Bug 17029: Fix XSS in catalogue/*detail.pl
[koha.git] / catalogue / moredetail.pl
1 #!/usr/bin/perl
2
3 # Copyright 2000-2003 Katipo Communications
4 # parts copyright 2010 BibLibre
5 #
6 # This file is part of Koha.
7 #
8 # Koha is free software; you can redistribute it and/or modify it
9 # under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
12 #
13 # Koha is distributed in the hope that it will be useful, but
14 # WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
17 #
18 # You should have received a copy of the GNU General Public License
19 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20
21
22 use strict;
23 #use warnings; FIXME - Bug 2505
24 use C4::Koha;
25 use CGI qw ( -utf8 );
26 use HTML::Entities;
27 use C4::Biblio;
28 use C4::Items;
29 use C4::Branch;
30 use C4::Acquisition;
31 use C4::Output;
32 use C4::Auth;
33 use C4::Serials;
34 use C4::Circulation;  # to use itemissues
35 use C4::Members; # to use GetMember
36 use C4::Search;         # enabled_staff_search_views
37 use C4::Members qw/GetHideLostItemsPreference/;
38 use C4::Reserves qw(GetReservesFromBiblionumber);
39
40 use Koha::Acquisition::Bookseller;
41 use Koha::DateUtils;
42
43 my $query=new CGI;
44
45 # FIXME  subject is not exported to the template?
46 my $subject=$query->param('subject');
47
48 # if its a subject we need to use the subject.tt
49 my ($template, $loggedinuser, $cookie) = get_template_and_user(
50     {
51         template_name   => ( $subject
52                                 ? 'catalogue/subject.tt'
53                                 : 'catalogue/moredetail.tt'),
54         query           => $query,
55         type            => "intranet",
56         authnotrequired => 0,
57         flagsrequired   => { catalogue => 1 },
58     }
59 );
60
61 if($query->cookie("holdfor")){ 
62     my $holdfor_patron = GetMember('borrowernumber' => $query->cookie("holdfor"));
63     $template->param(
64         holdfor => $query->cookie("holdfor"),
65         holdfor_surname => $holdfor_patron->{'surname'},
66         holdfor_firstname => $holdfor_patron->{'firstname'},
67         holdfor_cardnumber => $holdfor_patron->{'cardnumber'},
68     );
69 }
70
71 my $hidepatronname = C4::Context->preference("HidePatronName");
72
73 # get variables
74
75 my $biblionumber=$query->param('biblionumber');
76 $biblionumber = HTML::Entities::encode($biblionumber);
77 my $title=$query->param('title');
78 my $bi=$query->param('bi');
79 $bi = $biblionumber unless $bi;
80 my $itemnumber = $query->param('itemnumber');
81 my $data = &GetBiblioData($biblionumber);
82 my $dewey = $data->{'dewey'};
83 my $showallitems = $query->param('showallitems');
84
85 #coping with subscriptions
86 my $subscriptionsnumber = CountSubscriptionFromBiblionumber($biblionumber);
87
88 # FIXME Dewey is a string, not a number, & we should use a function
89 # $dewey =~ s/0+$//;
90 # if ($dewey eq "000.") { $dewey = "";};
91 # if ($dewey < 10){$dewey='00'.$dewey;}
92 # if ($dewey < 100 && $dewey > 10){$dewey='0'.$dewey;}
93 # if ($dewey <= 0){
94 #      $dewey='';
95 # }
96 # $dewey=~ s/\.$//;
97 # $data->{'dewey'}=$dewey;
98
99 my $fw = GetFrameworkCode($biblionumber);
100 my @all_items= GetItemsInfo($biblionumber);
101 my @items;
102 for my $itm (@all_items) {
103     push @items, $itm unless ( $itm->{itemlost} && 
104                                GetHideLostItemsPreference($loggedinuser) &&
105                                !$showallitems && 
106                                ($itemnumber != $itm->{itemnumber}));
107 }
108
109 my $record=GetMarcBiblio($biblionumber);
110
111 my $hostrecords;
112 # adding items linked via host biblios
113 my @hostitems = GetHostItemsInfo($record);
114 if (@hostitems){
115         $hostrecords =1;
116         push (@items,@hostitems);
117 }
118
119 my $subtitle = GetRecordValue('subtitle', $record, $fw);
120
121 my $totalcount=@all_items;
122 my $showncount=@items;
123 my $hiddencount = $totalcount - $showncount;
124 $data->{'count'}=$totalcount;
125 $data->{'showncount'}=$showncount;
126 $data->{'hiddencount'}=$hiddencount;  # can be zero
127
128 my $ccodes= GetKohaAuthorisedValues('items.ccode',$fw);
129 my $copynumbers = GetKohaAuthorisedValues('items.copynumber',$fw);
130 my $itemtypes = GetItemTypes;
131
132 $data->{'itemtypename'} = $itemtypes->{$data->{'itemtype'}}->{'description'};
133 $data->{'rentalcharge'} = sprintf( "%.2f", $data->{'rentalcharge'} );
134 foreach ( keys %{$data} ) {
135     $template->param( "$_" => defined $data->{$_} ? $data->{$_} : '' );
136 }
137
138 ($itemnumber) and @items = (grep {$_->{'itemnumber'} == $itemnumber} @items);
139 foreach my $item (@items){
140     $item->{itemlostloop}= GetAuthorisedValues(GetAuthValCode('items.itemlost',$fw),$item->{itemlost}) if GetAuthValCode('items.itemlost',$fw);
141     $item->{itemdamagedloop}= GetAuthorisedValues(GetAuthValCode('items.damaged',$fw),$item->{damaged}) if GetAuthValCode('items.damaged',$fw);
142     $item->{'collection'}              = $ccodes->{ $item->{ccode} } if ($ccodes);
