slims · nalamapu · Apr 12, 2021 · Jun 23, 2021 · Jun 24, 2021 · Jun 24, 2021
diff --git a/.htaccess b/.htaccess
@@ -6,6 +6,13 @@
   Order allow,deny
 </FilesMatch>
 
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    # Protect hidden directory from vulnerability scanner
+    RewriteRule (^|/)\.([^/]+)(/|$) - [L,F]
+    RewriteRule (^|/)([^/]+)~(/|$) - [L,F]
+</IfModule>
+
 # Don't show directory listings for URLs which map to a directory.
 Options -Indexes
 

diff --git a/README.md b/README.md
@@ -11,8 +11,10 @@ SLiMS is licensed under GNU GPL version 3. Please read "GPL-3.0 License.txt"
 to learn more about GPL.
 
 ### System Requirements
-- PHP version 7.4;
+- PHP version 8.1;
 - MySQL version 5.7 and or MariaDB version 10.3;
 - PHP GD enabled
 - PHP gettext enabled
-- PHP mbstring enabled
+- PHP mbstring enabled
+- PDO MySQL enabled
+- YAZ Optional
diff --git a/admin/admin_template/akasia-dz/index_template.inc.php b/admin/admin_template/akasia-dz/index_template.inc.php
@@ -86,7 +86,15 @@
         <div class="s-user">
           <div class="s-user-frame">
             <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>" class="s-user-photo">
-              <img src="<?php echo '../lib/minigalnano/createthumb.php?filename='.IMG.'/persons/'.urlencode(urlencode($_SESSION['upict'])).'&width=200'?>" alt="Photo <?php echo $_SESSION['realname']?>">
+                <?php
+                if (filter_var($_SESSION['upict'], FILTER_VALIDATE_URL)) {
+                    $user_image_url = $_SESSION['upict'];
+                } else {
+                    $user_image = $_SESSION['upict'] && file_exists(IMGBS . 'persons/' . $_SESSION['upict']) ? $_SESSION['upict'] : 'person.png';
+                    $user_image_url = '../lib/minigalnano/createthumb.php?filename=' . IMG . '/persons/' . urlencode(urlencode($user_image)) . '&width=200';
+                }
+                ?>
+                <img src="<?= $user_image_url ?>" alt="Photo <?php echo $_SESSION['realname'] ?>">
             </a>
           </div>
           <h4 class="s-user-name"><?php echo $_SESSION['realname']?></h4>

diff --git a/admin/admin_template/akasia/index_template.inc.php b/admin/admin_template/akasia/index_template.inc.php
@@ -85,7 +85,15 @@
         <div class="s-user">
           <div class="s-user-frame">
             <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>" class="s-user-photo">
-              <img src="<?php echo '../lib/minigalnano/createthumb.php?filename='.IMG.'/persons/'.urlencode(urlencode($_SESSION['upict'])).'&width=200'?>" alt="Photo <?php echo $_SESSION['realname']?>">
+                <?php
+                if (filter_var($_SESSION['upict'], FILTER_VALIDATE_URL)) {
+                    $user_image_url = $_SESSION['upict'];
+                } else {
+                    $user_image = $_SESSION['upict'] && file_exists(IMGBS . 'persons/' . $_SESSION['upict']) ? $_SESSION['upict'] : 'person.png';
+                    $user_image_url = '../lib/minigalnano/createthumb.php?filename=' . IMG . '/persons/' . urlencode(urlencode($user_image)) . '&width=200';
+                }
+                ?>
+                <img src="<?= $user_image_url ?>" alt="Photo <?php echo $_SESSION['realname'] ?>">
             </a>
           </div>
           <h4 class="s-user-name"><?php echo $_SESSION['realname']?></h4>

