|
Lines 329-360
Others will be added here depending on the needs (for instance biblio does not e
Link Here
|
| 329 |
sub output_and_exit_if_error { |
329 |
sub output_and_exit_if_error { |
| 330 |
my ( $query, $cookie, $template, $params ) = @_; |
330 |
my ( $query, $cookie, $template, $params ) = @_; |
| 331 |
my $error; |
331 |
my $error; |
| 332 |
if ($params->{module} eq 'CSRF_TOKEN_CHECK') { |
332 |
if ( $params and exists $params->{module} ) { |
| 333 |
my $csrfcheck = Koha::Token->new->check_csrf( { |
333 |
if ( $params->{module} eq 'members' ) { |
| 334 |
session_id => scalar $cookie, |
334 |
my $logged_in_user = $params->{logged_in_user}; |
| 335 |
token => scalar $params->{csrf_token}, |
335 |
my $current_patron = $params->{current_patron}; |
| 336 |
}); |
336 |
if ( not $current_patron ) { |
| 337 |
unless ($csrfcheck) { |
337 |
$error = 'unknown_patron'; |
| 338 |
$error = 'wrong_csrf_token'; |
338 |
} |
| 339 |
} |
339 |
elsif ( not $logged_in_user->can_see_patron_infos($current_patron) ) |
| 340 |
|
340 |
{ |
| 341 |
} else { |
341 |
$error = 'cannot_see_patron_infos'; |
| 342 |
if ( $params and exists $params->{module} ) { |
|
|
| 343 |
if ( $params->{module} eq 'members' ) { |
| 344 |
my $logged_in_user = $params->{logged_in_user}; |
| 345 |
my $current_patron = $params->{current_patron}; |
| 346 |
if ( not $current_patron ) { |
| 347 |
$error = 'unknown_patron'; |
| 348 |
} |
| 349 |
elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { |
| 350 |
$error = 'cannot_see_patron_infos'; |
| 351 |
} |
| 352 |
} |
342 |
} |
| 353 |
} elsif ( $params->{module} eq 'cataloguing' ) { |
343 |
} |
|
|
344 |
elsif ( $params->{module} eq 'cataloguing' ) { |
| 354 |
# We are testing the record to avoid additem to fetch the Koha::Biblio |
345 |
# We are testing the record to avoid additem to fetch the Koha::Biblio |
| 355 |
# But in the long term we will want to get a biblio in parameter |
346 |
# But in the long term we will want to get a biblio in parameter |
| 356 |
$error = 'unknown_biblio' unless $params->{record}; |
347 |
$error = 'unknown_biblio' unless $params->{record}; |
| 357 |
} |
348 |
} |
|
|
349 |
elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) { |
| 350 |
$error = 'wrong_csrf_token' |
| 351 |
unless Koha::Token->new->check_csrf( |
| 352 |
{ |
| 353 |
session_id => scalar $query->cookie('CGISESSID'), |
| 354 |
token => scalar $query->param('csrf_token'), |
| 355 |
} |
| 356 |
); |
| 357 |
} |
| 358 |
} |
| 358 |
} |
359 |
} |
| 359 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |
360 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |
| 360 |
return; |
361 |
return; |