Bug 19112 - Stored XSS in basketheader.pl page

[koha.git] / members / update-child.pl

diff --git a/members/update-child.pl b/members/update-child.pl
index 4788a07..c14db87 100755 (executable)
--- a/members/update-child.pl
+++ b/members/update-child.pl
@@ -4,18 +4,18 @@
 #
 # This file is part of Koha.
 #
-# Koha is free software; you can redistribute it and/or modify it under the
-# terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 2 of the License, or (at your option) any later
-# version.
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
 #
-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 =head1 updatechild.pl
 
@@ -27,11 +27,14 @@
 =cut
 
 use strict;
-use CGI;
+#use warnings; FIXME - Bug 2505
+use CGI qw ( -utf8 );
 use C4::Context;
 use C4::Auth;
 use C4::Output;
 use C4::Members;
+use Koha::Patrons;
+use Koha::Patron::Categories;
 
 # use Smart::Comments;
 
@@ -40,7 +43,7 @@ my $input = new CGI;
 
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
-        template_name   => "members/update-child.tmpl",
+        template_name   => "members/update-child.tt",
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
@@ -56,32 +59,31 @@ my $catcode_multi = $input->param('catcode_multi');
 my $op             = $input->param('op');
 
 if ( $op eq 'multi' ) {
-    my ( $catcodes, $labels ) =
-      GetborCatFromCatType( 'C', 'WHERE category_type <> ?' );
-    my @rows;
-    foreach my $k ( keys %$labels ) {
-        my $row;
-        $row->{catcode} = $k;
-        $row->{catdesc} = $labels->{$k};
-        my $borcat = GetBorrowercategory( $row->{catcode} );
-        $row->{cattype} = $borcat->{'category_type'};
-        push @rows, $row;
-    }
+    # FIXME - what are the possible upgrade paths?  C -> A , C -> S ...
+    #   currently just allowing C -> A
+    my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
     $template->param(
-        MULTI          => 1,
-        borrowernumber => $borrowernumber,
-        CAT_LOOP       => \@rows,
+        MULTI             => 1,
+        CATCODE_MULTI     => 1,
+        borrowernumber    => $borrowernumber,
+        patron_categories => $patron_categories,
     );
     output_html_with_http_headers $input, $cookie, $template->output;
 }
 
 elsif ( $op eq 'update' ) {
-    my $member = GetMember($borrowernumber);
-    $member->{'guarantorid'}  = '0';
+    my $patron = Koha::Patrons->find( $borrowernumber );
+    unless ( $patron ) {
+        print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
+        exit;
+    }
+    my $member = $patron->unblessed;
+    $member->{'guarantorid'}  = 0;
     $member->{'categorycode'} = $catcode;
-    my $borcat = GetBorrowercategory($catcode);
-    $member->{'category_type'} = $borcat->{'category_type'};
-    $member->{'description'}   = $borcat->{'description'};
+    my $borcat = Koha::Patron::Categories->find($catcode);
+    $member->{'category_type'} = $borcat->category_type;
+    $member->{'description'}   = $borcat->description;
+    delete $member->{password};
     ModMember(%$member);
 
     if (  $catcode_multi ) {