modrequest.pl did not previously have auth checking, security bug!

[koha_ffzg] / C4 / Koha.pm

diff --git a/C4/Koha.pm b/C4/Koha.pm
index fd3366a..52146e5 100644 (file)
--- a/C4/Koha.pm
+++ b/C4/Koha.pm
@@ -17,7 +17,6 @@ package C4::Koha;
 # Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
 # Suite 330, Boston, MA  02111-1307 USA
 
-# $Id$
 
 use strict;
 require Exporter;
@@ -25,7 +24,7 @@ use C4::Context;
 use C4::Output;
 our ($VERSION,@ISA,@EXPORT);
 
-$VERSION = do { my @v = '$Revision$' =~ /\d+/g; shift(@v) . "." . join( "_", map { sprintf "%03d", $_ } @v ); };
+$VERSION = 3.00;
 
 =head1 NAME
 
@@ -54,8 +53,6 @@ $VERSION = do { my @v = '$Revision$' =~ /\d+/g; shift(@v) . "." . join( "_", map
   &GetPrinters &GetPrinter
   &GetItemTypes &getitemtypeinfo
   &GetCcodes
-  &GetAuthItemlost
-  &GetAuthItembinding
   &get_itemtypeinfos_of
   &getframeworks &getframeworkinfo
   &getauthtypes &getauthtype
@@ -71,6 +68,7 @@ $VERSION = do { my @v = '$Revision$' =~ /\d+/g; shift(@v) . "." . join( "_", map
   &GetAuthorisedValues
   &FixEncoding
   &GetKohaAuthorisedValues
+  &GetAuthValCode
   &GetManagedTagSubfields
 
   $DEBUG
@@ -104,6 +102,7 @@ sub slashifyDate {
 
 sub DisplayISBN {
     my ($isbn) = @_;
+    if (length ($isbn)<13){
     my $seg1;
     if ( substr( $isbn, 0, 1 ) <= 7 ) {
         $seg1 = substr( $isbn, 0, 1 );
@@ -146,6 +145,52 @@ sub DisplayISBN {
     $seg3 = substr( $seg3, 0, length($seg3) - 1 );
     my $seg4 = substr( $x, -1, 1 );
     return "$seg1-$seg2-$seg3-$seg4";
+    } else {
+      my $seg1;
+      $seg1 = substr( $isbn, 0, 3 );
+      my $seg2;
+      if ( substr( $isbn, 3, 1 ) <= 7 ) {
+          $seg2 = substr( $isbn, 3, 1 );
+      }
+      elsif ( substr( $isbn, 3, 2 ) <= 94 ) {
+          $seg2 = substr( $isbn, 3, 2 );
+      }
+      elsif ( substr( $isbn, 3, 3 ) <= 995 ) {
+          $seg2 = substr( $isbn, 3, 3 );
+      }
+      elsif ( substr( $isbn, 3, 4 ) <= 9989 ) {
+          $seg2 = substr( $isbn, 3, 4 );
+      }
+      else {
+          $seg2 = substr( $isbn, 3, 5 );
+      }
+      my $x = substr( $isbn, length($seg2) +3);
+      my $seg3;
+      if ( substr( $x, 0, 2 ) <= 19 ) {
+  
+          # if(sTmp2 < 10) sTmp2 = "0" sTmp2;
+          $seg3 = substr( $x, 0, 2 );
+      }
+      elsif ( substr( $x, 0, 3 ) <= 699 ) {
+          $seg3 = substr( $x, 0, 3 );
+      }
+      elsif ( substr( $x, 0, 4 ) <= 8399 ) {
+          $seg3 = substr( $x, 0, 4 );
+      }
+      elsif ( substr( $x, 0, 5 ) <= 89999 ) {
+          $seg3 = substr( $x, 0, 5 );
+      }
+      elsif ( substr( $x, 0, 6 ) <= 9499999 ) {
+          $seg3 = substr( $x, 0, 6 );
+      }
+      else {
+          $seg3 = substr( $x, 0, 7 );
+      }
+      my $seg4 = substr( $x, length($seg3) );
+      $seg4 = substr( $seg4, 0, length($seg4) - 1 );
+      my $seg5 = substr( $x, -1, 1 );
+      return "$seg1-$seg2-$seg3-$seg4-$seg5";       
+    }    
 }
 
 # FIXME.. this should be moved to a MARC-specific module
@@ -219,6 +264,7 @@ sub get_itemtypeinfos_of {
     my $query = '
 SELECT itemtype,
        description,
+       imageurl,
        notforloan
   FROM itemtypes
   WHERE itemtype IN (' . join( ',', map( { "'" . $_ . "'" } @itemtypes ) ) . ')
@@ -248,36 +294,6 @@ sub GetCcodes {
     return ( $count, @results );
 }
 
