From 1cc852f0cb80e96cc57b27301b48898853cf3834 Mon Sep 17 00:00:00 2001 From: Adrien Saurat Date: Thu, 22 Dec 2011 10:34:07 +0100 Subject: [PATCH] Bug 7013: enforces required format for authorized values --- admin/authorised_values.pl | 99 +++++++++++--------- .../prog/en/modules/admin/authorised_values.tt | 41 +++++++-- 2 files changed, 88 insertions(+), 52 deletions(-) diff --git a/admin/authorised_values.pl b/admin/authorised_values.pl index d7872d6..a9b6ac2 100755 --- a/admin/authorised_values.pl +++ b/admin/authorised_values.pl @@ -102,59 +102,68 @@ if ($op eq 'add_form') { my $imageurl = $input->param( 'imageurl' ) || ''; $imageurl = '' if $imageurl =~ /removeImage/; my $duplicate_entry = 0; + my $bad_chars = 0; - if ( $id ) { # Update - my $sth = $dbh->prepare( "SELECT category, authorised_value FROM authorised_values WHERE id='$id' "); - $sth->execute(); - my ($category, $authorised_value) = $sth->fetchrow_array(); - if ( $authorised_value ne $new_authorised_value ) { + if ( $new_authorised_value =~ /^[a-zA-Z0-9\-_]+$/ ) { + if ( $id ) { # Update + my $sth = $dbh->prepare( "SELECT category, authorised_value FROM authorised_values WHERE id=? "); + $sth->execute($id); + my ($category, $authorised_value) = $sth->fetchrow_array(); + if ( $authorised_value ne $new_authorised_value ) { + my $sth = $dbh->prepare_cached( "SELECT COUNT(*) FROM authorised_values " . + "WHERE category = ? AND authorised_value = ? and id<>?"); + $sth->execute($new_category, $new_authorised_value, $id); + ($duplicate_entry) = $sth->fetchrow_array(); + warn "**** duplicate_entry = $duplicate_entry"; + } + unless ( $duplicate_entry ) { + my $sth=$dbh->prepare( 'UPDATE authorised_values + SET category = ?, + authorised_value = ?, + lib = ?, + lib_opac = ?, + imageurl = ? + WHERE id=?' ); + my $lib = $input->param('lib'); + my $lib_opac = $input->param('lib_opac'); + undef $lib if ($lib eq ""); # to insert NULL instead of a blank string + undef $lib_opac if ($lib_opac eq ""); # to insert NULL instead of a blank string + $sth->execute($new_category, $new_authorised_value, $lib, $lib_opac, $imageurl, $id); + print "Content-Type: text/html\n\n"; + exit; + } + } + else { # Insert my $sth = $dbh->prepare_cached( "SELECT COUNT(*) FROM authorised_values " . - "WHERE category = '$new_category' AND authorised_value = '$new_authorised_value' and id<>$id"); - $sth->execute(); + "WHERE category = ? AND authorised_value = ? "); + $sth->execute($new_category, $new_authorised_value); ($duplicate_entry) = $sth->fetchrow_array(); - warn "**** duplicate_entry = $duplicate_entry"; - } - unless ( $duplicate_entry ) { - my $sth=$dbh->prepare( 'UPDATE authorised_values - SET category = ?, - authorised_value = ?, - lib = ?, - lib_opac = ?, - imageurl = ? - WHERE id=?' ); - my $lib = $input->param('lib'); - my $lib_opac = $input->param('lib_opac'); - undef $lib if ($lib eq ""); # to insert NULL instead of a blank string - undef $lib_opac if ($lib_opac eq ""); # to insert NULL instead of a blank string - $sth->execute($new_category, $new_authorised_value, $lib, $lib_opac, $imageurl, $id); - print "Content-Type: text/html\n\n"; - exit; + unless ( $duplicate_entry ) { + my $sth=$dbh->prepare( 'INSERT INTO authorised_values + ( id, category, authorised_value, lib, lib_opac, imageurl ) + values (?, ?, ?, ?, ?, ?)' ); + my $lib = $input->param('lib'); + my $lib_opac = $input->param('lib_opac'); + undef $lib if ($lib eq ""); # to insert NULL instead of a blank string + undef $lib_opac if ($lib_opac eq ""); # to insert NULL instead of a blank string + $sth->execute($id, $new_category, $new_authorised_value, $lib, $lib_opac, $imageurl ); + print "Content-Type: text/html\n\nparam('category')."&offset=$offset\">"; + exit; + } } - } - else { # Insert - my $sth = $dbh->prepare_cached( "SELECT COUNT(*) FROM authorised_values " . - "WHERE category = '$new_category' AND authorised_value = '$new_authorised_value' "); - $sth->execute(); - ($duplicate_entry) = $sth->fetchrow_array(); - unless ( $duplicate_entry ) { - my $sth=$dbh->prepare( 'INSERT INTO authorised_values - ( id, category, authorised_value, lib, lib_opac, imageurl ) - values (?, ?, ?, ?, ?, ?)' ); - my $lib = $input->param('lib'); - my $lib_opac = $input->param('lib_opac'); - undef $lib if ($lib eq ""); # to insert NULL instead of a blank string - undef $lib_opac if ($lib_opac eq ""); # to insert NULL instead of a blank string - $sth->execute($id, $new_category, $new_authorised_value, $lib, $lib_opac, $imageurl ); - print "Content-Type: text/html\n\nparam('category')."&offset=$offset\">"; - exit; + if ( $duplicate_entry ) { + $template->param(duplicate_category => $new_category, + duplicate_value => $new_authorised_value, + else => 1); + default_form(); } } - if ( $duplicate_entry ) { - $template->param(duplicate_category => $new_category, - duplicate_value => $new_authorised_value, + else { + $template->param(rejected_category => $new_category, + rejected_value => $new_authorised_value, else => 1); default_form(); - } + } ################## DELETE_CONFIRM ################################## # called by default form, used to confirm deletion of data in DB diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt index 7e71789..8ea55eb 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt @@ -18,6 +18,29 @@