diff --git a/admin/admin_template/default/index_template.inc.php b/admin/admin_template/default/index_template.inc.php
@@ -34,8 +34,8 @@
     <script type="text/javascript" src="<?php echo JWB; ?>jquery.imgareaselect/scripts/jquery.imgareaselect.pack.js"></script>
     <script type="text/javascript" src="<?php echo JWB; ?>webcam.js"></script>
     <script type="text/javascript" src="<?php echo JWB; ?>scanner.js"></script>
-    <script type="text/javascript" src="<?php echo SWB; ?>js/bootstrap.min.js"></script>
     <script type="text/javascript" src="<?php echo SWB; ?>js/popper.min.js"></script>
+    <script type="text/javascript" src="<?php echo SWB; ?>js/bootstrap.min.js"></script>
     <script type="text/javascript" src="<?php echo JWB; ?>toastr/toastr.min.js"></script>
     <script type="text/javascript" src="<?php echo $sysconf['admin_template']['dir'].'/'.$sysconf['admin_template']['theme']; ?>/js/smooth-scrollbar.js"></script>
     <script type="text/javascript" src="<?php echo $sysconf['admin_template']['dir'].'/'.$sysconf['admin_template']['theme']; ?>/js/overscroll.js"></script>
@@ -64,7 +64,15 @@
     <div class="s-user" id="profile">
         <div class="s-user-frame">
             <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>" class="s-user-photo subMenuItem">
-                <img src="<?php echo '../lib/minigalnano/createthumb.php?filename='.IMG.'/persons/'.urlencode(urlencode($_SESSION['upict'])).'&width=200'?>" alt="Photo <?php echo $_SESSION['realname']?>">
+                <?php
+                if (filter_var($_SESSION['upict'], FILTER_VALIDATE_URL)) {
+                    $user_image_url = $_SESSION['upict'];
+                } else {
+                    $user_image = $_SESSION['upict'] && file_exists(IMGBS . 'persons/' . $_SESSION['upict']) ? $_SESSION['upict'] : 'person.png';
+                    $user_image_url = '../lib/minigalnano/createthumb.php?filename=' . IMG . '/persons/' . urlencode(urlencode($user_image)) . '&width=200';
+                }
+                ?>
+                <img src="<?= $user_image_url ?>" alt="Photo <?php echo $_SESSION['realname'] ?>">
             </a>
         </div>
         <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>">

diff --git a/admin/admin_template/nightmode/index_template.inc.php b/admin/admin_template/nightmode/index_template.inc.php
@@ -60,7 +60,15 @@
     <div class="s-user" id="profile">
         <div class="s-user-frame">
             <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>" class="s-user-photo subMenuItem">
-                <img src="<?php echo '../lib/minigalnano/createthumb.php?filename='.IMG.'/persons/'.urlencode(urlencode($_SESSION['upict'])).'&width=200'?>" alt="Photo <?php echo $_SESSION['realname']?>">
+                <?php
+                if (filter_var($_SESSION['upict'], FILTER_VALIDATE_URL)) {
+                    $user_image_url = $_SESSION['upict'];
+                } else {
+                    $user_image = $_SESSION['upict'] && file_exists(IMGBS . 'persons/' . $_SESSION['upict']) ? $_SESSION['upict'] : 'person.png';
+                    $user_image_url = '../lib/minigalnano/createthumb.php?filename=' . IMG . '/persons/' . urlencode(urlencode($user_image)) . '&width=200';
+                }
+                ?>
+                <img src="<?= $user_image_url ?>" alt="Photo <?php echo $_SESSION['realname'] ?>">
             </a>
         </div>
         <a href="<?php echo MWB.'system/app_user.php?changecurrent=true&action=detail'; ?>">

diff --git a/admin/index.php b/admin/index.php
@@ -70,9 +70,10 @@
     # ADV LOG SYSTEM - STIIL EXPERIMENTAL
     $log = new AlLibrarian('1101', array("username" => $_SESSION['uname'], "uid" => $_SESSION['uid'], "realname" => $_SESSION['realname'], "module" => $current_module));
     // get content of module default content with AJAX
+    $default_menu = $module->getFirstMenu($current_module)[1] ?? AWB . 'default/home.php';
     $sysconf['page_footer'] .= "\n"
         .'<script type="text/javascript">'
-        .'jQuery(document).ready(function() { jQuery(\'#mainContent\').simbioAJAX(\''.MWB.$current_module.'/index.php\', {method: \'get\'}); });'
+        .'jQuery(document).ready(function() { jQuery(\'#mainContent\').simbioAJAX(\''.$default_menu.'\', {method: \'get\'}); });'
         .'</script>';
 } else {
     include 'default/home.php';

diff --git a/admin/logout.php b/admin/logout.php
@@ -30,6 +30,8 @@
 // start the session
 require SB.'admin/default/session.inc.php';
 
