Attachment #70177 for bug #15492

View | Details | Raw Unified | Return to bug 15492
Collapse All | Expand All




        );
    }

    if ( $in->{type} eq 'opac' ) {
        my $kick_out;

        if (
# If the user logged in is the SCO user and they try to go out of the SCO module,
# log the user out removing the CGISESSID cookie
               $in->{template_name} !~ m|sco/|
            && $user
            && C4::Context->preference('AutoSelfCheckID')
            && $user eq C4::Context->preference('AutoSelfCheckID')
          )
        {
            $kick_out = 1;
        }
        elsif (
# If the user logged in is the SCI user and they try to go out of the SCI module,
# kick them out unless it is SCO with a valid permission
               $in->{template_name} !~ m|sci/|
            && $user
            && haspermission( $user, { self_check => 'self_checkin_module' } )
            && !(
                $in->{template_name} =~ m|sco/| && haspermission(
                    $user, { self_check => 'self_checkout_module' }
                )
            )
          )
        {
            $kick_out = 1;
        }
    }

        if ($kick_out) {
            $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
                $in->{query} );
            $cookie = $in->{query}->cookie(
            $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} );
            my $cookie = $in->{query}->cookie(
                -name     => 'CGISESSID',
                -value    => '',
                -expires  => '',

                loginprompt => 1,
                script_name => get_script_name(),
            );

            print $in->{query}->header(
                {
                    type              => 'text/html',
                    charset           => 'utf-8',
                    cookie            => $cookie,
                    'X-Frame-Options' => 'SAMEORIGIN'
                }
              ),
              $template->output;
            safe_exit;
        }
    }

Lines 365-373 if ( C4::Context->preference('WebBasedSelfCheck') Link Here

(-)a/about.pl (-2 / +2 lines)
365	my $all_permissions = C4::Auth::get_user_subpermissions( $userid );	365	my $all_permissions = C4::Auth::get_user_subpermissions( $userid );
366	my ( $has_self_checkout_perm, $has_other_permissions );	366	my ( $has_self_checkout_perm, $has_other_permissions );
367	while ( my ( $module, $permissions ) = each %$all_permissions ) {	367	while ( my ( $module, $permissions ) = each %$all_permissions ) {
368	if ( $module eq 'circulate' ) {	368	if ( $module eq 'self_check' ) {
369	while ( my ( $permission, $flag ) = each %$permissions ) {	369	while ( my ( $permission, $flag ) = each %$permissions ) {
370	if ( $permission eq 'self_checkout' ) {	370	if ( $permission eq 'self_checkout_module' ) {
371	$has_self_checkout_perm = 1;	371	$has_self_checkout_perm = 1;
372	} else {	372	} else {
373	$has_other_permissions = 1;	373	$has_other_permissions = 1;




                [% END %]
                [% IF AutoSelfCheckPatronDoesNotHaveSelfCheckPerm %]
                    <tr><th scope="row"><b>Warning</b> </th><td>
                    The patron used for the self checkout module at the OPAC does not have the self_check => self_checkout_module permission.
                    </td></tr>
                [% END %]
                [% IF AutoSelfCheckPatronHasTooManyPerm %]
                    <tr><th scope="row"><b>Warning</b> </th><td>
                    The patron used for the self checkout module at the OPAC has too many permissions. They should only have self_check => self_checkout_module.
                    </td></tr>
                [% END %]
                [% IF warnNoTemplateCaching %]

Lines 41-47 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here

(-)a/opac/sci/sci-main.pl (-1 / +5 lines)
41	{	41	{
42	template_name => "sci/sci-main.tt",	42	template_name => "sci/sci-main.tt",
43	authnotrequired => 0,	43	authnotrequired => 0,
44	flagsrequired => { circulate => "self_checkout" },	44	flagsrequired => { self_check => 'self_checkin_module' },
45	query => $cgi,	45	query => $cgi,
46	type => "opac"	46	type => "opac"
47	}	47	}
Lines 93-96 if ( $op eq 'check_in' ) { Link Here
93	$template->param( success => \@success, errors => \@errors, checkins => 1 );	93	$template->param( success => \@success, errors => \@errors, checkins => 1 );
94	}	94	}
95		95
		96	# Make sure timeour has a reasonable value
		97	my $timeout = C4::Context->preference('SelfCheckInTimeout') // 120;
		98	$template->param( refresh_timeout => $timeout );
		99
96	output_html_with_http_headers $cgi, $cookie, $template->output, undef, { force_no_caching => 1 };	100	output_html_with_http_headers $cgi, $cookie, $template->output, undef, { force_no_caching => 1 };




use C4::Output qw(output_html_with_http_headers);

my $query = new CGI;
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
    {
        template_name   => "sco/help.tt",
        query           => $query,
        type            => "opac",
        debug           => 1,
        authnotrequired => 1,
        flagsrequired   => { self_check => "self_checkout_module" },
    }
);

if (C4::Context->preference('SelfCheckoutByLogin')) {
    $template->param(SelfCheckoutByLogin => 1);




