Bug 17903: Fix possible SQL injection in serial claims

[koha.git] / C4 / HoldsQueue.pm

diff --git a/C4/HoldsQueue.pm b/C4/HoldsQueue.pm
index 7cadfec..e5f29c7 100755 (executable)
--- a/C4/HoldsQueue.pm
+++ b/C4/HoldsQueue.pm
@@ -25,7 +25,6 @@ use warnings;
 use C4::Context;
 use C4::Search;
 use C4::Items;
-use C4::Branch;
 use C4::Circulation;
 use C4::Members;
 use C4::Biblio;
@@ -278,7 +277,7 @@ sub GetPendingHoldRequestsForBib {
     my $dbh = C4::Context->dbh;
 
     my $request_query = "SELECT biblionumber, borrowernumber, itemnumber, priority, reserves.branchcode,
-                                reservedate, reservenotes, borrowers.branchcode AS borrowerbranch
+                                reservedate, reservenotes, borrowers.branchcode AS borrowerbranch, itemtype
                          FROM reserves
                          JOIN borrowers USING (borrowernumber)
                          WHERE biblionumber = ?
@@ -368,6 +367,7 @@ sub GetItemsAvailableToFillHoldRequestsForBib {
 sub MapItemsToHoldRequests {
     my ($hold_requests, $available_items, $branches_to_use, $transport_cost_matrix) = @_;
 
+
     # handle trival cases
     return unless scalar(@$hold_requests) > 0;
     return unless scalar(@$available_items) > 0;
@@ -388,6 +388,60 @@ sub MapItemsToHoldRequests {
 
     # figure out which item-level requests can be filled
     my $num_items_remaining = scalar(@$available_items);
+
+    # Look for Local Holds Priority matches first
+    if ( C4::Context->preference('LocalHoldsPriority') ) {
+        my $LocalHoldsPriorityPatronControl =
+          C4::Context->preference('LocalHoldsPriorityPatronControl');
+        my $LocalHoldsPriorityItemControl =
+          C4::Context->preference('LocalHoldsPriorityItemControl');
+
+        foreach my $request (@$hold_requests) {
+            last if $num_items_remaining == 0;
+
+            my $local_hold_match;
+            foreach my $item (@$available_items) {
+                next
+                  if ( !$item->{holdallowed} )
+                  || ( $item->{holdallowed} == 1
+                    && $item->{homebranch} ne $request->{borrowerbranch} );
+
+                my $local_holds_priority_item_branchcode =
+                  $item->{$LocalHoldsPriorityItemControl};
+
+                my $local_holds_priority_patron_branchcode =
+                  ( $LocalHoldsPriorityPatronControl eq 'PickupLibrary' )
+                  ? $request->{branchcode}
+                  : ( $LocalHoldsPriorityPatronControl eq 'HomeLibrary' )
+                  ? $request->{borrowerbranch}
+                  : undef;
+
+                $local_hold_match =
+                  $local_holds_priority_item_branchcode eq
+                  $local_holds_priority_patron_branchcode;
+
+                if ($local_hold_match) {
+                    if ( exists $items_by_itemnumber{ $item->{itemnumber} }
+                        and not exists $allocated_items{ $item->{itemnumber} } )
+                    {
+                        $item_map{ $item->{itemnumber} } = {
+                            borrowernumber => $request->{borrowernumber},
+                            biblionumber   => $request->{biblionumber},
+                            holdingbranch  => $item->{holdingbranch},
+                            pickup_branch  => $request->{branchcode}
+                              || $request->{borrowerbranch},
+                            item_level   => 0,
+                            reservedate  => $request->{reservedate},
+                            reservenotes => $request->{reservenotes},
+                        };
+                        $allocated_items{ $item->{itemnumber} }++;
+                        $num_items_remaining--;
+                    }
+                }
+            }
+        }
+    }
+
     foreach my $request (@$hold_requests) {
         last if $num_items_remaining == 0;
 
@@ -400,6 +454,8 @@ sub MapItemsToHoldRequests {
                 and ( # Don't fill item level holds that contravene the hold pickup policy at this time
                     ( $items_by_itemnumber{ $request->{itemnumber} }->{hold_fulfillment_policy} eq 'any' )
                     || ( $request->{branchcode} eq $items_by_itemnumber{ $request->{itemnumber} }->{ $items_by_itemnumber{ $request->{itemnumber} }->{hold_fulfillment_policy} }  )
+                and ( !$request->{itemtype} # If hold itemtype is set, item's itemtype must match
+                    || $items_by_itemnumber{ $request->{itemnumber} }->{itype} eq $request->{itemtype} )
                 )
 
               )
@@ -451,6 +507,8 @@ sub MapItemsToHoldRequests {
                     $request->{borrowerbranch} eq $item->{homebranch}
                     && ( ( $item->{hold_fulfillment_policy} eq 'any' ) # Don't fill item level holds that contravene the hold pickup policy at this time
                         || $request->{branchcode} eq $item->{ $item->{hold_fulfillment_policy} } )
+                    && ( !$request->{itemtype} # If hold itemtype is set, item's itemtype must match
+                        || $items_by_itemnumber{ $request->{itemnumber} }->{itype} eq $request->{itemtype} )
                   )
                 {
                     $itemnumber = $item->{itemnumber};
@@ -472,6 +530,10 @@ sub MapItemsToHoldRequests {
                     next unless $item->{hold_fulfillment_policy} eq 'any'
                         || $request->{branchcode} eq $item->{ $item->{hold_fulfillment_policy} };
 
+                    # If hold itemtype is set, item's itemtype must match
+                    next unless ( !$request->{itemtype}
+                        || $item->{itype} eq $request->{itemtype} );
+
                     $itemnumber = $item->{itemnumber};
                     last;
                 }
@@ -504,6 +566,10 @@ sub MapItemsToHoldRequests {
                     next unless $item->{hold_fulfillment_policy} eq 'any'
                         || $request->{branchcode} eq $item->{ $item->{hold_fulfillment_policy} };
 
+                    # If hold itemtype is set, item's itemtype must match
+                    next unless ( !$request->{itemtype}
+                        || $item->{itype} eq $request->{itemtype} );
+
                     $itemnumber = $item->{itemnumber};
                     $holdingbranch = $branch;
                     last PULL_BRANCHES;
@@ -519,6 +585,10 @@ sub MapItemsToHoldRequests {
                         next unless $current_item->{hold_fulfillment_policy} eq 'any'
                             || $request->{branchcode} eq $current_item->{ $current_item->{hold_fulfillment_policy} };
 
+                        # If hold itemtype is set, item's itemtype must match
+                        next unless ( !$request->{itemtype}
+                            || $current_item->{itype} eq $request->{itemtype} );
+
                         $itemnumber = $current_item->{itemnumber};
                         last; # quit this loop as soon as we have a suitable item
                     }
@@ -539,6 +609,10 @@ sub MapItemsToHoldRequests {
                         next unless $item->{hold_fulfillment_policy} eq 'any'
                             || $request->{branchcode} eq $item->{ $item->{hold_fulfillment_policy} };
 
+                        # If hold itemtype is set, item's itemtype must match
+                        next unless ( !$request->{itemtype}
+                            || $item->{itype} eq $request->{itemtype} );
+
                         $itemnumber = $item->{itemnumber};
                         $holdingbranch = $branch;
                         last PULL_BRANCHES2;