Bug 19112 - Stored XSS in basketheader.pl page

[koha.git] / members / summary-print.pl

diff --git a/members/summary-print.pl b/members/summary-print.pl
index 82b1ca2..a6a0e36 100755 (executable)
--- a/members/summary-print.pl
+++ b/members/summary-print.pl
@@ -22,11 +22,12 @@ use CGI;
 use C4::Auth;
 use C4::Output;
 use C4::Members;
-use C4::Koha qw( getitemtypeinfo );
 use C4::Circulation qw( GetIssuingCharges );
 use C4::Reserves;
 use C4::Items;
 use Koha::Holds;
+use Koha::ItemTypes;
+use Koha::Patrons;
 
 my $input          = CGI->new;
 my $borrowernumber = $input->param('borrowernumber');
@@ -42,7 +43,15 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
-my $data = GetMember( 'borrowernumber' => $borrowernumber );
+my $patron = Koha::Patrons->find( $borrowernumber );
+unless ( $patron ) {
+    print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
+    exit;
+}
+my $category = $patron->category;
+my $data = $patron->unblessed;
+$data->{description} = $category->description;
+$data->{category_type} = $category->category_type;
 
 my ( $total, $accts, $numaccts ) = GetMemberAccountRecords($borrowernumber);
 foreach my $accountline (@$accts) {
@@ -67,7 +76,7 @@ $template->param(
     accounts => $accts,
     totaldue => $total,
 
-    issues     => build_issue_data( GetPendingIssues($borrowernumber) ),
+    issues     => build_issue_data( $borrowernumber ),
     totalprice => $totalprice,
 
     reserves => build_reserve_data( $holds_rs ),
@@ -76,7 +85,8 @@ $template->param(
 output_html_with_http_headers $input, $cookie, $template->output;
 
 sub build_issue_data {
-    my $issues = shift;
+    my ( $borrowernumber ) = @_;
+    my $issues = GetPendingIssues( $borrowernumber );
 
     my $return = [];
 
@@ -93,8 +103,8 @@ sub build_issue_data {
         my ( $charge, $itemtype ) =
           GetIssuingCharges( $issue->{itemnumber}, $borrowernumber );
 
-        my $itemtypeinfo = getitemtypeinfo($itemtype);
-        $row{'itemtype_description'} = $itemtypeinfo->{description};
+        $itemtype = Koha::ItemTypes->find( $itemtype );
+        $row{'itemtype_description'} = $itemtype->description; #FIXME Should not it be translated_description
 
         $row{'charge'} = sprintf( "%.2f", $charge );