Bug 25898: Prohibit indirect object notation

[srvgit] / labels / label-item-search.pl

diff --git a/labels/label-item-search.pl b/labels/label-item-search.pl
index d93c922..3eed697 100755 (executable)
--- a/labels/label-item-search.pl
+++ b/labels/label-item-search.pl
@@ -17,8 +17,7 @@
 # You should have received a copy of the GNU General Public License
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
-use strict;
-use warnings;
+use Modern::Perl;
 use vars qw($debug $cgi_debug);
 
 use CGI qw ( -utf8 );
@@ -46,7 +45,7 @@ BEGIN {
     }
 }
 
-my $query = new CGI;
+my $query = CGI->new;
 
 my $type      = $query->param('type');
 my $op        = $query->param('op') || '';
@@ -68,8 +67,6 @@ my $display_columns = [ {_add                   => {label => "Add Item", link_fi
                       ];
 
 if ( $op eq "do_search" ) {
-    my $QParser;
-    $QParser = C4::Context->queryparser if (C4::Context->preference('UseQueryParser'));
     $idx         = $query->param('idx');
     $ccl_textbox = $query->param('ccl_textbox');
     if ( $ccl_textbox && $idx ) {
@@ -83,14 +80,8 @@ if ( $op eq "do_search" ) {
         $datefrom = eval { dt_from_string ( $datefrom ) };
         if ($datefrom) {
             $datefrom = output_pref( { dt => $datefrom, dateonly => 1, dateformat => 'iso' } );
-            if ($QParser) {
-                $ccl_query .= ' && ' if $ccl_textbox;
-                $ccl_query .=
-                    "acqdate(" . $datefrom . '-)';
-            } else {
-                $ccl_query .= ' and ' if $ccl_textbox;
-                $ccl_query .= "acqdate,st-date-normalized,ge=" . $datefrom;
-            }
+            $ccl_query .= ' and ' if $ccl_textbox;
+            $ccl_query .= "acqdate,ge,st-date-normalized=" . $datefrom;
         }
     }
 
@@ -98,13 +89,8 @@ if ( $op eq "do_search" ) {
         $dateto = eval { dt_from_string ( $dateto ) };
         if ($dateto) {
            $dateto = output_pref( { dt => $dateto, dateonly => 1, dateformat => 'iso' } );
-            if ($QParser) {
-                $ccl_query .= ' && ' if ( $ccl_textbox || $datefrom );
-                $ccl_query .= "acqdate(-" . $dateto . ')';
-            } else {
-                $ccl_query .= ' and ' if ( $ccl_textbox || $datefrom );
-                $ccl_query .= "acqdate,st-date-normalized,le=" . $dateto;
-            }
+            $ccl_query .= ' and ' if ( $ccl_textbox || $datefrom );
+            $ccl_query .= "acqdate,le,st-date-normalized=" . $dateto;
         }
     }
 
@@ -160,8 +146,7 @@ if ($show_results) {
             template_name   => "labels/result.tt",
             query           => $query,
             type            => "intranet",
-            authnotrequired => 0,
-            flagsrequired   => { borrowers => 1 },
+            flagsrequired   => { borrowers => 'edit_borrowers' },
             flagsrequired   => { catalogue => 1 },
             debug           => 1,
         }
@@ -240,7 +225,6 @@ else {
             template_name   => "labels/search.tt",
             query           => $query,
             type            => "intranet",
-            authnotrequired => 0,
             flagsrequired   => { catalogue => 1 },
             debug           => 1,
         }