From b63d4f0fed435c23dc8e3f601b7bd33849a04b18 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 25 Feb 2014 10:53:36 +0100 Subject: [PATCH] Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed If a user pass '&batch=1' to the url, he was allowed to access to the batch checkout page even if the patron is not in an authorised category. This patch also fixes the link to "Batch check out" from the "Details" tab (cf changes in circ-menu.inc). --- circ/circulation.pl | 21 ++++++++++++++------ .../intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- .../en/modules/circ/circulation_batch_checkouts.tt | 4 +++- 3 files changed, 19 insertions(+), 8 deletions(-) diff --git a/circ/circulation.pl b/circ/circulation.pl index 2b12a00..4d8a89b 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -85,7 +85,6 @@ if (!C4::Context->userenv && !$branch){ } my $barcodes = []; -my $batch = $query->param('batch'); if ( my $barcode = $query->param('barcode') ) { $barcodes = [ $barcode ]; } else { @@ -105,9 +104,20 @@ if ( my $barcode = $query->param('barcode') ) { $barcodes = [ uniq @$barcodes ]; -my $template_name = $batch - ? q|circ/circulation_batch_checkouts.tt| - : q|circ/circulation.tt|; +my $template_name = q|circ/circulation.tt|; +my $borrowernumber = $query->param('borrowernumber'); +my $borrower = $borrowernumber ? GetMember( borrowernumber => $borrowernumber ) : undef; +my $batch = $query->param('batch'); +my $batch_allowed = 0; +if ( $batch ) { + $template_name = q|circ/circulation_batch_checkouts.tt|; + my @batch_category_codes = split '\|', C4::Context->preference('batch_checkouts'); + if ( grep {/^$borrower->{categorycode}$/} @batch_category_codes ) { + $batch_allowed = 1; + } else { + $barcodes = []; + } +} my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( { @@ -131,7 +141,6 @@ for (@failedreturns) { $return_failed{$_} = 1; } my $findborrower = $query->param('findborrower') || q{}; $findborrower =~ s|,| |g; -my $borrowernumber = $query->param('borrowernumber'); $branch = C4::Context->userenv->{'branch'}; $printer = C4::Context->userenv->{'branchprinter'}; @@ -245,7 +254,6 @@ if ($findborrower) { } # get the borrower information..... -my $borrower; if ($borrowernumber) { $borrower = GetMemberDetails( $borrowernumber, 0 ); my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); @@ -777,6 +785,7 @@ $template->param( inprocess => $inprocess, is_child => ($borrower->{'category_type'} eq 'C'), $view => 1, + batch_allowed => $batch_allowed, soundon => C4::Context->preference("SoundOn"), fast_cataloging => $fast_cataloging, CircAutoPrintQuickSlip => C4::Context->preference("CircAutoPrintQuickSlip"), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc index f619c36..689d5b0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc @@ -65,7 +65,7 @@