+if(!isset($_SESSION['uid'])) header('location: ../index.php');
+
 // write log
 utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'system', $_SESSION['realname'].' Log Out from application from address '.$_SERVER['REMOTE_ADDR']);
 # ADV LOG SYSTEM - STIIL EXPERIMENTAL

diff --git a/admin/modules/bibliography/File/MARC.php b/admin/modules/bibliography/File/MARC.php
@@ -40,14 +40,14 @@
  */
 
 require_once 'PEAR/Exception.php';
-require_once 'File/MARCBASE.php';
-require_once 'File/MARC/Record.php';
-require_once 'File/MARC/Field.php';
-require_once 'File/MARC/Control_Field.php';
-require_once 'File/MARC/Data_Field.php';
-require_once 'File/MARC/Subfield.php';
-require_once 'File/MARC/Exception.php';
-require_once 'File/MARC/List.php';
+require_once MDLBS . 'bibliography/File/MARCBASE.php';
+require_once MDLBS . 'bibliography/File/MARC/Record.php';
+require_once MDLBS . 'bibliography/File/MARC/Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Control_Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Data_Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Subfield.php';
+require_once MDLBS . 'bibliography/File/MARC/Exception.php';
+require_once MDLBS . 'bibliography/File/MARC/List.php';
 
 // {{{ class File_MARC
 /**
@@ -169,7 +169,7 @@ function __construct($source, $type = self::SOURCE_FILE, $record_class = null)
 
         case self::SOURCE_STRING:
             $this->type = self::SOURCE_STRING;
-            $this->source = explode(File_MARC::END_OF_RECORD, $source);
+            $this->source = explode(File_MARC::END_OF_RECORD, $source??'');
             break;
 
         default:

diff --git a/admin/modules/bibliography/File/MARC/Control_Field.php b/admin/modules/bibliography/File/MARC/Control_Field.php
@@ -123,7 +123,7 @@ function getData()
      *
      * @return bool Returns true if the field is empty, otherwise false
      */
-    function isEmpty()
+    function isEmpty():bool
     {
         return ($this->data) ? false : true;
     }

diff --git a/admin/modules/bibliography/File/MARC/Data_Field.php b/admin/modules/bibliography/File/MARC/Data_Field.php
@@ -400,7 +400,7 @@ function getSubfields($code = null, $pcre = null)
      *
      * @return bool Returns true if the field is empty, otherwise false
      */
-    function isEmpty()
+    function isEmpty():bool
     {
         // If $this->subfields is null, we must have deleted it
         if (!$this->subfields) {

diff --git a/admin/modules/bibliography/File/MARC/Field.php b/admin/modules/bibliography/File/MARC/Field.php
@@ -36,7 +36,7 @@
  * @link      http://pear.php.net/package/File_MARC
  */
 
-require_once 'File/MARC/List.php';
+require_once MDLBS . 'bibliography/File/MARC/List.php';
 
 // {{{ class File_MARC_Field extends File_MARC_List
 /**
@@ -133,7 +133,7 @@ function setTag($tag)
      *
      * @return bool Returns true if the field is empty, otherwise false
      */
-    function isEmpty()
+    function isEmpty():bool
     {
         if ($this->getTag()) {
             return false;

diff --git a/admin/modules/bibliography/File/MARC/Lint.php b/admin/modules/bibliography/File/MARC/Lint.php
@@ -35,7 +35,7 @@
  * @version   CVS: $Id: Record.php 308146 2011-02-08 20:36:20Z dbs $
  * @link      http://pear.php.net/package/File_MARC
  */
-require_once 'File/MARC/Lint/CodeData.php';
+require_once MDLBS . 'bibliography/File/MARC/Lint/CodeData.php';
 require_once 'Validate/ISPN.php';
 
