Attachment #105349 for bug #23276

View | Details | Raw Unified | Return to bug 23276
Collapse All | Expand All

Lines 54-62 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt (-3 / +1 lines)
54	[% FOREACH ERROR IN ERRORS %]	54	[% FOREACH ERROR IN ERRORS %]
55	<div class="alert">	55	<div class="alert">
56	There was a problem with this operation:	56	There was a problem with this operation:
57	[% IF ( ERROR.tagsdisabled ) %]	57	[% IF ( ERROR.badparam ) %]
58	Sorry, tags are not enabled on this system.
59	[% ELSIF ( ERROR.badparam ) %]
60	ERROR: illegal parameter [% ERROR.badparam \| html %]	58	ERROR: illegal parameter [% ERROR.badparam \| html %]
61	[% ELSIF ( ERROR.login ) %]	59	[% ELSIF ( ERROR.login ) %]
62	ERROR: You must log in to complete that action.	60	ERROR: You must log in to complete that action.




use C4::Auth qw(:DEFAULT check_cookie_auth);
use C4::Context;
use C4::Debug;
use C4::Output qw(:html :ajax );
use C4::Scrubber;
use C4::Biblio;
use C4::Items qw(GetItemsInfo GetHiddenItemnumbers);

my $is_ajax = is_ajax();
my $openadds = C4::Context->preference('TagsModeration') ? 0 : 1;
my $query = ($is_ajax) ? &ajax_auth_cgi({}) : CGI->new();
foreach ($query->param) {
    if (/^newtag(.*)/) {
        my $biblionumber = $1;
        unless ($biblionumber =~ /^\d+$/) {
            $debug and warn "$_ references non numerical biblionumber '$biblionumber'";
            push @errors, {+'badparam' => $_ };
            push @globalErrorIndexes, $#errors;
            next;
        }
        $newtags{$biblionumber} = $query->param($_);
    } elsif (/^del(\d+)$/) {
        push @deltags, $1;
    }
			$newtags{$biblionumber} = $query->param($_);
		} elsif (/^del(\d+)$/) {
			push @deltags, $1;
		}
	}
}

my $add_op = (scalar(keys %newtags) + scalar(@deltags)) ? 1 : 0;

	});
}

unless ( C4::Context->preference('TagsEnabled') ) {
    print $query->redirect("/cgi-bin/koha/errors/404.pl");
    exit;
}

if ($add_op) {
	unless ($loggedinuser) {
		push @errors, {+'login' => 1 };
- 

Return to bug 23276

Lines 38-44 use CGI::Cookie; # need to check cookies before having CGI parse the POST reques Link Here

(-)a/opac/opac-tags.pl (-20 / +19 lines)
38	use C4::Auth qw(:DEFAULT check_cookie_auth);	38	use C4::Auth qw(:DEFAULT check_cookie_auth);
39	use C4::Context;	39	use C4::Context;
40	use C4::Debug;	40	use C4::Debug;
41	use C4::Output qw(:html :ajax pagination_bar);	41	use C4::Output qw(:html :ajax );
42	use C4::Scrubber;	42	use C4::Scrubber;
43	use C4::Biblio;	43	use C4::Biblio;
44	use C4::Items qw(GetItemsInfo GetHiddenItemnumbers);	44	use C4::Items qw(GetItemsInfo GetHiddenItemnumbers);
Lines 87-110 sub ajax_auth_cgi { # returns CGI object Link Here
87	my $is_ajax = is_ajax();	87	my $is_ajax = is_ajax();
88	my $openadds = C4::Context->preference('TagsModeration') ? 0 : 1;	88	my $openadds = C4::Context->preference('TagsModeration') ? 0 : 1;
89	my $query = ($is_ajax) ? &ajax_auth_cgi({}) : CGI->new();	89	my $query = ($is_ajax) ? &ajax_auth_cgi({}) : CGI->new();
90	unless (C4::Context->preference('TagsEnabled')) {	90	foreach ($query->param) {
91	push @errors, {+ tagsdisabled=>1 };	91	if (/^newtag(.*)/) {
92	push @globalErrorIndexes, $#errors;	92	my $biblionumber = $1;
93	} else {	93	unless ($biblionumber =~ /^\d+$/) {
94	foreach ($query->param) {	94	$debug and warn "$_ references non numerical biblionumber '$biblionumber'";
95	if (/^newtag(.*)/) {	95	push @errors, {+'badparam' => $_ };
96	my $biblionumber = $1;	96	push @globalErrorIndexes, $#errors;
97	unless ($biblionumber =~ /^\d+$/) {	97	next;
98	$debug and warn "$_ references non numerical biblionumber '$biblionumber'";	98	}
99	push @errors, {+'badparam' => $_ };	99	$newtags{$biblionumber} = $query->param($_);
100	push @globalErrorIndexes, $#errors;	100	} elsif (/^del(\d+)$/) {
101	next;	101	push @deltags, $1;
102	}	102	}
103	$newtags{$biblionumber} = $query->param($_);
104	} elsif (/^del(\d+)$/) {
105	push @deltags, $1;
106	}
107	}
108	}	103	}
109		104
110	my $add_op = (scalar(keys %newtags) + scalar(@deltags)) ? 1 : 0;	105	my $add_op = (scalar(keys %newtags) + scalar(@deltags)) ? 1 : 0;
Lines 122-127 if ($is_ajax) { Link Here
122	});	117	});
123	}	118	}
124		119
		120	unless ( C4::Context->preference('TagsEnabled') ) {
		121	print $query->redirect("/cgi-bin/koha/errors/404.pl");
		122	exit;
		123	}
		124
125	if ($add_op) {	125	if ($add_op) {
126	unless ($loggedinuser) {	126	unless ($loggedinuser) {
127	push @errors, {+'login' => 1 };	127	push @errors, {+'login' => 1 };
128	-