bug 9401: remove direct reads of CGISESSID cookie by JavaScript

[koha.git] / tags / review.pl

diff --git a/tags/review.pl b/tags/review.pl
index c687034..3b7a0a0 100755 (executable)
--- a/tags/review.pl
+++ b/tags/review.pl
@@ -15,9 +15,9 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 use warnings;
 use strict;
@@ -30,25 +30,25 @@ use C4::Auth qw(:DEFAULT check_cookie_auth);
 use C4::Context;
 use C4::Dates qw(format_date format_date_in_iso);
 # use C4::Koha;
-use C4::Output 3.02 qw(:html :ajax pagination_bar);
+use C4::Output qw(:html :ajax pagination_bar);
 use C4::Debug;
-use C4::Tags 0.03 qw(get_tags get_approval_rows approval_counts whitelist blacklist is_approved);
+use C4::Tags qw(get_tags get_approval_rows approval_counts whitelist blacklist is_approved);
 
 my $script_name = "/cgi-bin/koha/tags/review.pl";
-my $needed_flags = { tools => 'moderate_comments' };   # FIXME: replace when more specific permission is created.
+my $needed_flags = { tools => 'moderate_tags' };       # FIXME: replace when more specific permission is created.
 
 sub ajax_auth_cgi ($) {                # returns CGI object
        my $needed_flags = shift;
        my %cookies = fetch CGI::Cookie;
        my $input = CGI->new;
-       my $sessid = $cookies{'CGISESSID'}->value || $input->param('CGISESSID');
+    my $sessid = $cookies{'CGISESSID'}->value;
        my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags);
        $debug and
        print STDERR "($auth_status, $auth_sessid) = check_cookie_auth($sessid," . Dumper($needed_flags) . ")\n";
        if ($auth_status ne "ok") {
-               output_ajax_with_http_headers $input,
+               output_with_http_headers $input, undef,
                        "window.alert('Your CGI session cookie ($sessid) is not current.  " . 
-                       "Please refresh the page and try again.');\n";
+                       "Please refresh the page and try again.');\n", 'js';
                exit 0;
        }
        $debug and print STDERR "AJAX request: " . Dumper($input),
@@ -72,7 +72,7 @@ if (is_ajax()) {
        if ($tag = $input->param('rej')) {
                $js_reply = (   blacklist($operator,$tag) ? 'success' : 'failure')  . "_reject('$tag');\n";
        }
-       output_ajax_with_http_headers $input, $js_reply;
+       output_with_http_headers $input, undef, $js_reply, 'js';
        exit;
 }
 
@@ -89,19 +89,19 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user({
 });
 
 my ($op, @errors, @tags);
-$op   = $input->param('op') || 'none';
+$op   = lc($input->param('op')) || 'none';
 @tags = $input->param('tags');
 
 $borrowernumber == 0 and push @errors, {op_zero=>1};
-     if (lc($op) eq 'approve') {
+     if ($op eq 'approve') {
        foreach (@tags) {
                whitelist($borrowernumber,$_) or push @errors, {failed_ok=>$_};
        }
-} elsif (lc($op) eq 'reject' ) {
+} elsif ($op eq 'reject' ) {
        foreach (@tags) {
                blacklist($borrowernumber,$_) or push @errors, {failed_rej=>$_};
        }
-} elsif (lc($op) eq 'test'   ) {
+} elsif ($op eq 'test'   ) {
        my $tag = $input->param('test');
        push @tags, $tag;
        my $check = is_approved($tag);
@@ -178,11 +178,12 @@ if ($filter = $input->param('to')) {
        }
 }
 if ($filter = $input->param('approver')) {             # name (or borrowernumber) from input box
-       if (($filter =~ /^\d+$/ and $filter > 0) or
-               (1) ){  # $filter=get borrowernumber from name
+       if ($filter =~ /^\d+$/ and $filter > 0) {
+               # $filter=get borrowernumber from name
+               # FIXME: get borrowernumber from name not implemented.
                $template->param(filter_approver=>$filter);
                $filters{approved_by} = $filter;
-       # } else {
+       } else {
                push @errors, {approver=>$filter};
        }
 }
@@ -196,6 +197,9 @@ if ($filter = $input->param('approved_by')) {       # borrowernumber from link
 }
 $debug and print STDERR "filters: " . Dumper(\%filters);
 my $tagloop = get_approval_rows(\%filters);
+for ( @{$tagloop} ) {
+    $_->{date_approved} = format_date( $_->{date_approved} );
+}
 my $qstring = $input->query_string;
 $qstring =~ s/([&;])*\blimit=\d+//;            # remove pagination var
 $qstring =~ s/^;+//;                                   # remove leading delims
@@ -203,9 +207,8 @@ $qstring = "limit=$pagesize" . ($qstring ? '&' . $qstring : '');
 $debug and print STDERR "number of approval_rows: " . scalar(@$tagloop) . "rows\n";
 (scalar @errors) and $template->param(message_loop=>\@errors);
 $template->param(
-       DHTMLcalendar_dateformat => C4::Dates->DHTMLcalendar(),
        offset => $offset,      # req'd for EXPR
-       op => lc($op),
+       op => $op,
        op_count => scalar(@tags),
        script_name => $script_name,
        approved => 0,          # dummy value (also EXPR)