 // {{{ class File_MARC_Lint

diff --git a/admin/modules/bibliography/File/MARC/List.php b/admin/modules/bibliography/File/MARC/List.php
@@ -93,7 +93,7 @@ class File_MARC_List extends SplDoublyLinkedList
      *
      * @return string returns the tag or code
      */
-    function key()
+    function key():int
     {
         if ($this->current() instanceof File_MARC_Field) {
             return $this->current()->getTag();

diff --git a/admin/modules/bibliography/File/MARC/Subfield.php b/admin/modules/bibliography/File/MARC/Subfield.php
@@ -237,7 +237,7 @@ function setPosition($pos)
     function isEmpty()
     {
         // There is data
-        if (strlen($this->data)) {
+        if (strlen($this->data??'')) {
             return false;
         }
 

diff --git a/admin/modules/bibliography/File/MARCBASE.php b/admin/modules/bibliography/File/MARCBASE.php
@@ -38,7 +38,7 @@
  * @example   marc_yaz.php Pretty print a MARC record retrieved through the PECL yaz extension
  */
 
-require_once 'File/MARC/Record.php';
+require_once MDLBS . 'bibliography/File/MARC/Record.php';
 
 // {{{ class File_MARCBASE
 /**

diff --git a/admin/modules/bibliography/File/MARCXML.php b/admin/modules/bibliography/File/MARCXML.php
@@ -39,15 +39,15 @@
  */
 
 require_once 'PEAR/Exception.php';
-require_once 'File/MARCBASE.php';
-require_once 'File/MARC.php';
-require_once 'File/MARC/Record.php';
-require_once 'File/MARC/Field.php';
-require_once 'File/MARC/Control_Field.php';
-require_once 'File/MARC/Data_Field.php';
-require_once 'File/MARC/Subfield.php';
-require_once 'File/MARC/Exception.php';
-require_once 'File/MARC/List.php';
+require_once MDLBS . 'bibliography/File/MARCBASE.php';
+require_once MDLBS . 'bibliography/File/MARC.php';
+require_once MDLBS . 'bibliography/File/MARC/Record.php';
+require_once MDLBS . 'bibliography/File/MARC/Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Control_Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Data_Field.php';
+require_once MDLBS . 'bibliography/File/MARC/Subfield.php';
+require_once MDLBS . 'bibliography/File/MARC/Exception.php';
+require_once MDLBS . 'bibliography/File/MARC/List.php';
 
 // {{{ class File_MARCXML
 /**

diff --git a/admin/modules/bibliography/biblio.inc.php b/admin/modules/bibliography/biblio.inc.php
@@ -89,8 +89,9 @@ public function getRecords($criteria = '', $offset = 0, $total = 10000)
       die();
       return false;
     } else {
+      $this->records = [];
       while ($record = $_q->fetch_assoc()) {
-        $this->records[] = $record;
+          $this->records[] = $record;
       }
       // free the memory
       $_q->free_result();

diff --git a/admin/modules/bibliography/import.php b/admin/modules/bibliography/import.php
@@ -164,7 +164,7 @@
 
