modrequest.pl did not previously have auth checking, security bug!

[koha_ffzg] / C4 / Koha.pm

diff --git a/C4/Koha.pm b/C4/Koha.pm
index 22dae29..52146e5 100644 (file)
--- a/C4/Koha.pm
+++ b/C4/Koha.pm
@@ -53,8 +53,6 @@ $VERSION = 3.00;
   &GetPrinters &GetPrinter
   &GetItemTypes &getitemtypeinfo
   &GetCcodes
-  &GetAuthItemlost
-  &GetAuthItembinding
   &get_itemtypeinfos_of
   &getframeworks &getframeworkinfo
   &getauthtypes &getauthtype
@@ -70,6 +68,7 @@ $VERSION = 3.00;
   &GetAuthorisedValues
   &FixEncoding
   &GetKohaAuthorisedValues
+  &GetAuthValCode
   &GetManagedTagSubfields
 
   $DEBUG
@@ -265,6 +264,7 @@ sub get_itemtypeinfos_of {
     my $query = '
 SELECT itemtype,
        description,
+       imageurl,
        notforloan
   FROM itemtypes
   WHERE itemtype IN (' . join( ',', map( { "'" . $_ . "'" } @itemtypes ) ) . ')
@@ -294,36 +294,6 @@ sub GetCcodes {
     return ( $count, @results );
 }
 
-=head2
-
-grab itemlost authorized values
-
-=cut
-
-sub GetAuthItemlost {
-    my $itemlost = shift;
-    my $count    = 0;
-    my @results;
-    my $dbh = C4::Context->dbh;
-    my $sth =
-      $dbh->prepare(
-        "SELECT * FROM authorised_values ORDER BY authorised_value");
-    $sth->execute;
-    while ( my $data = $sth->fetchrow_hashref ) {
-        if ( $data->{category} eq "ITEMLOST" ) {
-            $count++;
-            if ( $itemlost eq $data->{'authorised_value'} ) {
-                $data->{'selected'} = 1;
-            }
-            $results[$count] = $data;
-
-            #warn "data: $data";
-        }
-    }
-    $sth->finish;
-    return ( $count, @results );
-}
-
 =head2 getauthtypes
 
   $authtypes = &getauthtypes();
@@ -613,7 +583,7 @@ sub getFacets {
             },
             {
                 link_value  => 'branch',
-                label_value => 'Branches',
+                label_value => 'Libraries',
                 tags        => [ '995', ],
                 subfield    => 'b',
                 expanded    => '1',
@@ -661,7 +631,7 @@ sub getFacets {
             },
             {
                 link_value  => 'branch',
-                label_value => 'Branches',
+                label_value => 'Libraries',
                 tags        => [ '952', ],
                 subfield    => 'b',
                 expanded    => '1',
@@ -736,6 +706,8 @@ labels.
 
 =cut
 
+# FIXME - why not use GetAuthorisedValues ??
+#
 sub get_notforloan_label_of {
     my $dbh = C4::Context->dbh;
 
@@ -817,6 +789,22 @@ sub displaySecondaryServers {
     return;    #$secondary_servers_loop;
 }
 
+=head2 GetAuthValCode
+
+$authvalcode = GetAuthValCode($kohafield,$frameworkcode);
+
+=cut
+
+sub GetAuthValCode {
+       my ($kohafield,$fwcode) = @_;
+       my $dbh = C4::Context->dbh;
+       $fwcode='' unless $fwcode;
+       my $sth = $dbh->prepare('select authorised_value from marc_subfield_structure where kohafield=? and frameworkcode=?');
+       $sth->execute($kohafield,$fwcode);
+       my ($authvalcode) = $sth->fetchrow_array;
+       return $authvalcode;
+}
+
 =head2 GetAuthorisedValues
 
 $authvalues = GetAuthorisedValues($category);
@@ -829,15 +817,24 @@ Set C<$category> on input args if you want to limits your query to this one. Thi
 =cut
 
 sub GetAuthorisedValues {
-    my $category = shift;
+    my ($category,$selected) = @_;
+       my $count = 0;
+       my @results;
     my $dbh      = C4::Context->dbh;
     my $query    = "SELECT * FROM authorised_values";
     $query .= " WHERE category = '" . $category . "'" if $category;
 
     my $sth = $dbh->prepare($query);
     $sth->execute;
-    my $data = $sth->fetchall_arrayref({});
-    return $data;
+       while (my $data=$sth->fetchrow_hashref) {
+               if ($selected eq $data->{'authorised_value'} ) {
+                       $data->{'selected'} = 1;
+               }
+               $results[$count] = $data;
+               $count++;
+       }
+    #my $data = $sth->fetchall_arrayref({});
+    return \@results; #$data;
 }
 
 =item fixEncoding
@@ -900,18 +897,17 @@ sub FixEncoding {
 =cut
 
 sub GetKohaAuthorisedValues {
-  my ($kohafield) = @_;
+  my ($kohafield,$fwcode) = @_;
+  $fwcode='' unless $fwcode;
   my %values;
   my $dbh = C4::Context->dbh;
-  my $sthnflstatus = $dbh->prepare('select authorised_value from marc_subfield_structure where kohafield=?');
-  $sthnflstatus->execute($kohafield);
-  my $authorised_valuecode = $sthnflstatus->fetchrow;
-  if ($authorised_valuecode) {  
-    $sthnflstatus = $dbh->prepare("select authorised_value, lib from authorised_values where category=? ");
-    $sthnflstatus->execute($authorised_valuecode);
-    while ( my ($val, $lib) = $sthnflstatus->fetchrow_array ) { 
-      $values{$val}= $lib;
-    }
+  my $avcode = GetAuthValCode($kohafield,$fwcode);
+  if ($avcode) {  
+    my $sth = $dbh->prepare("select authorised_value, lib from authorised_values where category=? ");
+    $sth->execute($avcode);
+       while ( my ($val, $lib) = $sth->fetchrow_array ) { 
+               $values{$val}= $lib;
+       }
   }
   return \%values;
 }