Bug 6632 [Signed Off] add html filter to prevent XSS
[koha_fer] / reserve / request.pl
index 60f7ea4..79ff6b5 100755 (executable)
@@ -15,9 +15,9 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 =head1 request.pl
 
@@ -51,12 +51,13 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { reserveforothers => 1 },
+        flagsrequired   => { reserveforothers => 'place_holds' },
     }
 );
 
 my $multihold = $input->param('multi_hold');
 $template->param(multi_hold => $multihold);
+my $showallitems = $input->param('showallitems');
 
 # get Branches and Itemtypes
 my $branches = GetBranches();
@@ -82,14 +83,33 @@ my $CGIbranch = CGI::scrolling_list(
 
 # Select borrowers infos
 my $findborrower = $input->param('findborrower');
+$findborrower = '' unless defined $findborrower;
 $findborrower =~ s|,| |g;
-my $cardnumber = $input->param('cardnumber');
+my $borrowernumber_hold = $input->param('borrowernumber') || '';
 my $borrowerslist;
 my $messageborrower;
 my $warnings;
 my $messages;
 
 my $date = C4::Dates->today('iso');
+my $action = $input->param('action');
+
+if ( $action eq 'move' ) {
+  my $where = $input->param('where');
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber = $input->param('biblionumber');
+                     
+  AlterPriority( $where, $borrowernumber, $biblionumber );
+
+} elsif ( $action eq 'cancel' ) {
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber = $input->param('biblionumber');
+  CancelReserve( $biblionumber, '', $borrowernumber );
+} elsif ( $action eq 'setLowestPriority' ) {
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber   = $input->param('biblionumber');
+  ToggleLowestPriority( $borrowernumber, $biblionumber );
+}
 
 if ($findborrower) {
     my ( $count, $borrowers ) =
@@ -97,21 +117,19 @@ if ($findborrower) {
 
     my @borrowers = @$borrowers;
 
-    if ( $#borrowers == -1 ) {
-        $input->param( 'findborrower', '' );
+    if ( !@borrowers ) {
         $messageborrower = "'$findborrower'";
     }
-    elsif ( $#borrowers == 0 ) {
-        $input->param( 'cardnumber', $borrowers[0]->{'cardnumber'} );
-        $cardnumber = $borrowers[0]->{'cardnumber'};
+    elsif ( @borrowers == 1 ) {
+        $borrowernumber_hold = $borrowers[0]->{'borrowernumber'};
     }
     else {
         $borrowerslist = \@borrowers;
     }
 }
 
-if ($cardnumber) {
-    my $borrowerinfo = GetMemberDetails( 0, $cardnumber );
+if ($borrowernumber_hold) {
+    my $borrowerinfo = GetMemberDetails( $borrowernumber_hold );
     my $diffbranch;
     my @getreservloop;
     my $count_reserv = 0;
@@ -123,7 +141,7 @@ if ($cardnumber) {
     my $number_reserves =
       GetReserveCount( $borrowerinfo->{'borrowernumber'} );
 
-    if ( $number_reserves > C4::Context->preference('maxreserves') ) {
+    if ( C4::Context->preference('maxreserves') && ($number_reserves >= C4::Context->preference('maxreserves')) ) {
                $warnings = 1;
         $maxreserves = 1;
     }
@@ -144,24 +162,25 @@ if ($cardnumber) {
     }
 
     $template->param(
-                borrowernumber => $borrowerinfo->{'borrowernumber'},
-                borrowersurname   => $borrowerinfo->{'surname'},
-                borrowerfirstname => $borrowerinfo->{'firstname'},
-                borrowerstreetaddress => $borrowerinfo->{'address'},
-                borrowercity => $borrowerinfo->{'city'},
-                borrowerphone => $borrowerinfo->{'phone'},
-                borrowermobile => $borrowerinfo->{'mobile'},
-                borrowerfax => $borrowerinfo->{'fax'},
-                borrowerphonepro => $borrowerinfo->{'phonepro'},
-                borroweremail => $borrowerinfo->{'email'},
-                borroweremailpro => $borrowerinfo->{'emailpro'},
-                borrowercategory => $borrowerinfo->{'category'},
-                borrowerreservs   => $count_reserv,
-                maxreserves       => $maxreserves,
-                expiry            => $expiry,
-                diffbranch        => $diffbranch,
-                               messages => $messages,
-                               warnings => $warnings
+                borrowernumber      => $borrowerinfo->{'borrowernumber'},
+                borrowersurname     => $borrowerinfo->{'surname'},
+                borrowerfirstname   => $borrowerinfo->{'firstname'},
+                borrowerstreetaddress   => $borrowerinfo->{'address'},
+                borrowercity        => $borrowerinfo->{'city'},
+                borrowerphone       => $borrowerinfo->{'phone'},
+                borrowermobile      => $borrowerinfo->{'mobile'},
+                borrowerfax         => $borrowerinfo->{'fax'},
+                borrowerphonepro    => $borrowerinfo->{'phonepro'},
+                borroweremail       => $borrowerinfo->{'email'},
+                borroweremailpro    => $borrowerinfo->{'emailpro'},
+                borrowercategory    => $borrowerinfo->{'category'},
+                borrowerreservs     => $count_reserv,
+                cardnumber          => $borrowerinfo->{'cardnumber'},
+                maxreserves         => $maxreserves,
+                expiry              => $expiry,
+                diffbranch          => $diffbranch,
+                               messages            => $messages,
+                               warnings            => $warnings
     );
 }
 
