added comments for removing local customizations / reading ini file going forward
attempt to clean up whitespace and get standardized with eg code formatting asap :
perltidy cuddled else and 's/ {4}/\t/g' version
cleaning up service detection block by way of including code from atz fork
Whitespace revision, take II

perltidy can result in code formatting which is a little extreme
when left at the 80-characters-wide default, so rejoin the split
$doc->findvalue() calls which were negatively affecting
readability.

Also, Evergreen code standards is for using four spaces, not tabs,
so correct for that small mixup as well.

Signed-off-by: Dan Wells <dbw2@calvin.edu>
Comment out incomplete, unused subs

Signed-off-by: Dan Wells <dbw2@calvin.edu>
Update and fix place_simple_hold()

This commit makes the following changes to the place_simple_hold()
subroutine:
 - clarify that the patron parameter is an ID
 - use a more typical default location for the oils_header.pl file
 - use a Fieldmapper object rather than raw JSON to construct the
hold request
 - add freeze/thaw to hold process to prevent custom status issues
 - add comments where customization is likely needed

We should probably revisit the freeze/thaw process in the future,
but this at least gets us to a working state.

Signed-off-by: Dan Wells <dbw2@calvin.edu>
Clarify item_request(), add missing $U

First, we clarify the item_request() sub by:
 - adding customization notes
 - making sure we retain our custom status after hold placement
 - identifying Item vs User Agency code branches

Second, we add the common $U AppUtils variable which was missing from
the last commit.

Signed-off-by: Dan Wells <dbw2@calvin.edu>
Remove force-to-available code from check_in_item

check_in_item() currently tries to force the checked-in copy to the
"Available" status.  This seems unnecessary, and possibly damaging.

Instead, let the EG check in process set the status as it sees fit
(most often to "Reshelving").

Signed-off-by: Dan Wells <dbw2@calvin.edu>
More customization markers, and general cleanup

First, add more CUSTOMIZATION markers wherever a value likely needs
per-system configuration.

Second, clean up and clarify the code in a few places.  This includes
standardizing some variable names.  In particular, $visid and
$barcode were both used interchangeably, and this commit standardizes
on $visid for anything which isn't an actual local item barcode (i.e.
it is a fake or external system "barcode" value).

Signed-off-by: Dan Wells <dbw2@calvin.edu>
A little defensive coding around last_post.txt.

If the file doesn't exist, rather than die, try to create it.  Only
die if we fail to create it.

Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Merge pull request #3 from Dyrcona/last_post

A little defensive coding around last_post.txt.
Remove duplicate request detection

Per MeLCat staff 2013-07-26, duplicate request detection is no
longer needed, and can cause its own problems. It should be removed.

This commit removes the duplicate NCIP message detection.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Avoid referencing nonexistent AgencyId vars

In fail() and do_user_lookup_error_stanza(), we were attempting to
call staff_log() with values for FromAgencyId and ToAgencyId using
variables which did not exist.

Also, in fail() we were attempting to use those same variables in
the creation of an XML NCIP response.

The above issues would result in "Use of uninitialized value"
warnings, as well preventing use of "use strict".

This commit removes the references to the nonexistent variables,
resulting in the same log and xml output.

A future commit may provide a means for these functions to log the
FromAgencyId and ToAgencyId.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix ref. to nonexistent $visid, clarify terms

The XML for NCIP message RenewItemResponse was being constructed
with a nonexistent variable $visid, resulting in warnings and no
content in the ItemIdentifierValue element.

When processing a RenewItem message in renew_item(), we are
referencing the item by its UniqueItemId, so in addition to fixing
the nonexistent variable issue, this commit adjusts the variable
names for clarity.

Log output is also changed.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix nonexistent variables in ItemReceivedResponse

When creating an NCIP ItemReceivedResponse message, nonexistent
variables were being referenced, resulting in warnings and empty
values for the following elements in ResponseHeader:

FromAgencyId/UniqueAgencyId/Scheme
ToAgencyId/UniqueAgencyId/Scheme
ToAgencyId/UniqueAgencyId/Value

This commit populates the variables $faidScheme, $taidScheme, and
$taidValie in a manner similar to other locations in the code,
silencing the warnings and causing the elements in question to
contain data.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
use strict;

Having eliminated a number of issues with nonexistent variables being
referenced, we can now enable the "use strict" pragma.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Begin to break config out into ini file

Begin to migrate from hardcoded variables to a configuration file.

Copy the example iNCIPit.ini-example file to iNCIPit.ini and make
your changes there.

At this point, only the username and password are moved to a config
file.

This commit introduces a new dependency on Config::Tiny

SECURITY NOTE:
You will want to take steps to protect your configuration file, and
ensure that it is NOT accessible via the web server.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add support for source IP auth behind a proxy

When using a proxy in front of your web server(s), the web server
sees the IP address of the proxy, and not the actual IP address of
the client making the requests.

This prevents you from using standard Apache directives to limit
access to a set of specific source IP addresses. While there are
Apache modules available that can help in this situation, we also
have the option of performing the access control within iNCIPit
itself.

This commit adds support for relying on the X-Forwarded-For HTTP
header to determine the actual IP of the client.

SECURITY NOTE: Your proxy MUST set/modify the X-Forwarded-For HTTP
header for this feature to work. If your proxy passes the header
unmodified, not only will your authorized clients likely be unable
to access the script, but unauthorized clients can easily spoof the
header to gain access.

To use, in the [access] section of iNCIPit.ini:

- set load_balancer_ip to the IP of your proxy
- set allowed_client_ips to a comma-delimited list of authorized IP
  addresses

If your proxy speaks to your backend servers via HTTP, you will also
need to set permit_plaintext to "yes" (case insensitive).  You must
then rely on your proxy to enforce the use of HTTPS, or trust your
authorized clients to always use HTTPS.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Whitespace cleanup.

Whitespace cleanup -- replace stray tabs.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix syntax error

Fix syntax error: ~= != =~

Signed-off-by: Jeff Godin <jgodin@tadl.org>