               // first field is header
               if (isset($_POST['header']) && $n < 1) {
-                  $n++;
+                  $n++; continue;
               } else {
                 // send query
                 $dbs->query($sql_str);
@@ -246,7 +246,7 @@
     <h2><?php echo __('Import Tool'); ?></h2>
     </div>
     <div class="infoBox">
-    <?php echo __('Import for bibliographics data from CSV file. For guide on CVS fields order and format please refer to documentation or visit <a href="http://slims.web.id" target="_blank">Official Website</a>'); ?>
+    <?php echo __('Import for bibliographics data from CSV file. For guide on CSV fields order and format please refer to documentation or visit <a href="http://slims.web.id" target="_blank">Official Website</a>'); ?>
 	</div>
 </div>
 </div>
@@ -294,4 +294,4 @@
     let fileName = $(this).val().replace(/\\/g, '/').replace(/.*\//, '');
     $(this).parent('.custom-file').find('.custom-file-label').text(fileName);
 });
-</script>
+</script>
diff --git a/admin/modules/bibliography/index.php b/admin/modules/bibliography/index.php
@@ -226,17 +226,25 @@ function getimagesizefromstring($string_data)
             $image_upload->setAllowableFormat($sysconf['allowed_images']);
             $image_upload->setMaxSize($sysconf['max_image_upload'] * 1024);
             $image_upload->setUploadDir(IMGBS . 'docs');
+
+            $img_title = $data['title'].'_'.date("YmdHis");
+            if(strlen($data['title']) > 70){
+                $img_title = substr($data['title'], 0, 70).'_'.date("YmdHis");
+            }
+
+            $new_filename = strtolower('cover_'. preg_replace("/[^a-zA-Z0-9]+/", "-", $img_title));
             // upload the file and change all space characters to underscore
-            $img_upload_status = $image_upload->doUpload('image', preg_replace('@\s+@i', '_', $_FILES['image']['name']));
+            $img_upload_status = $image_upload->doUpload('image', $new_filename);
             if ($img_upload_status == UPLOAD_SUCCESS) {
                 $data['image'] = $dbs->escape_string($image_upload->new_filename);
                 // write log
                 utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'bibliography', $_SESSION['realname'] . ' upload image file ' . $image_upload->new_filename);
                 utility::jsToastr('Bibliography', __('Image Uploaded Successfully'), 'success');
             } else {
                 // write log
+                $data['image'] = NULL;
                 utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'bibliography', 'ERROR : ' . $_SESSION['realname'] . ' FAILED TO upload image file ' . $image_upload->new_filename . ', with error (' . $image_upload->error . ')');
-                utility::jsToastr('Bibliography', __('Image Uploaded Failed'), 'error');
+                utility::jsToastr('Bibliography', __('Image Uploaded Failed').'<br/>'.$image_upload->error, 'error');
             }
         } else if (!empty($_POST['base64picstring'])) {
             list($filedata, $filedom) = explode('#image/type#', $_POST['base64picstring']);
@@ -261,6 +269,13 @@ function getimagesizefromstring($string_data)
             if ($sysconf['log']['biblio']) {
                 $_prevrawdata = api::biblio_load($dbs, $_POST['updateRecordID']);
             }
+
+            // Remove previous popular biblio data from cache if opac use default template
+            if ($sysconf['template']['theme'] == 'default' && $_POST['opacHide'] != $_POST['opacHideOrigin']) {
+                require SB . 'api/v1/helpers/Cache.php';
+                Cache::destroy('biblio_popular');
+            }
+
             /* UPDATE RECORD MODE */
             // remove input date
             unset($data['input_date']);
@@ -1063,6 +1078,7 @@ function affectedDetail($obj_db, $array_data)
     // biblio hide from opac
     $hide_options[] = array('0', __('Show'));
     $hide_options[] = array('1', __('Hide'));
+    $form->addHidden('opacHideOrigin', $rec_d['opac_hide']??0);
     $form->addRadio('opacHide', __('Hide in OPAC'), $hide_options, isset($rec_d['opac_hide']) && $rec_d['opac_hide'] ? '1' : '0');
     // biblio promote to front page
     $promote_options[] = array('0', __('Don\'t Promote'));

diff --git a/admin/modules/bibliography/item.php b/admin/modules/bibliography/item.php
@@ -260,7 +260,7 @@
         // default biblio title and biblio ID
         $b_title = $rec_d['title'];
         $b_id = $rec_d['biblio_id'];
-        if (trim($rec_d['call_number']) == '') {
+        if (trim($rec_d['call_number']??'') == '') {
             $biblio_q = $dbs->query('SELECT call_number FROM biblio WHERE biblio_id='.$rec_d['biblio_id']);
             $biblio_d = $biblio_q->fetch_assoc();
             $rec_d['call_number'] = $biblio_d['call_number'];