Bug 33702: Patrons should only see their own ILLs in the OPAC
[koha.git] / opac / opac-illrequests.pl
1 #!/usr/bin/perl
2
3 # Copyright 2017 PTFS-Europe Ltd
4 #
5 # This file is part of Koha.
6 #
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
11 #
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
16 #
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20 use Modern::Perl;
21
22 use JSON qw( encode_json );
23
24 use CGI qw ( -utf8 );
25 use C4::Auth qw( get_template_and_user );
26 use C4::Koha;
27 use C4::Output qw( output_html_with_http_headers );
28
29 use Koha::Illrequest::Config;
30 use Koha::Illrequests;
31 use Koha::Libraries;
32 use Koha::Patrons;
33 use Koha::Illrequest::Availability;
34
35 my $query = CGI->new;
36
37 # Grab all passed data
38 # 'our' since Plack changes the scoping
39 # of 'my'
40 our $params = $query->Vars();
41
42 # if illrequests is disabled, leave immediately
43 if ( ! C4::Context->preference('ILLModule') ) {
44     print $query->redirect("/cgi-bin/koha/errors/404.pl");
45     exit;
46 }
47
48 my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
49     template_name   => "opac-illrequests.tt",
50     query           => $query,
51     type            => "opac",
52 });
53
54 # Are we able to actually work?
55 my $reduced  = C4::Context->preference('ILLOpacbackends');
56 my $backends = Koha::Illrequest::Config->new->available_backends($reduced);
57 my $backends_available = ( scalar @{$backends} > 0 );
58 $template->param( backends_available => $backends_available );
59
60 my $op = $params->{'method'} || 'list';
61
62 if ( $op eq 'list' ) {
63
64     my $requests = Koha::Illrequests->search(
65         { borrowernumber => $loggedinuser }
66     );
67     my $req = Koha::Illrequest->new;
68     $template->param(
69         requests => $requests,
70         backends    => $backends
71     );
72
73 } elsif ( $op eq 'view') {
74     my $request = Koha::Illrequests->find({
75         borrowernumber => $loggedinuser,
76         illrequest_id  => $params->{illrequest_id}
77     });
78     # Make sure the request belongs to the logged in user
79     unless ( $request->borrowernumber == $loggedinuser ) {
80         print $query->redirect("/cgi-bin/koha/errors/404.pl");
81         exit;
82     }
83     $template->param(
84         request => $request
85     );
86
87 } elsif ( $op eq 'update') {
88     my $request = Koha::Illrequests->find({
89         borrowernumber => $loggedinuser,
90         illrequest_id  => $params->{illrequest_id}
91     });
92     $request->notesopac($params->{notesopac})->store;
93     # Send a notice to staff alerting them of the update
94     $request->send_staff_notice('ILL_REQUEST_MODIFIED');
95     print $query->redirect(
96         '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' .
97         $params->{illrequest_id} .
98         '&message=1'
99     );
100     exit;
101 } elsif ( $op eq 'cancreq') {
102     my $request = Koha::Illrequests->find({
103         borrowernumber => $loggedinuser,
104         illrequest_id  => $params->{illrequest_id}
105     });
106     $request->status('CANCREQ')->store;
107     print $query->redirect(
108         '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' .
109         $params->{illrequest_id} .
110         '&message=1'
111     );
112     exit;
113 } elsif ( $op eq 'create' ) {
114     if (!$params->{backend}) {
115         my $req = Koha::Illrequest->new;
116         $template->param(
117             backends    => $req->available_backends
118         );
119     } else {
120         my $request = Koha::Illrequest->new
121             ->load_backend($params->{backend});
122
123         # Does this backend enable us to insert an availability stage and should
124         # we? If not, proceed as normal.
125         if (
126             C4::Context->preference("ILLCheckAvailability") &&
127             $request->_backend_capability(
128                 'should_display_availability',
129                 $params
130             ) &&
131             # If the user has elected to continue with the request despite
132             # having viewed availability info, this flag will be set
133             !$params->{checked_availability}
134         ) {
135             # Establish which of the installed availability providers
136             # can service our metadata, if so, jump in
137             my $availability = Koha::Illrequest::Availability->new($params);
138             my $services = $availability->get_services({
139                 ui_context => 'opac'
140             });
141             if (scalar @{$services} > 0) {
142                 # Modify our method so we use the correct part of the
143                 # template
144                 $op = 'availability';
145                 # Prepare the metadata we're sending them
146                 my $metadata = $availability->prep_metadata($params);
147                 $template->param(
148                     metadata        => $metadata,
149                     services_json   => encode_json($services),
150                     services        => $services,
151                     illrequestsview => 1,
152                     message         => $params->{message},
153                     method          => $op,
154                     whole           => $params
155                 );
156                 output_html_with_http_headers $query, $cookie,
157                     $template->output, undef, { force_no_caching => 1 };
158                 exit;
159             }
160         }
161
162         $params->{cardnumber} = Koha::Patrons->find({
163             borrowernumber => $loggedinuser
164         })->cardnumber;
165         $params->{opac} = 1;
166         my $backend_result = $request->backend_create($params);
167         if ($backend_result->{stage} eq 'copyrightclearance') {
168             $template->param(
169                 stage       => $backend_result->{stage},
170                 whole       => $backend_result
171             );
172         } else {
173             $template->param(
174                 types       => [ "Book", "Article", "Journal" ],
175                 branches    => Koha::Libraries->search->unblessed,
176                 whole       => $backend_result,
177                 request     => $request
178             );
179             if ($backend_result->{stage} eq 'commit') {
180                 print $query->redirect('/cgi-bin/koha/opac-illrequests.pl?message=2');
181                 exit;
182             }
183         }
184
185     }
186 }
187
188 $template->param(
189     message         => $params->{message},
190     illrequestsview => 1,
191     method          => $op
192 );
193
194 output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };