Bugzilla – Attachment 129035 Details for
Bug 29543
Self-checkout allows returning everybody's loans
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29543: Prevent user to checkin or renew items they don't own
Bug-29543-Prevent-user-to-checkin-or-renew-items-t.patch (text/plain), 3.82 KB, created by
Nick Clemens (kidclamp)
on 2022-01-05 15:34:03 UTC
(
hide
)
Description:
Bug 29543: Prevent user to checkin or renew items they don't own
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2022-01-05 15:34:03 UTC
Size:
3.82 KB
patch
obsolete
>From 6d8c7fc377d1ef29f83c7aefb1771e7139e31887 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 5 Jan 2022 15:25:48 +0100 >Subject: [PATCH] Bug 29543: Prevent user to checkin or renew items they don't > own > >Checkin or renew must be restricted to the items they own. > >Test plan: >Create an item with barcode bc_1 >Check it in to user A >Login to SCO with user B >Get the token using the browser dev tool, from the cookie >Hit (replace $JWT) > /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1 > /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1 > >You should see an error message > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > .../bootstrap/en/modules/sco/sco-main.tt | 5 +++ > opac/sco/sco-main.pl | 36 +++++++++++++------ > 2 files changed, 30 insertions(+), 11 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >index bddfa7e919..86bd857d18 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >@@ -205,6 +205,11 @@ > <div class="alert alert-info"> > <p>Item renewed</p> > </div> >+ [% ELSIF ( renewed == 0) %] >+ <span class="sco-alert-warning renew"></span> >+ <div class="alert alert-info"> >+ <p>Item not renewed</p> >+ </div> > [% ELSIF ( returned == 0 ) %] > <span class="sco-alert-warning return"></span> > <div class="alert alert-info"> >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index 5ab0d42c76..7e056fa34e 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -139,19 +139,28 @@ my $confirm_required = 0; > my $return_only = 0; > > if ( $patron && $op eq "returnbook" && $allowselfcheckreturns ) { >- my $success = 0; >- my $human_required = 0; >+ my $success = 1; >+ >+ > my $item = Koha::Items->find( { barcode => $barcode } ); >- if ( C4::Context->preference("CircConfirmItemParts") ) { >+ if ( $success && C4::Context->preference("CircConfirmItemParts") ) { > if ( defined($item) > && $item->materials ) > { >- $human_required = 1; >+ $success = 0; > } > } > >- ($success) = AddReturn( $barcode, $branch ) >- unless $human_required; >+ if ($success) { >+ # Patron cannot checkin an item they don't own >+ $success = 0 >+ unless $patron->checkouts->find( { itemnumber => $item->itemnumber } ); >+ } >+ >+ if ( $success ) { >+ ($success) = AddReturn( $barcode, $branch ) >+ } >+ > $template->param( returned => $success ); > } > elsif ( $patron && ( $op eq 'checkout' ) ) { >@@ -267,11 +276,16 @@ elsif ( $patron && ( $op eq 'checkout' ) ) { > > if ( $patron && ( $op eq 'renew' ) ) { > my $item = Koha::Items->find({ barcode => $barcode }); >- my ($status,$renewerror) = CanBookBeRenewed( $patron->borrowernumber, $item->itemnumber ); >- if ($status) { >- AddRenewal( $patron->borrowernumber, $item->itemnumber, undef, undef, undef, undef, 1 ); >- push @newissueslist, $barcode; >- $template->param( renewed => 1 ); >+ >+ if ( $patron->checkouts->find( { itemnumber => $item->itemnumber } ) ) { >+ my ($status,$renewerror) = CanBookBeRenewed( $patron->borrowernumber, $item->itemnumber ); >+ if ($status) { >+ AddRenewal( $patron->borrowernumber, $item->itemnumber, undef, undef, undef, undef, 1 ); >+ push @newissueslist, $barcode; >+ $template->param( renewed => 1 ); >+ } >+ } else { >+ $template->param( renewed => 0 ); > } > } > >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29543
:
129022
|
129023
|
129024
|
129025
|
129026
|
129031
|
129032
|
129033
|
129034
|
129035
|
129036
|
129037
|
129039
|
129133
|
129210
|
129211
|
129212
|
129213
|
129214
|
129215
|
129216
|
129217
|
129679