Bug 6632 [Signed Off] add html filter to prevent XSS
[koha_fer] / reserve / request.pl
index 908a626..79ff6b5 100755 (executable)
@@ -15,9 +15,9 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 =head1 request.pl
 
@@ -51,12 +51,13 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { reserveforothers => 1 },
+        flagsrequired   => { reserveforothers => 'place_holds' },
     }
 );
 
 my $multihold = $input->param('multi_hold');
 $template->param(multi_hold => $multihold);
+my $showallitems = $input->param('showallitems');
 
 # get Branches and Itemtypes
 my $branches = GetBranches();
@@ -84,13 +85,31 @@ my $CGIbranch = CGI::scrolling_list(
 my $findborrower = $input->param('findborrower');
 $findborrower = '' unless defined $findborrower;
 $findborrower =~ s|,| |g;
-my $cardnumber = $input->param('cardnumber') || '';
+my $borrowernumber_hold = $input->param('borrowernumber') || '';
 my $borrowerslist;
 my $messageborrower;
 my $warnings;
 my $messages;
 
 my $date = C4::Dates->today('iso');
+my $action = $input->param('action');
+
+if ( $action eq 'move' ) {
+  my $where = $input->param('where');
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber = $input->param('biblionumber');
+                     
+  AlterPriority( $where, $borrowernumber, $biblionumber );
+
+} elsif ( $action eq 'cancel' ) {
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber = $input->param('biblionumber');
+  CancelReserve( $biblionumber, '', $borrowernumber );
+} elsif ( $action eq 'setLowestPriority' ) {
+  my $borrowernumber = $input->param('borrowernumber');
+  my $biblionumber   = $input->param('biblionumber');
+  ToggleLowestPriority( $borrowernumber, $biblionumber );
+}
 
 if ($findborrower) {
     my ( $count, $borrowers ) =
@@ -98,21 +117,19 @@ if ($findborrower) {
 
     my @borrowers = @$borrowers;
 
-    if ( $#borrowers == -1 ) {
-        $input->param( 'findborrower', '' );
+    if ( !@borrowers ) {
         $messageborrower = "'$findborrower'";
     }
-    elsif ( $#borrowers == 0 ) {
-        $input->param( 'cardnumber', $borrowers[0]->{'cardnumber'} );
-        $cardnumber = $borrowers[0]->{'cardnumber'};
+    elsif ( @borrowers == 1 ) {
+        $borrowernumber_hold = $borrowers[0]->{'borrowernumber'};
     }
     else {
         $borrowerslist = \@borrowers;
     }
 }
 
-if ($cardnumber) {
-    my $borrowerinfo = GetMemberDetails( 0, $cardnumber );
+if ($borrowernumber_hold) {
+    my $borrowerinfo = GetMemberDetails( $borrowernumber_hold );
     my $diffbranch;
     my @getreservloop;
     my $count_reserv = 0;
@@ -124,7 +141,7 @@ if ($cardnumber) {
     my $number_reserves =
       GetReserveCount( $borrowerinfo->{'borrowernumber'} );
 
-    if ( $number_reserves > C4::Context->preference('maxreserves') ) {
+    if ( C4::Context->preference('maxreserves') && ($number_reserves >= C4::Context->preference('maxreserves')) ) {
                $warnings = 1;
         $maxreserves = 1;
     }
@@ -145,24 +162,25 @@ if ($cardnumber) {
     }
 
     $template->param(
-                borrowernumber => $borrowerinfo->{'borrowernumber'},
-                borrowersurname   => $borrowerinfo->{'surname'},
-                borrowerfirstname => $borrowerinfo->{'firstname'},
-                borrowerstreetaddress => $borrowerinfo->{'address'},
-                borrowercity => $borrowerinfo->{'city'},
-                borrowerphone => $borrowerinfo->{'phone'},
-                borrowermobile => $borrowerinfo->{'mobile'},
-                borrowerfax => $borrowerinfo->{'fax'},
-                borrowerphonepro => $borrowerinfo->{'phonepro'},
-                borroweremail => $borrowerinfo->{'email'},
-                borroweremailpro => $borrowerinfo->{'emailpro'},
-                borrowercategory => $borrowerinfo->{'category'},
-                borrowerreservs   => $count_reserv,
-                maxreserves       => $maxreserves,
-                expiry            => $expiry,
-                diffbranch        => $diffbranch,
-                               messages => $messages,
-                               warnings => $warnings
+                borrowernumber      => $borrowerinfo->{'borrowernumber'},
+                borrowersurname     => $borrowerinfo->{'surname'},
+                borrowerfirstname   => $borrowerinfo->{'firstname'},
+                borrowerstreetaddress   => $borrowerinfo->{'address'},
+                borrowercity        => $borrowerinfo->{'city'},
+                borrowerphone       => $borrowerinfo->{'phone'},
+                borrowermobile      => $borrowerinfo->{'mobile'},
+                borrowerfax         => $borrowerinfo->{'fax'},
+                borrowerphonepro    => $borrowerinfo->{'phonepro'},
+                borroweremail       => $borrowerinfo->{'email'},
+                borroweremailpro    => $borrowerinfo->{'emailpro'},
+                borrowercategory    => $borrowerinfo->{'category'},
+                borrowerreservs     => $count_reserv,
+                cardnumber          => $borrowerinfo->{'cardnumber'},
+                maxreserves         => $maxreserves,
+                expiry              => $expiry,
+                diffbranch          => $diffbranch,
+                               messages            => $messages,
+                               warnings            => $warnings
     );
 }
 
@@ -181,18 +199,18 @@ if ($borrowerslist) {
         } @{$borrowerslist}
       )
     {
-        push @values, $borrower->{cardnumber};
+        push @values, $borrower->{borrowernumber};
 
-        $labels{ $borrower->{cardnumber} } = sprintf(
+        $labels{ $borrower->{borrowernumber} } = sprintf(
             '%s, %s ... (%s - %s) ... %s',
-            $borrower->{surname},    $borrower->{firstname},
-            $borrower->{cardnumber}, $borrower->{categorycode},
-            $borrower->{address},
+            $borrower->{surname} ||'',    $borrower->{firstname} || '',
+            $borrower->{cardnumber} || '', $borrower->{categorycode} || '',
+            $borrower->{address} || '',
         );
     }
 
     $CGIselectborrower = CGI::scrolling_list(
-        -name     => 'cardnumber',
+        -name     => 'borrowernumber',
         -values   => \@values,
         -labels   => \%labels,
         -size     => 7,
@@ -201,7 +219,7 @@ if ($borrowerslist) {
 }
 
 # FIXME launch another time GetMemberDetails perhaps until
-my $borrowerinfo = GetMemberDetails( 0, $cardnumber );
+my $borrowerinfo = GetMemberDetails( $borrowernumber_hold );
 
 my @biblionumbers = ();
 my $biblionumbers = $input->param('biblionumbers');
@@ -219,7 +237,7 @@ foreach my $biblionumber (@biblionumbers) {
 
     my $dat          = GetBiblioData($biblionumber);
 
-    if ( not CanBookBeReserved($borrowerinfo->{borrowernumber}, $biblionumber) ) {
+    unless ( CanBookBeReserved($borrowerinfo->{borrowernumber}, $biblionumber) ) {
                $warnings = 1;
         $maxreserves = 1;
     }
@@ -301,6 +319,7 @@ foreach my $biblionumber (@biblionumbers) {
         my $biblioitem = $biblioiteminfos_of->{$biblioitemnumber};
         my $num_available = 0;
         my $num_override  = 0;
+        my $hiddencount   = 0;
         
         $biblioitem->{description} =
           $itemtypes->{ $biblioitem->{itemtype} }{description};
@@ -358,7 +377,7 @@ foreach my $biblionumber (@biblionumbers) {
                 $item->{notforloanvalue} =
                   $notforloan_label_of->{ $item->{notforloan} };
             }
-            
+     
             # Management of lost or long overdue items
             if ( $item->{itemlost} ) {
                 
@@ -368,6 +387,10 @@ foreach my $biblionumber (@biblionumbers) {
                     : $item->{itemlost} == 2 ? "(long overdue)"
                       : "";
                 $item->{backgroundcolor} = 'other';
+                if (GetHideLostItemsPreference($borrowernumber) && !$showallitems) {
+                    $item->{hide} = 1;
+                    $hiddencount++;
+                }
             }
             
             # Check the transit status
@@ -405,19 +428,28 @@ foreach my $biblionumber (@biblionumbers) {
             $item->{'holdallowed'} = $branchitemrule->{'holdallowed'};
             
             if ( $branchitemrule->{'holdallowed'} == 0 ||
-                 ( $branchitemrule->{'holdallowed'} == 1 && $borrowerinfo->{'branchcode'} ne $item->{'homebranch'} ) ) {
+                 ( $branchitemrule->{'holdallowed'} == 1 && 
+                     $borrowerinfo->{'branchcode'} ne $item->{'homebranch'} ) ) {
                 $policy_holdallowed = 0;
             }
             
