marclist       => $marclist,
140         and_or         => $and_or,
141         excluding      => $excluding,
142         operator       => $operator,
143         orderby        => $orderby,
144         value          => $value,
145         authtypecode   => $authtypecode,
146         startfrom      => $startfrom,
147         resultsperpage => $resultsperpage,
148     );
149
150     # we must get parameters once again. Because if there is a mainentry, it
151     # has been replaced by something else during the search, thus the links
152     # next/previous would not work anymore
153
154     # construction of the url of each page
155     my $value_url = uri_escape_utf8($value);
156     my $base_url = "authorities-home.pl?"
157       ."marclist=$marclist"
158       ."&amp;and_or=$and_or"
159       ."&amp;excluding=$excluding"
160       ."&amp;operator=$operator"
161       ."&amp;value=$value_url"
162       ."&amp;resultsperpage=$resultsperpage"
163       ."&amp;type=intranet"
164       ."&amp;op=do_search"
165       ."&amp;authtypecode=$authtypecode"
166       ."&amp;orderby=$orderby";
167
168     my $from = ( $startfrom - 1 ) * $resultsperpage + 1;
169     my $to;
170     if ( !defined $total ) {
171         $total = 0;
172     }
173
174     if ( $total < $startfrom * $resultsperpage ) {
175         $to = $total;
176     }
177     else {
178         $to = $startfrom * $resultsperpage;
179     }
180
181     $template->param( result => $results ) if $results;
182
183     my $max_result_window = $searcher->max_result_window;
184     my $hits_to_paginate = ($max_result_window && $max_result_window < $total) ? $max_result_window : $total;
185
186     $template->param(
187         pagination_bar => pagination_bar(
188             $base_url,  ceil( $hits_to_paginate / $resultsperpage ),
189             $startfrom, 'startfrom'
190         ),
191         total            => $total,
192         hits_to_paginate => $hits_to_paginate,
193         from             => $from,
194         to               => $to,
195         isEDITORS        => $authtypecode eq 'EDITORS',
196     );
197
198 }
199 if ( $op eq '' ) {
200     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
201         {
202             template_name   => "authorities/authorities-home.tt",
203             query           => $query,
204             type            => 'intranet',
205             flagsrequired   => { catalogue => 1 },
206             debug           => 1,
207         }
208     );
209
210 }
211
212 my $servers = Koha::Z3950Servers->search(
213     {
214         recordtype => 'authority',
215         servertype => ['zed', 'sru'],
216     },
217 );
218
219 $template->param(
220     servers => $servers,
221     authority_types => $authority_types,
222     op            => $op,
223 );
224
225 $template->{VARS}->{marcflavour} = C4::Context->preference("marcflavour");
226
227 # Print the page
228 output_html_with_http_headers $query, $cookie, $template->output;