| 
      
            Lines 34-39
          use URI::Escape;
      
      
        Link Here
      
     | 
  
        
          | 34 | 
          use C4::Auth qw( get_template_and_user );  | 
          34 | 
          use C4::Auth qw( get_template_and_user );  | 
        
        
          | 35 | 
          use C4::Context;  | 
          35 | 
          use C4::Context;  | 
        
        
          | 36 | 
          use C4::Templates;  | 
          36 | 
          use C4::Templates;  | 
        
            
               | 
               | 
              37 | 
              use Koha::Token;  | 
            
        
          | 37 | 
           | 
          38 | 
           | 
        
        
          | 38 | 
          our (@ISA, @EXPORT_OK);  | 
          39 | 
          our (@ISA, @EXPORT_OK);  | 
        
        
          | 39 | 
           | 
          40 | 
           | 
        
  
    | 
      
            Lines 314-322
          sub is_ajax {
      
      
        Link Here
      
     | 
  
        
          | 314 | 
          To executed at the beginning of scripts to stop the script at this point if  | 
          315 | 
          To executed at the beginning of scripts to stop the script at this point if  | 
        
        
          | 315 | 
          some errors are found.  | 
          316 | 
          some errors are found.  | 
        
        
          | 316 | 
           | 
          317 | 
           | 
        
          
            
              | 317 | 
              Tests for module 'members':  | 
              318 | 
              A series of tests can be run for a given module, or a specific check.  | 
            
            
              | 318 | 
              * patron is not defined (we are looking for a patron that does no longer exist/never existed)  | 
              319 | 
              Params "module" and "check" are mutually exclusive.  | 
            
            
              | 319 | 
              * The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos')  | 
              320 | 
               | 
            
            
               | 
               | 
              321 | 
              Tests for modules:  | 
            
            
              | 322 | 
              * members:  | 
            
            
              | 323 | 
                  - Patron is not defined (we are looking for a patron that does no longer exist/never existed)  | 
            
            
              | 324 | 
                  - The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos')  | 
            
            
              | 325 | 
               | 
            
            
              | 326 | 
              Tests for specific check:  | 
            
            
              | 327 | 
              * csrf_token  | 
            
            
              | 328 | 
                  will test if the csrf_token CGI param is valid  | 
            
        
          | 320 | 
           | 
          329 | 
           | 
        
        
          | 321 | 
          Others will be added here depending on the needs (for instance biblio does not exist will be useful).  | 
          330 | 
          Others will be added here depending on the needs (for instance biblio does not exist will be useful).  | 
        
        
          | 322 | 
           | 
          331 | 
           | 
        
  
    | 
      
            Lines 332-347
          sub output_and_exit_if_error {
      
      
        Link Here
      
     | 
  
        
          | 332 | 
                      if ( not $current_patron ) { | 
          341 | 
                      if ( not $current_patron ) { | 
        
        
          | 333 | 
                          $error = 'unknown_patron';  | 
          342 | 
                          $error = 'unknown_patron';  | 
        
        
          | 334 | 
                      }  | 
          343 | 
                      }  | 
        
          
            
              | 335 | 
                          elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { | 
              344 | 
                          elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )  | 
            
            
               | 
               | 
              345 | 
                          { | 
            
        
          | 336 | 
                          $error = 'cannot_see_patron_infos';  | 
          346 | 
                          $error = 'cannot_see_patron_infos';  | 
        
        
          | 337 | 
                      }  | 
          347 | 
                      }  | 
        
          
            
              | 338 | 
                      } elsif ( $params->{module} eq 'cataloguing' ) { | 
              348 | 
                      }  | 
            
            
               | 
               | 
              349 | 
                      elsif ( $params->{module} eq 'cataloguing' ) { | 
            
        
          | 339 | 
                      # We are testing the record to avoid additem to fetch the Koha::Biblio  | 
          350 | 
                      # We are testing the record to avoid additem to fetch the Koha::Biblio  | 
        
        
          | 340 | 
                      # But in the long term we will want to get a biblio in parameter  | 
          351 | 
                      # But in the long term we will want to get a biblio in parameter  | 
        
        
          | 341 | 
                      $error = 'unknown_biblio' unless $params->{record}; | 
          352 | 
                      $error = 'unknown_biblio' unless $params->{record}; | 
        
        
          | 342 | 
                  }  | 
          353 | 
                  }  | 
        
        
          | 343 | 
              }  | 
          354 | 
              }  | 
        
          
            
              | 344 | 
               | 
              355 | 
                  elsif ( $params and exists $params->{check} ) { | 
            
            
               | 
               | 
              356 | 
                      if ( $params->{check} eq 'csrf_token' ) { | 
            
            
              | 357 | 
                          $error = 'wrong_csrf_token'  | 
            
            
              | 358 | 
                            unless Koha::Token->new->check_csrf(  | 
            
            
              | 359 | 
                              { | 
            
            
              | 360 | 
                                  session_id => scalar $query->cookie('CGISESSID'), | 
            
            
              | 361 | 
                                  token      => scalar $query->param('csrf_token'), | 
            
            
              | 362 | 
                              }  | 
            
            
              | 363 | 
                            );  | 
            
            
              | 364 | 
                      }  | 
            
            
              | 365 | 
                  }  | 
            
        
          | 345 | 
              output_and_exit( $query, $cookie, $template, $error ) if $error;  | 
          366 | 
              output_and_exit( $query, $cookie, $template, $error ) if $error;  | 
        
        
          | 346 | 
              return;  | 
          367 | 
              return;  | 
        
        
          | 347 | 
          }  | 
          368 | 
          }  |