-            if (IsAvailableForItemLevelRequest($itemnumber) and not $item->{cantreserve} and CanItemBeReserved($borrowerinfo->{borrowernumber}, $itemnumber) ) {
-                if ( not $policy_holdallowed and C4::Context->preference( 'AllowHoldPolicyOverride' ) ) {
-                    $item->{override} = 1;
-                    $num_override++;
-                } elsif ( $policy_holdallowed ) {
+            if (IsAvailableForItemLevelRequest($itemnumber) and 
+               not $item->{cantreserve} and 
+               CanItemBeReserved($borrowerinfo->{borrowernumber}, $itemnumber) ) {
+                if ( $policy_holdallowed ) {
                     $item->{available} = 1;
                     $num_available++;
                 }
+            } elsif (C4::Context->preference( 'AllowHoldPolicyOverride' ) ) {
+                    $item->{override} = 1;
+                    $num_override++;
             }
+            # If AllowHoldPolicyOverride is set, it should override EVERY restriction, not just branch item rules
+            if (C4::Context->preference( 'AllowHoldPolicyOverride' ) && !$item->{available} ) {
+                $item->{override} = 1;
+                $num_override++;
+            }   
+
             # If none of the conditions hold true, then neither override nor available is set and the item cannot be checked
             
             # FIXME: move this to a pm
@@ -437,6 +469,7 @@ foreach my $biblionumber (@biblionumbers) {
             $biblioloopiter{warn} = 1;
             $biblioloopiter{none_avail} = 1;
         }
+        $template->param( hiddencount => $hiddencount);
         
         push @bibitemloop, $biblioitem;
     }
@@ -461,7 +494,7 @@ foreach my $biblionumber (@biblionumbers) {
                 );
         }
         
-        if ( defined $res->{'found'} && $res->{'found'} eq 'W' ) {
+        if ( defined $res->{'found'} && $res->{'found'} eq 'W' || $res->{'found'} eq 'T' ) {
             my $item = $res->{'itemnumber'};
             $item = GetBiblioFromItemNumber($item,undef);
             $reserve{'wait'}= 1; 
@@ -476,6 +509,7 @@ foreach my $biblionumber (@biblionumbers) {
             }
             # set found to 1 if reserve is waiting for patron pickup
             $reserve{'found'} = 1 if $res->{'found'} eq 'W';
+            $reserve{'intransit'} = 1 if $res->{'found'} eq 'T';
         } elsif ($res->{priority} > 0) {
             if (defined($res->{itemnumber})) {
                 my $item = GetItem($res->{itemnumber});
@@ -491,6 +525,8 @@ foreach my $biblionumber (@biblionumbers) {
            $reserve{'hidename'} = 1;
            $reserve{'cardnumber'} = $reserveborrowerinfo->{'cardnumber'};
        }
+        $reserve{'expirationdate'} = format_date( $res->{'expirationdate'} ) 
+            unless ( !defined($res->{'expirationdate'}) || $res->{'expirationdate'} eq '0000-00-00' );
         $reserve{'date'}           = format_date( $res->{'reservedate'} );
         $reserve{'borrowernumber'} = $res->{'borrowernumber'};
         $reserve{'biblionumber'}   = $res->{'biblionumber'};
@@ -506,6 +542,7 @@ foreach my $biblionumber (@biblionumbers) {
         $reserve{'ccode'}           = $res->{'ccode'};
         $reserve{'barcode'}         = $res->{'barcode'};
         $reserve{'priority'}    = $res->{'priority'};
+        $reserve{'lowestPriority'}    = $res->{'lowestPriority'};
         $reserve{'branchloop'} = GetBranchesLoop($res->{'branchcode'});
         $reserve{'optionloop'} = \@optionloop;
         
@@ -529,7 +566,6 @@ foreach my $biblionumber (@biblionumbers) {
                      date              => $date,
                      biblionumber      => $biblionumber,
                      findborrower      => $findborrower,
-                     cardnumber        => $cardnumber,
                      title             => $dat->{title},
                      author            => $dat->{author},
                      holdsview => 1,
@@ -558,16 +594,14 @@ foreach my $biblionumber (@biblionumbers) {
 
 $template->param( biblioloop => \@biblioloop );
 $template->param( biblionumbers => $biblionumbers );
+$template->param( DHTMLcalendar_dateformat  => C4::Dates->DHTMLcalendar() );
 
 if ($multihold) {
     $template->param( multi_hold => 1 );
 }
 
 if ( C4::Context->preference( 'AllowHoldDateInFuture' ) ) {
-    $template->param(
-       reserve_in_future         => 1,
-       DHTMLcalendar_dateformat  => C4::Dates->DHTMLcalendar(),
-       );
+    $template->param( reserve_in_future => 1 );
 }
     
 # printout the page