    $query->param(-name=>'koha_login_context',-values=>['sco']);
}
$query->param(-name=>'sco_user_login',-values=>[1]);

my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
    {
        template_name   => "sco/sco-main.tt",
        authnotrequired => 0,
        flagsrequired   => { self_check => "self_checkout_module" },
        query           => $query,
        type            => "opac",
        debug           => 1,
    }
);

# Get the self checkout timeout preference, or use 120 seconds as a default
my $selfchecktimeout = 120000;

Lines 25-31 use Koha::Patron::Images; Link Here

(-)a/opac/sco/sco-patron-image.pl (-2 / +1 lines)
25	use Koha::Patrons;	25	use Koha::Patrons;
26	use Koha::Token;	26	use Koha::Token;
27		27
28	my ($query, $response) = C4::Service->init(circulate => 'self_checkout');	28	my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );
29		29
30	unless (C4::Context->preference('WebBasedSelfCheck')) {	30	unless (C4::Context->preference('WebBasedSelfCheck')) {
31	print $query->header(status => '403 Forbidden - web-based self-check not enabled');	31	print $query->header(status => '403 Forbidden - web-based self-check not enabled');
32	-

Return to bug 15492

Lines 179-218 sub get_template_and_user { Link Here

(-)a/C4/Auth.pm (-33 / +35 lines)
179	);	179	);
180	}	180	}
181		181
		182	if ( $in->{type} eq 'opac' ) {
		183	my $kick_out;
182		184
183	# If the user logged in is the SCO user and they try to go out of the SCO module, log the user out removing the CGISESSID cookie	185	if (
184	if ( $in->{type} eq 'opac' and $in->{template_name} !~ m\|sco/\| ) {	186	# If the user logged in is the SCO user and they try to go out of the SCO module,
185	if ( $user && C4::Context->preference('AutoSelfCheckID') && $user eq C4::Context->preference('AutoSelfCheckID') ) {	187	# log the user out removing the CGISESSID cookie
186	$template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} );	188	$in->{template_name} !~ m\|sco/\|
187	my $cookie = $in->{query}->cookie(	189	&& $user
188	-name => 'CGISESSID',	190	&& C4::Context->preference('AutoSelfCheckID')
189	-value => '',	191	&& $user eq C4::Context->preference('AutoSelfCheckID')
190	-expires => '',	192	)
191	-HttpOnly => 1,	193	{
192	);	194	$kick_out = 1;
193		195	}
194	$template->param(	196	elsif (
195	loginprompt => 1,	197	# If the user logged in is the SCI user and they try to go out of the SCI module,
196	script_name => get_script_name(),	198	# kick them out unless it is SCO with a valid permission
197	);	199	$in->{template_name} !~ m\|sci/\|
198	print $in->{query}->header(	200	&& $user
199	{ type => 'text/html',	201	&& haspermission( $user, { self_check => 'self_checkin_module' } )
200	charset => 'utf-8',	202	&& !(
201	cookie => $cookie,	203	$in->{template_name} =~ m\|sco/\| && haspermission(
202	'X-Frame-Options' => 'SAMEORIGIN'	204	$user, { self_check => 'self_checkout_module' }
203	}	205	)
204	),	206	)
205	$template->output;	207	)
206	safe_exit;	208	{
		209	$kick_out = 1;
207	}	210	}
208	}
209		211
210	# If the user logged in is the SCI user and they try to go out of the SCI module,	212	if ($kick_out) {
211	# log the user out removing the CGISESSID cookie	213	$template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
212	if ( $in->{type} eq 'opac' and $in->{template_name} !~ m\|sci/\| ) {	214	$in->{query} );
213	if ( $user && C4::Context->preference('AutoSelfCheckID') && $user eq C4::Context->preference('AutoSelfCheckID') ) {	215	$cookie = $in->{query}->cookie(
214	$template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} );
215	my $cookie = $in->{query}->cookie(
216	-name => 'CGISESSID',	216	-name => 'CGISESSID',
217	-value => '',	217	-value => '',
218	-expires => '',	218	-expires => '',
Lines 223-236 sub get_template_and_user { Link Here
223	loginprompt => 1,	223	loginprompt => 1,
224	script_name => get_script_name(),	224	script_name => get_script_name(),
225	);	225	);
		226
226	print $in->{query}->header(	227	print $in->{query}->header(
227	{ type => 'text/html',	228	{
		229	type => 'text/html',
228	charset => 'utf-8',	230	charset => 'utf-8',
229	cookie => $cookie,	231	cookie => $cookie,
230	'X-Frame-Options' => 'SAMEORIGIN'	232	'X-Frame-Options' => 'SAMEORIGIN'
231	}	233	}
232	),	234	),
233	$template->output;	235	$template->output;
234	safe_exit;	236	safe_exit;
235	}	237	}
236	}	238	}

