Bug 17029: Fix XSS in catalogue/*detail.pl

[koha.git] / catalogue / labeledMARCdetail.pl

diff --git a/catalogue/labeledMARCdetail.pl b/catalogue/labeledMARCdetail.pl
index 9d2a14e..7c488e0 100755 (executable)
--- a/catalogue/labeledMARCdetail.pl
+++ b/catalogue/labeledMARCdetail.pl
@@ -4,22 +4,23 @@
 #
 # This file is part of Koha.
 #
-# Koha is free software; you can redistribute it and/or modify it under the
-# terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 2 of the License, or (at your option) any later
-# version.
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
 #
-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along
-# with Koha; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use strict;
 use warnings;
-use CGI; 
+use CGI qw ( -utf8 ); 
+use HTML::Entities;
 use MARC::Record;
 use C4::Auth;
 use C4::Context;
@@ -28,10 +29,13 @@ use C4::Biblio;
 use C4::Items;
 use C4::Members; # to use GetMember
 use C4::Search;                # enabled_staff_search_views
+use C4::Acquisition qw(GetOrdersByBiblionumber);
+use C4::Koha qw( GetFrameworksLoop );
 
 my $query        = new CGI;
 my $dbh          = C4::Context->dbh;
 my $biblionumber = $query->param('biblionumber');
+$biblionumber = HTML::Entities::encode($biblionumber);
 my $frameworkcode = $query->param('frameworkcode');
 $frameworkcode = GetFrameworkCode( $biblionumber ) unless ($frameworkcode);
 my $popup        =
@@ -41,7 +45,7 @@ my $popup        =
 # open template
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
-        template_name   => "catalogue/labeledMARCdetail.tmpl",
+        template_name   => "catalogue/labeledMARCdetail.tt",
         query           => $query,
         type            => "intranet",
         authnotrequired => 0,
@@ -78,30 +82,8 @@ my $itemcount = GetItemsCount($biblionumber);
 $template->param( count => $itemcount,
                                        bibliotitle => $biblio->{title}, );
 
-#Getting the list of all frameworks
-my $queryfwk =
-  $dbh->prepare("select frameworktext, frameworkcode from biblio_framework");
-$queryfwk->execute;
-my %select_fwk;
-my @select_fwk;
-my $curfwk;
-push @select_fwk, "Default";
-$select_fwk{"Default"} = "Default";
-
-while ( my ( $description, $fwk ) = $queryfwk->fetchrow ) {
-    push @select_fwk, $fwk;
-    $select_fwk{$fwk} = $description;
-}
-$curfwk=$frameworkcode;
-my $framework=CGI::scrolling_list( -name     => 'Frameworks',
-            -id => 'Frameworks',
-            -default => $curfwk,
-            -OnChange => 'Changefwk(this);',
-            -values   => \@select_fwk,
-            -labels   => \%select_fwk,
-            -size     => 1,
-            -multiple => 0 );
-$template->param(framework => $framework);
+#Getting framework loop
+$template->param(frameworkloop => GetFrameworksLoop( $frameworkcode ) );
 
 my @marc_data;
 my $prevlabel = '';
@@ -134,9 +116,39 @@ $template->param (
        labeledmarcview => 1,
        z3950_search_params             => C4::Search::z3950_search_args($biblio),
        C4::Search::enabled_staff_search_views,
+    searchid            => scalar $query->param('searchid'),
 );
 
-my ( $holdcount, $holds ) = C4::Reserves::GetReservesFromBiblionumber($biblionumber,1);
-$template->param( holdcount => $holdcount, holds => $holds );
+my @allorders_using_biblio = GetOrdersByBiblionumber ($biblionumber);
+my @deletedorders_using_biblio;
+my @orders_using_biblio;
+my @baskets_orders;
+my @baskets_deletedorders;
+
+foreach my $myorder (@allorders_using_biblio) {
+    my $basket = $myorder->{'basketno'};
+    if ((defined $myorder->{'datecancellationprinted'}) and  ($myorder->{'datecancellationprinted'} ne '0000-00-00') ){
+        push @deletedorders_using_biblio, $myorder;
+        unless (grep(/^$basket$/, @baskets_deletedorders)){
+            push @baskets_deletedorders,$myorder->{'basketno'};
+        }
+    }
+    else {
+        push @orders_using_biblio, $myorder;
+        unless (grep(/^$basket$/, @baskets_orders)){
+            push @baskets_orders,$myorder->{'basketno'};
+            }
+    }
+}
+
+my $count_orders_using_biblio = scalar @orders_using_biblio ;
+$template->param (countorders => $count_orders_using_biblio);
+
+my $count_deletedorders_using_biblio = scalar @deletedorders_using_biblio ;
+$template->param (countdeletedorders => $count_deletedorders_using_biblio);
+
+my $holds= C4::Reserves::GetReservesFromBiblionumber({ biblionumber => $biblionumber, all_dates => 1 });
+my $holdcount = scalar( @$holds );
+$template->param( holdcount => scalar ( @$holds ) );
 
 output_html_with_http_headers $query, $cookie, $template->output;