From 3fb42927b9a5572ebc3279ebf5e0263a2de298d2 Mon Sep 17 00:00:00 2001
From: Chris Cormack <chris@bigballofwax.co.nz>
Date: Sun, 24 Mar 2013 20:29:18 +1300
Subject: [PATCH] Bug 9915 : Allow sql_params to be passed to a report using
 the svc interface

Test plan:

1/ Make a public report that contains sql parameters
2/ Test it from the staff side
3/ Hit the url like
cgi-bin/koha/svc/report?id=1&sql_params=chris&sql_params=chris2
4/ Test you get json
---
 opac/svc/report |   46 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 13 deletions(-)

diff --git a/opac/svc/report b/opac/svc/report
index 38cbd42..949165c 100755
--- a/opac/svc/report
+++ b/opac/svc/report
@@ -1,12 +1,13 @@
 #!/usr/bin/perl
 
 # Copyright 2011 Chris Cormack <chris@bigballofwax.co.nz>
+# Updated 2013 by Chris Cormack <chris@bigballofwax.co.nz>
 #
 # This file is part of Koha.
 #
 # Koha is free software; you can redistribute it and/or modify it under the
 # terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 2 of the License, or (at your option) any later
+# Foundation; either version 3 of the License, or (at your option) any later
 # version.
 #
 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
@@ -17,7 +18,6 @@
 # with Koha; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
-
 use strict;
 use warnings;
 
@@ -27,32 +27,52 @@ use CGI;
 
 use Koha::Cache;
 
-my $query  = CGI->new();
-my $report_id = $query->param('id');
+my $query       = CGI->new();
+my $report_id   = $query->param('id');
 my $report_name = $query->param('name');
+my @sql_params  = $query->param('sql_params');
 
-my $report_rec = get_saved_report( $report_name ? { 'name' => $report_name } : { 'id' => $report_id } );
+my $report_rec = get_saved_report(
+    $report_name ? { 'name' => $report_name } : { 'id' => $report_id } );
 die "Sorry this report is not public\n" unless $report_rec->{public};
 
-
 my $cache_active = Koha::Cache->is_cache_active;
-my ($cache_key, $cache, $json_text);
+my ( $cache_key, $cache, $json_text );
 if ($cache_active) {
-    $cache_key = "opac:report:".($report_name ? "name:$report_name" : "id:$report_id");
-    $cache = Koha::Cache->new();
+    $cache_key =
+        "opac:report:"
+      . ( $report_name ? "name:$report_name" : "id:$report_id" )
+      . @sql_params;
+    $cache     = Koha::Cache->new();
     $json_text = $cache->get_from_cache($cache_key);
 }
 
 unless ($json_text) {
     my $offset = 0;
-    my $limit  = C4::Context->preference("SvcMaxReportRows") || 10;
-    my ( $sth, $errors ) = execute_query( $report_rec->{savedsql}, $offset, $limit );
+    my $limit = C4::Context->preference("SvcMaxReportRows") || 10;
+    my $sql = $report_rec->{savedsql};
+    if (@sql_params) {
+
+        # we have sql params need to fix the sql
+        my @split = split /<<|>>/, $sql;
+        my @tmpl_parameters;
+        for ( my $i = 0 ; $i < $#split / 2 ; $i++ ) {
+            my $quoted = C4::Context->dbh->quote( $sql_params[$i] );
+
+            # if there are special regexp chars, we must \ them
+            $split[ $i * 2 + 1 ] =~ s/(\||\?|\.|\*|\(|\)|\%)/\\$1/g;
+            $sql =~ s/<<$split[$i*2+1]>>/$quoted/;
+        }
+    }
+    my ( $sth, $errors ) =
+      execute_query( $sql, $offset, $limit );
     if ($sth) {
-        my $lines     = $sth->fetchall_arrayref;
+        my $lines = $sth->fetchall_arrayref;
         $json_text = to_json($lines);
 
         if ($cache_active) {
-            $cache->set_in_cache( $cache_key, $json_text, $report_rec->{cache_expiry} );
+            $cache->set_in_cache( $cache_key, $json_text,
+                $report_rec->{cache_expiry} );
         }
     }
     else {
-- 
1.7.10.4