Lines 238-249 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt (-2 / +2 lines)
238	[% END %]	238	[% END %]
239	[% IF AutoSelfCheckPatronDoesNotHaveSelfCheckPerm %]	239	[% IF AutoSelfCheckPatronDoesNotHaveSelfCheckPerm %]
240	<tr><th scope="row"><b>Warning</b> </th><td>	240	<tr><th scope="row"><b>Warning</b> </th><td>
241	The patron used for the self checkout module at the OPAC does not have the circulate => self_checkout permission.	241	The patron used for the self checkout module at the OPAC does not have the self_check => self_checkout_module permission.
242	</td></tr>	242	</td></tr>
243	[% END %]	243	[% END %]
244	[% IF AutoSelfCheckPatronHasTooManyPerm %]	244	[% IF AutoSelfCheckPatronHasTooManyPerm %]
245	<tr><th scope="row"><b>Warning</b> </th><td>	245	<tr><th scope="row"><b>Warning</b> </th><td>
246	The patron used for the self checkout module at the OPAC has too many permissions. They should only have circulate => self_checkout.	246	The patron used for the self checkout module at the OPAC has too many permissions. They should only have self_check => self_checkout_module.
247	</td></tr>	247	</td></tr>
248	[% END %]	248	[% END %]
249	[% IF warnNoTemplateCaching %]	249	[% IF warnNoTemplateCaching %]

Lines 29-42 use C4::Auth qw(get_template_and_user); Link Here

(-)a/opac/sco/help.pl (-8 / +10 lines)
29	use C4::Output qw(output_html_with_http_headers);	29	use C4::Output qw(output_html_with_http_headers);
30		30
31	my $query = new CGI;	31	my $query = new CGI;
32	my ($template, $borrowernumber, $cookie) = get_template_and_user({	32	my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
33	template_name => "sco/help.tt",	33	{
34	query => $query,	34	template_name => "sco/help.tt",
35	type => "opac",	35	query => $query,
36	debug => 1,	36	type => "opac",
37	authnotrequired => 1,	37	debug => 1,
38	flagsrequired => {circulate => "self_checkout"},	38	authnotrequired => 1,
39	});	39	flagsrequired => { self_check => "self_checkout_module" },
		40	}
		41	);
40		42
41	if (C4::Context->preference('SelfCheckoutByLogin')) {	43	if (C4::Context->preference('SelfCheckoutByLogin')) {
42	$template->param(SelfCheckoutByLogin => 1);	44	$template->param(SelfCheckoutByLogin => 1);

Lines 67-80 if (C4::Context->preference('AutoSelfCheckAllowed')) Link Here

(-)a/opac/sco/sco-main.pl (-8 / +11 lines)
67	$query->param(-name=>'koha_login_context',-values=>['sco']);	67	$query->param(-name=>'koha_login_context',-values=>['sco']);
68	}	68	}
69	$query->param(-name=>'sco_user_login',-values=>[1]);	69	$query->param(-name=>'sco_user_login',-values=>[1]);
70	my ($template, $loggedinuser, $cookie) = get_template_and_user({	70
71	template_name => "sco/sco-main.tt",	71	my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
72	authnotrequired => 0,	72	{
73	flagsrequired => { circulate => "self_checkout" },	73	template_name => "sco/sco-main.tt",
74	query => $query,	74	authnotrequired => 0,
75	type => "opac",	75	flagsrequired => { self_check => "self_checkout_module" },
76	debug => 1,	76	query => $query,
77	});	77	type => "opac",
		78	debug => 1,
		79	}
		80	);
78		81
79	# Get the self checkout timeout preference, or use 120 seconds as a default	82	# Get the self checkout timeout preference, or use 120 seconds as a default
80	my $selfchecktimeout = 120000;	83	my $selfchecktimeout = 120000;