-=head2
-
-grab itemlost authorized values
-
-=cut
-
-sub GetAuthItemlost {
-    my $itemlost = shift;
-    my $count    = 0;
-    my @results;
-    my $dbh = C4::Context->dbh;
-    my $sth =
-      $dbh->prepare(
-        "SELECT * FROM authorised_values ORDER BY authorised_value");
-    $sth->execute;
-    while ( my $data = $sth->fetchrow_hashref ) {
-        if ( $data->{category} eq "ITEMLOST" ) {
-            $count++;
-            if ( $itemlost eq $data->{'authorised_value'} ) {
-                $data->{'selected'} = 1;
-            }
-            $results[$count] = $data;
-
-            #warn "data: $data";
-        }
-    }
-    $sth->finish;
-    return ( $count, @results );
-}
-
 =head2 getauthtypes
 
   $authtypes = &getauthtypes();
@@ -567,7 +583,7 @@ sub getFacets {
             },
             {
                 link_value  => 'branch',
-                label_value => 'Branches',
+                label_value => 'Libraries',
                 tags        => [ '995', ],
                 subfield    => 'b',
                 expanded    => '1',
@@ -615,7 +631,7 @@ sub getFacets {
             },
             {
                 link_value  => 'branch',
-                label_value => 'Branches',
+                label_value => 'Libraries',
                 tags        => [ '952', ],
                 subfield    => 'b',
                 expanded    => '1',
@@ -690,6 +706,8 @@ labels.
 
 =cut
 
+# FIXME - why not use GetAuthorisedValues ??
+#
 sub get_notforloan_label_of {
     my $dbh = C4::Context->dbh;
 
@@ -771,6 +789,22 @@ sub displaySecondaryServers {
     return;    #$secondary_servers_loop;
 }
 
+=head2 GetAuthValCode
+
+$authvalcode = GetAuthValCode($kohafield,$frameworkcode);
+
+=cut
+
+sub GetAuthValCode {
+       my ($kohafield,$fwcode) = @_;
+       my $dbh = C4::Context->dbh;
+       $fwcode='' unless $fwcode;
+       my $sth = $dbh->prepare('select authorised_value from marc_subfield_structure where kohafield=? and frameworkcode=?');
+       $sth->execute($kohafield,$fwcode);
+       my ($authvalcode) = $sth->fetchrow_array;
+       return $authvalcode;
+}
+
 =head2 GetAuthorisedValues
 
 $authvalues = GetAuthorisedValues($category);
@@ -783,15 +817,24 @@ Set C<$category> on input args if you want to limits your query to this one. Thi
 =cut
 
 sub GetAuthorisedValues {
-    my $category = shift;
+    my ($category,$selected) = @_;
+       my $count = 0;
+       my @results;
     my $dbh      = C4::Context->dbh;
     my $query    = "SELECT * FROM authorised_values";
     $query .= " WHERE category = '" . $category . "'" if $category;
 
     my $sth = $dbh->prepare($query);
     $sth->execute;
-    my $data = $sth->fetchall_arrayref({});
-    return $data;
+       while (my $data=$sth->fetchrow_hashref) {
+               if ($selected eq $data->{'authorised_value'} ) {
+                       $data->{'selected'} = 1;
+               }
+               $results[$count] = $data;
+               $count++;
+       }
+    #my $data = $sth->fetchall_arrayref({});
+    return \@results; #$data;
 }
 
 =item fixEncoding
@@ -854,18 +897,17 @@ sub FixEncoding {
 =cut
 
 sub GetKohaAuthorisedValues {
-  my ($kohafield) = @_;
+  my ($kohafield,$fwcode) = @_;
+  $fwcode='' unless $fwcode;
   my %values;
   my $dbh = C4::Context->dbh;
-  my $sthnflstatus = $dbh->prepare('select authorised_value from marc_subfield_structure where kohafield=?');
-  $sthnflstatus->execute($kohafield);
-  my $authorised_valuecode = $sthnflstatus->fetchrow;
-  if ($authorised_valuecode) {  
-    $sthnflstatus = $dbh->prepare("select authorised_value, lib from authorised_values where category=? ");
-    $sthnflstatus->execute($authorised_valuecode);
-    while ( my ($val, $lib) = $sthnflstatus->fetchrow_array ) { 
-      $values{$val}= $lib;
-    }
+  my $avcode = GetAuthValCode($kohafield,$fwcode);
+  if ($avcode) {  
+    my $sth = $dbh->prepare("select authorised_value, lib from authorised_values where category=? ");
+    $sth->execute($avcode);
+       while ( my ($val, $lib) = $sth->fetchrow_array ) { 
+               $values{$val}= $lib;
+       }
   }
   return \%values;
 }