143     $item->{'itype'}                   = $itemtypes->{ $item->{'itype'} }->{'description'};
144     $item->{'replacementprice'}        = sprintf( "%.2f", $item->{'replacementprice'} );
145     if ( defined $item->{'copynumber'} ) {
146         $item->{'displaycopy'} = 1;
147         if ( defined $copynumbers->{ $item->{'copynumber'} } ) {
148             $item->{'copyvol'} = $copynumbers->{ $item->{'copynumber'} }
149         }
150         else {
151             $item->{'copyvol'} = $item->{'copynumber'};
152         }
153     }
154
155     # item has a host number if its biblio number does not match the current bib
156     if ($item->{biblionumber} ne $biblionumber){
157         $item->{hostbiblionumber} = $item->{biblionumber};
158         $item->{hosttitle} = GetBiblioData($item->{biblionumber})->{title};
159     }
160
161     my $order  = GetOrderFromItemnumber( $item->{'itemnumber'} );
162     $item->{'ordernumber'}             = $order->{'ordernumber'};
163     $item->{'basketno'}                = $order->{'basketno'};
164     $item->{'orderdate'}               = $order->{'entrydate'};
165     if ($item->{'basketno'}){
166             my $basket = GetBasket($item->{'basketno'});
167         my $bookseller = Koha::Acquisition::Bookseller->fetch({ id => $basket->{booksellerid} });
168             $item->{'vendor'} = $bookseller->{'name'};
169     }
170     $item->{'invoiceid'}               = $order->{'invoiceid'};
171     if($item->{invoiceid}) {
172         my $invoice = GetInvoice($item->{invoiceid});
173         $item->{invoicenumber} = $invoice->{invoicenumber} if $invoice;
174     }
175     $item->{'datereceived'}            = $order->{'datereceived'};
176
177     if ($item->{notforloantext} or $item->{itemlost} or $item->{damaged} or $item->{withdrawn}) {
178         $item->{status_advisory} = 1;
179     }
180
181     if (C4::Context->preference("IndependentBranches")) {
182         #verifying rights
183         my $userenv = C4::Context->userenv();
184         unless (C4::Context->IsSuperLibrarian() or ($userenv->{'branch'} eq $item->{'homebranch'})) {
185                 $item->{'nomod'}=1;
186         }
187     }
188     $item->{'homebranchname'} = GetBranchName($item->{'homebranch'});
189     $item->{'holdingbranchname'} = GetBranchName($item->{'holdingbranch'});
190     if ($item->{'datedue'}) {
191         $item->{'issue'}= 1;
192     } else {
193         $item->{'issue'}= 0;
194     }
195
196     unless ($hidepatronname) {
197         if ( $item->{'borrowernumber'} ) {
198             my $curr_borrower = GetMember('borrowernumber' => $item->{'borrowernumber'} );
199             $item->{borrowerfirstname} = $curr_borrower->{'firstname'};
200             $item->{borrowersurname} = $curr_borrower->{'surname'};
201         }
202     }
203
204 }
205 $template->param(count => $data->{'count'},
206         subscriptionsnumber => $subscriptionsnumber,
207     subscriptiontitle   => $data->{title},
208         C4::Search::enabled_staff_search_views,
209 );
210
211 $template->param(
212     ITEM_DATA           => \@items,
213     moredetailview      => 1,
214     loggedinuser        => $loggedinuser,
215     biblionumber        => $biblionumber,
216     biblioitemnumber    => $bi,
217     itemnumber          => $itemnumber,
218     z3950_search_params => C4::Search::z3950_search_args(GetBiblioData($biblionumber)),
219     subtitle            => $subtitle,
220     hidepatronname      => $hidepatronname,
221 );
222 $template->param(ONLY_ONE => 1) if ( $itemnumber && $showncount != @items );
223 $template->{'VARS'}->{'searchid'} = $query->param('searchid');
224
225 my @allorders_using_biblio = GetOrdersByBiblionumber ($biblionumber);
226 my @deletedorders_using_biblio;
227 my @orders_using_biblio;
228 my @baskets_orders;
229 my @baskets_deletedorders;
230
231 foreach my $myorder (@allorders_using_biblio) {
232     my $basket = $myorder->{'basketno'};
233     if ((defined $myorder->{'datecancellationprinted'}) and  ($myorder->{'datecancellationprinted'} ne '0000-00-00') ){
234         push @deletedorders_using_biblio, $myorder;
235         unless (grep(/^$basket$/, @baskets_deletedorders)){
236             push @baskets_deletedorders,$myorder->{'basketno'};
237         }
238     }
239     else {
240         push @orders_using_biblio, $myorder;
241         unless (grep(/^$basket$/, @baskets_orders)){
242             push @baskets_orders,$myorder->{'basketno'};
243             }
244     }
245 }
246
247 my $count_orders_using_biblio = scalar @orders_using_biblio ;
248 $template->param (countorders => $count_orders_using_biblio);
249
250 my $count_deletedorders_using_biblio = scalar @deletedorders_using_biblio ;
251 $template->param (countdeletedorders => $count_deletedorders_using_biblio);
252
253 my $holds = GetReservesFromBiblionumber({ biblionumber => $biblionumber, all_dates => 1 });
254 my $holdcount = scalar( @$holds );
255 $template->param( holdcount => scalar ( @$holds ) );
256
257 output_html_with_http_headers $query, $cookie, $template->output;
258