@@ -180,18 +199,18 @@ if ($borrowerslist) {
         } @{$borrowerslist}
       )
     {
-        push @values, $borrower->{cardnumber};
+        push @values, $borrower->{borrowernumber};
 
-        $labels{ $borrower->{cardnumber} } = sprintf(
+        $labels{ $borrower->{borrowernumber} } = sprintf(
             '%s, %s ... (%s - %s) ... %s',
-            $borrower->{surname},    $borrower->{firstname},
-            $borrower->{cardnumber}, $borrower->{categorycode},
-            $borrower->{address},
+            $borrower->{surname} ||'',    $borrower->{firstname} || '',
+            $borrower->{cardnumber} || '', $borrower->{categorycode} || '',
+            $borrower->{address} || '',
         );
     }
 
     $CGIselectborrower = CGI::scrolling_list(
-        -name     => 'cardnumber',
+        -name     => 'borrowernumber',
         -values   => \@values,
         -labels   => \%labels,
         -size     => 7,
@@ -200,7 +219,7 @@ if ($borrowerslist) {
 }
 
 # FIXME launch another time GetMemberDetails perhaps until
-my $borrowerinfo = GetMemberDetails( 0, $cardnumber );
+my $borrowerinfo = GetMemberDetails( $borrowernumber_hold );
 
 my @biblionumbers = ();
 my $biblionumbers = $input->param('biblionumbers');
@@ -214,20 +233,25 @@ my @biblioloop = ();
 foreach my $biblionumber (@biblionumbers) {
 
     my %biblioloopiter = ();
+       my $maxreserves;
 
     my $dat          = GetBiblioData($biblionumber);
 
+    unless ( CanBookBeReserved($borrowerinfo->{borrowernumber}, $biblionumber) ) {
+               $warnings = 1;
+        $maxreserves = 1;
+    }
     # get existing reserves .....
-    my ( $count, $reserves ) = GetReservesFromBiblionumber($biblionumber);
+    my ( $count, $reserves ) = GetReservesFromBiblionumber($biblionumber,1);
     my $totalcount = $count;
     my $alreadyreserved;
 
     foreach my $res (@$reserves) {
-        if ( ( $res->{found} eq 'W' ) ) {
+        if ( defined $res->{found} && $res->{found} eq 'W' ) {
             $count--;
         }
 
-        if ( $borrowerinfo->{borrowernumber} eq $res->{borrowernumber} ) {
+        if ( defined $borrowerinfo && ($borrowerinfo->{borrowernumber} eq $res->{borrowernumber}) ) {
             $warnings = 1;
             $alreadyreserved = 1;
             $biblioloopiter{warn} = 1;
@@ -237,7 +261,9 @@ foreach my $biblionumber (@biblionumbers) {
 
     $template->param( alreadyreserved => $alreadyreserved,
                       messages => $messages,
-                      warnings => $warnings );
+                      warnings => $warnings,
+                                         maxreserves=>$maxreserves
+                                         );
     
     
     # FIXME think @optionloop, is maybe obsolete, or  must be switchable by a systeme preference fixed rank or not
@@ -291,8 +317,9 @@ foreach my $biblionumber (@biblionumbers) {
     
     foreach my $biblioitemnumber (@biblioitemnumbers) {
         my $biblioitem = $biblioiteminfos_of->{$biblioitemnumber};
-        my $num_available;
-        my $num_override;
+        my $num_available = 0;
+        my $num_override  = 0;
+        my $hiddencount   = 0;
         
         $biblioitem->{description} =
           $itemtypes->{ $biblioitem->{itemtype} }{description};
@@ -350,7 +377,7 @@ foreach my $biblionumber (@biblionumbers) {
                 $item->{notforloanvalue} =
                   $notforloan_label_of->{ $item->{notforloan} };
             }
-            
+     
             # Management of lost or long overdue items
             if ( $item->{itemlost} ) {
                 
