From 57466e36b7677bcbfcf496cbbe645615d6a7cc16 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 22 Nov 2021 07:39:52 +0000 Subject: [PATCH] Bug 29542: Check permission to view list in sendshelf Content-Type: text/plain; charset=utf-8 Test plan: Find a (private) list that you should not be able to view. Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number] You should see an error message. (Which could surely be improved on another report.) Signed-off-by: Marcel de Rooy --- virtualshelves/sendshelf.pl | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/virtualshelves/sendshelf.pl b/virtualshelves/sendshelf.pl index bc47249744..6543034215 100755 --- a/virtualshelves/sendshelf.pl +++ b/virtualshelves/sendshelf.pl @@ -66,7 +66,15 @@ if ($to_address) { ); my $shelf = Koha::Virtualshelves->find( $shelfid ); - my $contents = $shelf->get_contents; + my $contents; + if( $shelf && $shelf->can_be_viewed($borrowernumber) ) { + $contents = $shelf->get_contents; + } else { + $template->param( error => 1, email => $to_address ); + output_html_with_http_headers $query, $cookie, $template->output; + exit; + } + my $marcflavour = C4::Context->preference('marcflavour'); my $iso2709; my @results; -- 2.20.1