Bug 17901: Fix possible SQL injection in shelf editing

[koha.git] / opac / opac-shelves.pl

diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl
index 4a25a79..237ad91 100755 (executable)
--- a/opac/opac-shelves.pl
+++ b/opac/opac-shelves.pl
@@ -18,6 +18,7 @@
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use Modern::Perl;
+
 use CGI qw ( -utf8 );
 use C4::Auth;
 use C4::Biblio;
@@ -27,7 +28,10 @@ use C4::Members;
 use C4::Output;
 use C4::Tags qw( get_tags );
 use C4::XSLT;
+
+use Koha::Biblioitems;
 use Koha::Virtualshelves;
+use Koha::RecordProcessor;
 
 my $query = new CGI;
 
@@ -101,9 +105,11 @@ if ( $op eq 'add_form' ) {
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
     if ( $shelf ) {
         $op = $referer;
+        my $sortfield = $query->param('sortfield');
+        $sortfield = 'title' unless grep {/^$sortfield$/}qw( title author copyrightdate itemcallnumber );
         if ( $shelf->can_be_managed( $loggedinuser ) ) {
             $shelf->shelfname( $query->param('shelfname') );
-            $shelf->sortfield( $query->param('sortfield') );
+            $shelf->sortfield( $sortfield );
             $shelf->allow_add( $query->param('allow_add') );
             $shelf->allow_delete_own( $query->param('allow_delete_own') );
             $shelf->allow_delete_other( $query->param('allow_delete_other') );
@@ -222,6 +228,7 @@ if ( $op eq 'view' ) {
         if ( $shelf->can_be_viewed( $loggedinuser ) ) {
             $category = $shelf->category;
             my $sortfield = $query->param('sortfield') || $shelf->sortfield;    # Passed in sorting overrides default sorting
+            $sortfield = 'title' unless grep {/^$sortfield$/}qw( title author copyrightdate itemcallnumber );
             my $direction = $query->param('direction') || 'asc';
             $direction = 'asc' if $direction ne 'asc' and $direction ne 'desc';
             my ( $page, $rows );
@@ -248,18 +255,32 @@ if ( $op eq 'view' ) {
 
             my $borrower = GetMember( borrowernumber => $loggedinuser );
 
+            # Lists display falls back to search results configuration
+            my $xslfile = C4::Context->preference('OPACXSLTListsDisplay');
+            my $lang   = $xslfile ? C4::Languages::getlanguage()  : undef;
+            my $sysxml = $xslfile ? C4::XSLT::get_xslt_sysprefs() : undef;
+
+            my $record_processor = Koha::RecordProcessor->new({ filters => 'ViewPolicy' });
             my @items;
             while ( my $content = $contents->next ) {
-                my $biblionumber = $content->biblionumber->biblionumber;
+                my $biblionumber = $content->biblionumber;
                 my $this_item    = GetBiblioData($biblionumber);
-                my $record       = GetMarcBiblio($biblionumber);
+                my $record = GetMarcBiblio($biblionumber);
+                my $framework = GetFrameworkCode( $biblionumber );
+                $record_processor->options({
+                    interface => 'opac',
+                    frameworkcode => $framework
+                });
+                $record_processor->process($record);
 
-                if ( C4::Context->preference("OPACXSLTResultsDisplay") ) {
-                    $this_item->{XSLTBloc} = XSLTParse4Display( $biblionumber, $record, "OPACXSLTResultsDisplay" );
+                if ( $xslfile ) {
+                    $this_item->{XSLTBloc} = XSLTParse4Display( $biblionumber, $record, "OPACXSLTListsDisplay",
+                                                                1, undef, $sysxml, $xslfile, $lang);
                 }
 
                 my $marcflavour = C4::Context->preference("marcflavour");
-                my $itemtypeinfo = getitemtypeinfo( $content->biblionumber->biblioitems->first->itemtype, 'opac' );
+                my $itemtype = Koha::Biblioitems->search({ biblionumber => $content->biblionumber })->next->itemtype;
+                my $itemtypeinfo = getitemtypeinfo( $itemtype, 'opac' );
                 $this_item->{imageurl}          = $itemtypeinfo->{imageurl};
                 $this_item->{description}       = $itemtypeinfo->{description};
                 $this_item->{notforloan}        = $itemtypeinfo->{notforloan};
@@ -308,7 +329,6 @@ if ( $op eq 'view' ) {
                 can_delete_shelf   => $shelf->can_be_deleted($loggedinuser),
                 can_remove_biblios => $shelf->can_biblios_be_removed($loggedinuser),
                 can_add_biblios    => $shelf->can_biblios_be_added($loggedinuser),
-                sortfield          => $sortfield,
                 itemsloop          => \@items,
                 sortfield          => $sortfield,
                 direction          => $direction,
@@ -324,6 +344,7 @@ if ( $op eq 'view' ) {
             }
         } else {
             push @messages, { type => 'error', code => 'unauthorized_on_view' };
+            undef $shelf;
         }
     } else {
         push @messages, { type => 'error', code => 'does_not_exist' };
@@ -355,7 +376,7 @@ $template->param(
     shelf    => $shelf,
     messages => \@messages,
     category => $category,
-    print    => $query->param('print') || 0,
+    print    => scalar $query->param('print') || 0,
     listsview => 1,
 );