@@ -360,13 +387,17 @@ foreach my $biblionumber (@biblionumbers) {
                     : $item->{itemlost} == 2 ? "(long overdue)"
                       : "";
                 $item->{backgroundcolor} = 'other';
+                if (GetHideLostItemsPreference($borrowernumber) && !$showallitems) {
+                    $item->{hide} = 1;
+                    $hiddencount++;
+                }
             }
             
             # Check the transit status
             my ( $transfertwhen, $transfertfrom, $transfertto ) =
               GetTransfers($itemnumber);
             
-            if ( $transfertwhen ne '' ) {
+            if ( defined $transfertwhen && $transfertwhen ne '' ) {
                 $item->{transfertwhen} = format_date($transfertwhen);
                 $item->{transfertfrom} =
                   $branches->{$transfertfrom}{branchname};
@@ -389,25 +420,36 @@ foreach my $biblionumber (@biblionumbers) {
                 }
             }
             
-            my $branchitemrule = GetBranchItemRule( $item->{'homebranch'}, $item->{'itype'} );
+            my $branch = C4::Circulation::_GetCircControlBranch($item, $borrowerinfo);
+
+            my $branchitemrule = GetBranchItemRule( $branch, $item->{'itype'} );
             my $policy_holdallowed = 1;
             
             $item->{'holdallowed'} = $branchitemrule->{'holdallowed'};
             
             if ( $branchitemrule->{'holdallowed'} == 0 ||
-                 ( $branchitemrule->{'holdallowed'} == 1 && $borrowerinfo->{'branchcode'} ne $item->{'homebranch'} ) ) {
+                 ( $branchitemrule->{'holdallowed'} == 1 && 
+                     $borrowerinfo->{'branchcode'} ne $item->{'homebranch'} ) ) {
                 $policy_holdallowed = 0;
             }
             
-            if (IsAvailableForItemLevelRequest($itemnumber) and not $item->{cantreserve}) {
-                if ( not $policy_holdallowed and C4::Context->preference( 'AllowHoldPolicyOverride' ) ) {
-                    $item->{override} = 1;
-                    $num_override++;
-                } elsif ( $policy_holdallowed ) {
+            if (IsAvailableForItemLevelRequest($itemnumber) and 
+               not $item->{cantreserve} and 
+               CanItemBeReserved($borrowerinfo->{borrowernumber}, $itemnumber) ) {
+                if ( $policy_holdallowed ) {
                     $item->{available} = 1;
                     $num_available++;
                 }
+            } elsif (C4::Context->preference( 'AllowHoldPolicyOverride' ) ) {
+                    $item->{override} = 1;
+                    $num_override++;
             }
+            # If AllowHoldPolicyOverride is set, it should override EVERY restriction, not just branch item rules
+            if (C4::Context->preference( 'AllowHoldPolicyOverride' ) && !$item->{available} ) {
+                $item->{override} = 1;
+                $num_override++;
+            }   
+
             # If none of the conditions hold true, then neither override nor available is set and the item cannot be checked
             
             # FIXME: move this to a pm
@@ -427,14 +469,19 @@ foreach my $biblionumber (@biblionumbers) {
             $biblioloopiter{warn} = 1;
             $biblioloopiter{none_avail} = 1;
         }
+        $template->param( hiddencount => $hiddencount);
         
         push @bibitemloop, $biblioitem;
     }
 
     # existingreserves building
     my @reserveloop;
-    ( $count, $reserves ) = GetReservesFromBiblionumber($biblionumber);
-    foreach my $res ( sort { $a->{found} cmp $b->{found} } @$reserves ) {
+    ( $count, $reserves ) = GetReservesFromBiblionumber($biblionumber,1);
+    foreach my $res ( sort { 
+            my $a_found = $a->{found} || '';
+            my $b_found = $a->{found} || '';
+            $a_found cmp $b_found; 
+        } @$reserves ) {
         my %reserve;
         my @optionloop;
         for ( my $i = 1 ; $i <= $totalcount ; $i++ ) {
@@ -446,16 +493,8 @@ foreach my $biblionumber (@biblionumbers) {
                  }
                 );
         }
-        my @branchloop;
-        foreach my $br ( keys %$branches ) {
-            my %abranch;
-            $abranch{'selected'}   = ( $br eq $res->{'branchcode'} );
-            $abranch{'branch'}     = $br;
-            $abranch{'branchname'} = $branches->{$br}->{'branchname'};
-            push( @branchloop, \%abranch );
-        }
         
