]> git.evergreen-ils.org Git - Evergreen.git/blob - Open-ILS/src/templates/opac/parts/place_hold.tt2
LP#1671635: escape some values to avoid XSS
[Evergreen.git] / Open-ILS / src / templates / opac / parts / place_hold.tt2
1 [%  PROCESS "opac/parts/misc_util.tt2";
2     PROCESS "opac/parts/hold_error_messages.tt2";
3     PROCESS "opac/parts/metarecord_hold_filters.tt2";
4 %]
5 <script>
6 // Toggle the activation date input and check the suspend checkbox.
7 // If JavaScript is disabled, the CSS will handle the former, but
8 // the latter will not happen.
9 function toggleActivationDate() {
10     var cb = document.getElementById("hold_suspend");
11     var block = document.getElementById("toggled-block-suspend");
12     var anchor = document.getElementById("actDateToggle");
13     var actText = "[%- l('Hide activation date') -%]";
14     var inActText = "[%- l('Set activation date') -%]";
15     // Check for not equal to block so it works on first click.
16     if (block.style.display != "block") {
17         block.style.display = "block";
18         anchor.innerHTML = actText;
19         if (cb.checked != true) cb.checked = true;
20     } else {
21         block.style.display = "none";
22         anchor.innerHTML = inActText;
23     }
24     // Prevent the href from being followed, thus overriding the CSS.
25     return false;
26 }
27 </script>
28 <div id='holds_box' class='canvas' style='margin-top: 6px;'>
29     <h1>[% l('Place Hold') %]</h1>
30
31     [% some_holds_allowed = -1 %]
32
33     <!-- loop through the holds and display status of request where appropriate -->
34         [% FOR hdata IN ctx.hold_data;
35             attrs = {marc_xml => hdata.marc_xml};
36             PROCESS get_marc_attrs args=attrs;
37             this_hold_disallowed = 0;
38
39             IF CGI.param('hold_type') == 'M';
40               IF hdata.metarecord_filters.formats.size == 0;
41                 this_hold_disallowed = 1;
42                 # if this is the first hold and it's disallowed,
43                 # assume all holds are, until we proven otherwise
44                 SET some_holds_allowed = 0 IF some_holds_allowed == -1;
45               ELSE; some_holds_allowed = 1; END;
46             END %]
47       
48     <form method="post" name="PlaceHold" onsubmit="return validateHoldForm()" >
49         <input type="hidden" name="hold_type" value="[% CGI.param('hold_type') | html %]" />
50         [%  
51             redirect = CGI.param('hold_source_page') || CGI.param('redirect_to') || CGI.referer;
52             # since we have to be logged in to get this far, return to a secure page
53             redirect = redirect.replace('^http:', 'https:') 
54         %]
55         <input type="hidden" name="redirect_to" value="[% redirect | html %]" />
56         <input type="hidden" name="hold_source_page" value="[% CGI.param('hold_source_page') | html %]" />
57
58         <!-- Adding hidden fields so that parameters are maintained in
59         searchbar throughout the place hold process. -->
60         <input type="hidden" name="locg" value="[% CGI.param('locg') | html %]" />
61         <input type="hidden" name="qtype" value="[% CGI.param('qtype') | html %]" />
62         <input type="hidden" name="query" value="[% CGI.param('query') | html %]" />
63         [%
64             usr_barcode = CGI.param('usr_barcode') | html;
65             is_requestor = CGI.param('is_requestor');
66
67            IF is_requestor == '';
68                is_requestor = '0';
69            END;
70
71            IF is_requestor == '0' && usr_barcode == ctx.staff_recipient.card.barcode;
72                usr_barcode = '';
73            END;
74         %]
75
76         [% IF ctx.is_staff %]
77         <p class="staff-hold">
78             <input type="radio" id="hold_usr_is_requestor_not"
79                 onchange="staff_hold_usr_input_disabler(this);"
80                 name="hold_usr_is_requestor" value="0"
81                 />
82             <label for="hold_usr_is_requestor_not">
83                 [% l("Place hold for patron by barcode:") %]
84             </label>
85             <input type="text" name="hold_usr" id="hold_usr_input" 
86               value="[% usr_barcode | html %]" 
87               onchange="staff_hold_usr_barcode_changed();" 
88               onpaste="setTimeout(staff_hold_usr_barcode_changed,1);" 
89               onkeypress="return no_hold_submit(event)" autofocus /> 
90             <span id="patron_name"></span>
91             <span id="patron_usr_barcode_not_found" style="display: none">
92               [% l('Patron barcode was not found') %]
93             </span>
94             [% IF ctx.is_browser_staff %]
95             <button id="hold_usr_search" type="button" class="opac-button" style="display: none;">[% l('Patron Search') %]</button>
96             [% END %]
97             <br />
98             <input type="hidden" id="staff_barcode" 
99               value="[% ctx.staff_recipient.card.barcode | html %]"/>
100             <span>
101                 <input type="radio" id="hold_usr_is_requestor"
102                     onchange="staff_hold_usr_input_disabler(this);"
103                     name="hold_usr_is_requestor" value="1" />
104                 <label for="hold_usr_is_requestor">
105                     [% l("Place this hold for me ([_1] [_2])", ctx.user.first_given_name, ctx.user.family_name) | html %]
106                 </label>
107             </span>
108         </p>
109         [% END %]
110
111         <table id='hold-items-list'>
112             <tr>
113                 <td>
114                     [% IF !this_hold_disallowed %]
115                     <input type="hidden" name="hold_target" value="[% hdata.target.id | html %]" />
116                     [% END %]
117                     <div class='hold-items-list-title'>
118                                             <!-- If hold is for grouped formats/editions (metarecord), show short title - else, show complete title --> 
119                                             [% IF CGI.param('hold_type') == 'M' %]
120                                                     [% attrs.title | html %]
121                                                 [% ELSE %]
122                                                     [% attrs.title_extended | html %]
123                                                 [% END %]
124                     </div>
125                     [% IF hdata.parts AND !this_hold_disallowed %]
126                         [% IF hdata.parts.size > 0 %]
127                         <div class='hold-div'>
128                             [% IF enable.radio.parts == 'true' %]
129                                 <span class='hold-span'><label for='select_hold_part'>[%
130                                l('Select a Part:')
131                                %]</label></span>
132                              <div class='radio-parts-selection'>
133                              [% IF !hdata.part_required %]
134                                 <span class='parts-radio-option'>
135                                  <input type='radio' name='part' value='' required>[% l('All Parts') %]</span>
136                               [% END %]
137                                [% FOR part IN hdata.parts %]
138                                  <span class='parts-radio-option'><input type='radio' name='part' id=[% part.id %] value=[% part.id %] required>
139                                   <label for=[% part.id %]>[% part.label | html %]</label></span>
140                               [% END %]
141                               </div>
142                           [% ELSE %]
143                             <span style='font-weight: bold;'><label for='select_hold_part'>[%
144                                 hdata.part_required ? l('Select a Part:') : l('Select a Part (optional):')
145                             %]</label></span>
146                             <select id='select_hold_part' name='part'>
147                                 [% IF !hdata.part_required %]
148                                 <option selected='selected' value=''>[% l('- All Parts -') %]</option>
149                                 [% END %]
150                                 [% FOR part IN hdata.parts %]
151                                 <option value='[% part.id %]'>[% part.label | html %]</option>
152                                 [% END %]
153                             </select>
154                           [% END %]
155                         </div>
156                         [% ELSE %]
157                         <input type='hidden' name='part' value=''/>
158                         [% END %]
159                     [% END %]
160                     [% IF NOT metarecords.disabled %]
161                         [% IF CGI.param('hold_type') == 'T' AND hdata.record.metarecord AND !hdata.part_required %]
162                         <!-- Grab the bre_id so that we can restore it if user accidentally clicks advanced options -->
163                            [% bre_id = hdata.target.id %]
164                             <a  id='advanced_hold_link'
165                                 href="[% mkurl('', {hold_type => 'M', hold_target => hdata.record.metarecord.id, bre_id => bre_id}) %]">
166                                 [% l('Advanced Hold Options') %]</a>
167                         [% END %]
168                         [% IF CGI.param('hold_type') == 'M' AND CGI.param('bre_id') %]
169                             <input type="hidden" name="bre_id" value="[% CGI.param('bre_id') %]" />
170                             <a id='basic_hold_link'
171                                href="[% mkurl('', {hold_target => CGI.param('bre_id'), hold_type => 'T'}) %]">
172                                 [% l('Basic Hold Options') %]</a>
173                         [% END %]
174                         [% IF hdata.metarecord_filters.formats.size OR # should this be size > 1
175                             (hdata.metarecord_filters.langs.size && hdata.metarecord_filters.langs.size > 1);
176                             PROCESS metarecord_hold_filters_selector hold_data=hdata;
177                         END;
178                     END %]
179                 </td>
180             </tr>
181
182             [% IF this_hold_disallowed %]
183               <tr><td>
184                 <div class="mr_holds_no_formats">
185                 [% l('This item does not have any formats available for holds placement') %]
186                 </div>
187               </td></tr>
188             [% END %]
189
190             [%  IF !loop.last AND ctx.hold_data.size > 1 %]
191             <tr class="holds_item_row_separator"><td> </td></tr>
192             [% END %]
193
194         [% END %]
195         </table>
196
197         [% IF some_holds_allowed %]
198
199         <p>
200             [%- org_select_id = 'pickup_lib'; -%]
201             <label for="[% org_select_id %]">[%l('Pickup location:') %]</label>
202             [% PROCESS "opac/parts/org_selector.tt2";
203                 INCLUDE build_org_selector name='pickup_lib' 
204                     value=ctx.default_pickup_lib id=org_select_id 
205                     can_have_vols_only=1 hold_pickup_lib=1 %]
206         </p>
207         <p>
208             [% l('Notify when hold is ready for pickup?') %]
209             <blockquote>
210                 <input class="hold-alert-method" type="checkbox" id="email_notify" name="email_notify" value="t"
211                     [% IF !ctx.user.email %]disabled="true"[% ELSIF ctx.default_email_notify %]checked="checked"[% END %]/>
212                     <label for="email_notify">[% l('Yes, by Email') %]</label><br/>
213                 <blockquote>
214                     [% IF !ctx.user.email and !ctx.is_staff; l('No configured Email address. See "My Account" for setting your Email address.');
215                      ELSE; l('Email Address:') %] <span name="email_address">[% ctx.user.email %]</span>[% END %]
216                 </blockquote>
217                 [%- IF allow_phone_notifications == 'true' %]
218                 <input class="hold-alert-method" type="checkbox" id="phone_notify_checkbox" name="phone_notify_checkbox"
219                     [% IF ctx.default_phone_notify %]checked="checked"[% END %]/>
220                     <label for="phone_notify_checkbox">[% l('Yes, by Phone') %]</label><br/>
221                 <blockquote>
222                     <label>[% l('Phone Number:') %]<input type="text" name="phone_notify" [% setting = 'opac.default_phone';
223                     IF ctx.user_setting_map.$setting; %] value='[% ctx.user_setting_map.$setting | html %]'
224                     [%- ELSIF ctx.user.day_phone; %] value='[% ctx.user.day_phone | html %]' [% END %]/></label>
225                 </blockquote>
226                 [%- END -%]
227                 [% IF ctx.get_org_setting(ctx.search_ou, 'sms.enable') == 1 %]
228                 <input class="hold-alert-method" type="checkbox" id="sms_notify_checkbox" name="sms_notify_checkbox"
229                     [% IF ctx.default_sms_notify %]checked="checked"[% END %]/>
230                     <label for="sms_notify_checkbox">[% l('Yes, by Text Messaging') %]</label><br/>
231                 <blockquote>
232                     [% INCLUDE "opac/parts/sms_carrier_selector.tt2" %]<br/>
233                     [% INCLUDE "opac/parts/sms_number_textbox.tt2" %]<br/>
234                 </blockquote>
235                 [% END %]
236             </blockquote>
237             <blockquote>
238                 [% IF ctx.hold_data.size == 1;
239                        l('Suspend this hold?');
240                    ELSE;
241                        l('Suspend these holds?');
242                    END %]
243                 <img src="[% ctx.media_prefix %]/images/question-mark.png[% ctx.cache_key %]"
244                      alt="[% l('Suspend Hold Help') %]"
245                      title="[% l('A suspended hold will retain its place in the queue, but will not be fulfilled until it has been activated.') %]" />
246                 <br/>
247                 <input type="checkbox" name="hold_suspend" id="hold_suspend" value="t"/> [% l('Yes') %]
248                 <a id="actDateToggle" href="#toggled-block-suspend" onclick="return toggleActivationDate();">[% l('Set activation date') %]</a>
249             </blockquote>
250             <blockquote id="toggled-block-suspend">
251                 <label for="thaw_date">[% l('Activate on') %]</label>
252                 <input type="text" id="thaw_date" name="thaw_date" />
253                 <em>[% l('Enter date in MM/DD/YYYY format') %]</em>
254             </blockquote>
255         </p>
256         <input id="place_hold_submit" type="submit" name="submit" 
257             value="[% l('Submit') %]" title="[% l('Submit') %]"
258             alt="[% l('Submit') %]" class="opac-button" />
259         [% END # some_holds_allowed %]
260         <input type="reset" name="cancel" onclick="window.location='[% redirect | html %]'" value="[% l('Cancel') %]" id="holds_cancel" class="opac-button" />
261     </form>
262 </div>
263