From f3a9cd72d34fb986e18973fc4653ece95d612d0a Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 25 Feb 2014 10:53:36 +0100 Subject: [PATCH] Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed If a user pass '&batch=1' to the url, he was allowed to access to the batch checkout page even if the patron is not in an authorised category. This patch also fixes the link to "Batch check out" from the "Details" tab (cf changes in circ-menu.inc). --- circ/circulation.pl | 23 ++++++++++++++------ .../intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- .../en/modules/circ/circulation_batch_checkouts.tt | 4 +++- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/circ/circulation.pl b/circ/circulation.pl index 1247d51..fd17f13 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -85,7 +85,6 @@ if (!C4::Context->userenv && !$branch){ } my $barcodes = []; -my $batch = $query->param('batch'); if ( my $barcode = $query->param('barcode') ) { $barcodes = [ $barcode ]; } else { @@ -105,9 +104,21 @@ if ( my $barcode = $query->param('barcode') ) { $barcodes = [ uniq @$barcodes ]; -my $template_name = $batch - ? q|circ/circulation_batch_checkouts.tt| - : q|circ/circulation.tt|; +my $template_name = q|circ/circulation.tt|; +my $borrower; +my $borrowernumber = $query->param('borrowernumber'); +my $batch = $query->param('batch'); +my $batch_allowed = 0; +if ( $batch ) { + $template_name = q|circ/circulation_batch_checkouts.tt|; + my @batch_category_codes = split '\|', C4::Context->preference('batch_checkouts'); + $borrower = GetMemberDetails( $borrowernumber, 0 ); + if ( grep {/^$borrower->{categorycode}$/} @batch_category_codes ) { + $batch_allowed = 1; + } else { + $barcodes = []; + } +} my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( { @@ -131,7 +142,6 @@ for (@failedreturns) { $return_failed{$_} = 1; } my $findborrower = $query->param('findborrower') || q{}; $findborrower =~ s|,| |g; -my $borrowernumber = $query->param('borrowernumber'); $branch = C4::Context->userenv->{'branch'}; $printer = C4::Context->userenv->{'branchprinter'}; @@ -246,9 +256,7 @@ if ($findborrower) { } # get the borrower information..... -my $borrower; if ($borrowernumber) { - $borrower = GetMemberDetails( $borrowernumber, 0 ); my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); # Warningdate is the date that the warning starts appearing @@ -799,6 +807,7 @@ $template->param( CGIorganisations => $CGIorganisations, is_child => ($borrower->{'category_type'} eq 'C'), $view => 1, + batch_allowed => $batch_allowed, soundon => C4::Context->preference("SoundOn"), fast_cataloging => $fast_cataloging, CircAutoPrintQuickSlip => C4::Context->preference("CircAutoPrintQuickSlip"), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc index c341015..266c307 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc @@ -65,7 +65,7 @@