-        if ( ( $res->{'found'} eq 'W' ) ) {
+        if ( defined $res->{'found'} && $res->{'found'} eq 'W' || $res->{'found'} eq 'T' ) {
             my $item = $res->{'itemnumber'};
             $item = GetBiblioFromItemNumber($item,undef);
             $reserve{'wait'}= 1; 
@@ -470,6 +509,7 @@ foreach my $biblionumber (@biblionumbers) {
             }
             # set found to 1 if reserve is waiting for patron pickup
             $reserve{'found'} = 1 if $res->{'found'} eq 'W';
+            $reserve{'intransit'} = 1 if $res->{'found'} eq 'T';
         } elsif ($res->{priority} > 0) {
             if (defined($res->{itemnumber})) {
                 my $item = GetItem($res->{itemnumber});
@@ -481,23 +521,29 @@ foreach my $biblionumber (@biblionumbers) {
         
         #     get borrowers reserve info
         my $reserveborrowerinfo = GetMemberDetails( $res->{'borrowernumber'}, 0);
-        
+        if (C4::Context->preference('HidePatronName')){
+           $reserve{'hidename'} = 1;
+           $reserve{'cardnumber'} = $reserveborrowerinfo->{'cardnumber'};
+       }
+        $reserve{'expirationdate'} = format_date( $res->{'expirationdate'} ) 
+            unless ( !defined($res->{'expirationdate'}) || $res->{'expirationdate'} eq '0000-00-00' );
         $reserve{'date'}           = format_date( $res->{'reservedate'} );
         $reserve{'borrowernumber'} = $res->{'borrowernumber'};
         $reserve{'biblionumber'}   = $res->{'biblionumber'};
         $reserve{'borrowernumber'} = $res->{'borrowernumber'};
         $reserve{'firstname'}      = $reserveborrowerinfo->{'firstname'};
-        $reserve{'surname'}        = $reserveborrowerinfo->{'surname'};
+        $reserve{'surname'}        = $reserveborrowerinfo->{'surname'};            
         $reserve{'notes'}          = $res->{'reservenotes'};
         $reserve{'wait'}           =
-          ( ( $res->{'found'} eq 'W' ) or ( $res->{'priority'} eq '0' ) );
+          ( ( defined $res->{'found'} and $res->{'found'} eq 'W' ) or ( $res->{'priority'} eq '0' ) );
         $reserve{'constrainttypea'} = ( $res->{'constrainttype'} eq 'a' );
         $reserve{'constrainttypeo'} = ( $res->{'constrainttype'} eq 'o' );
         $reserve{'voldesc'}         = $res->{'volumeddesc'};
         $reserve{'ccode'}           = $res->{'ccode'};
         $reserve{'barcode'}         = $res->{'barcode'};
         $reserve{'priority'}    = $res->{'priority'};
-        $reserve{'branchloop'} = \@branchloop;
+        $reserve{'lowestPriority'}    = $res->{'lowestPriority'};
+        $reserve{'branchloop'} = GetBranchesLoop($res->{'branchcode'});
         $reserve{'optionloop'} = \@optionloop;
         
         push( @reserveloop, \%reserve );
@@ -520,15 +566,18 @@ foreach my $biblionumber (@biblionumbers) {
                      date              => $date,
                      biblionumber      => $biblionumber,
                      findborrower      => $findborrower,
-                     cardnumber        => $cardnumber,
-                     CGIselectborrower => $CGIselectborrower,
                      title             => $dat->{title},
                      author            => $dat->{author},
                      holdsview => 1,
-                     borrower_branchname => $branches->{$borrowerinfo->{'branchcode'}}->{'branchname'},
-                     borrower_branchcode => $borrowerinfo->{'branchcode'},
                      C4::Search::enabled_staff_search_views,
                     );
+    if (defined $borrowerinfo && exists $borrowerinfo->{'branchcode'}) {
+        $template->param(
+                     borrower_branchname => $branches->{$borrowerinfo->{'branchcode'}}->{'branchname'},
+                     borrower_branchcode => $borrowerinfo->{'branchcode'},
+        );
+    }
+    $template->param(CGIselectborrower => $CGIselectborrower) if defined $CGIselectborrower;
 
     $biblioloopiter{biblionumber} = $biblionumber;
     $biblioloopiter{title} = $dat->{title};
@@ -545,10 +594,15 @@ foreach my $biblionumber (@biblionumbers) {
 
 $template->param( biblioloop => \@biblioloop );
 $template->param( biblionumbers => $biblionumbers );
+$template->param( DHTMLcalendar_dateformat  => C4::Dates->DHTMLcalendar() );
 
 if ($multihold) {
     $template->param( multi_hold => 1 );
 }
+
+if ( C4::Context->preference( 'AllowHoldDateInFuture' ) ) {
+    $template->param( reserve_in_future => 1 );
+}
     
 # printout the page
 output_html_with_http_headers $input, $cookie, $template->output;