Attachment 161643 Details for Bug 35941 – Bug 35941: Limit club list to those from the logged in user

[patch] Bug 35941: Limit club list to those from the logged in user

Bug-35941-Limit-club-list-to-those-from-the-logged.patch (text/plain), 5.89 KB, created by Kyle M Hall (khall) on 2024-01-30 14:41:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2024-01-30 14:41:36 UTC

Size: 5.89 KB

patch

obsolete

>From 2100030c019719f2927d9914ca0b78ec3e4dcb48 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 30 Jan 2024 14:53:03 +0100
>Subject: [PATCH] Bug 35941: Limit club list to those from the logged in user
>
>clubs-tab get the patron's id from the parameter. At the OPAC we must
>use the one from the logged in user, to prevent leak to other users
>
>Test plan:
>Have 2 clubs: A, B
>Enroll to A with patron borrowernumber=1
>Enroll to B with patron borrowernumber=2
>Log in with patron 1 and hit:
>  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
>=> OK
>Now hit
>  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
>=> oops
>
>Apply this patch, try again.
>The "borrowernumber" parameter is no longer used to fetch the club list.
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>---
> .../opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt  |  6 +++---
> .../opac-tmpl/bootstrap/en/modules/clubs/enroll.tt     |  3 +--
> opac/clubs/clubs-tab.pl                                | 10 ++++------
> opac/clubs/enroll.pl                                   |  8 ++------
> 4 files changed, 10 insertions(+), 17 deletions(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
>index 25c1e0363b2..818e74d3c67 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
>@@ -58,7 +58,7 @@
>                     <td>[% c.name | html %]</td>
>                     <td>[% c.description | html %]</td>
>                     <td>
>-                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && borrower.notice_email_address ) %]
>+                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && patron.notice_email_address ) %]
>                             <button class="btn btn-sm btn-primary load_enrollment" data-id="[% c.id | html%]">
>                                 <i class="fa fa-plus" aria-hidden="true"></i> Enroll
>                             </button>
>@@ -76,7 +76,7 @@
> <script>
> function loadEnrollmentForm( id ) {
>     $("body").css("cursor", "progress");
>-    $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber | html %]&id=' + id, function() {
>+    $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% patron.borrowernumber | html %]&id=' + id, function() {
>         $("body").css("cursor", "default");
>     });
> 
>@@ -91,7 +91,7 @@ function cancelEnrollment( id ) {
>         data: { id: id },
>         success: function( data ) {
>             if ( data.success ) {
>-                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrower.borrowernumber | html %]', function() {
>+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% patron.borrowernumber | html %]', function() {
>                     $("body").css("cursor", "default");
>                 });
>             } else {
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
>index a8dde0bbdf3..f6d35ca76b5 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
>@@ -8,7 +8,6 @@
>     <form id="patron-enrollment-form">
>         <legend class="sr-only">Enrollment</legend>
>         <input type="hidden" name="id" value="[% club.id | html %]" />
>-        <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
>         <fieldset class="rows">
>             <ol>
>                 [% FOREACH f IN club.club_template.club_template_enrollment_fields %]
>@@ -44,7 +43,7 @@ function addEnrollment() {
>         data: $( "#patron-enrollment-form" ).serialize(),
>         success: function( data ) {
>             if ( data.success ) {
>-                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
>+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?id=[% club.id | html %]', function() {
>                     $("body").css("cursor", "default");
>                 });
>             } else {
>diff --git a/opac/clubs/clubs-tab.pl b/opac/clubs/clubs-tab.pl
>index 8c3f7583753..28fcd1ed690 100755
>--- a/opac/clubs/clubs-tab.pl
>+++ b/opac/clubs/clubs-tab.pl
>@@ -35,17 +35,15 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     }
> );
> 
>-my $borrowernumber = $cgi->param('borrowernumber');
>+my $patron = Koha::Patrons->find( $loggedinuser );
> 
>-my $borrower = Koha::Patrons->find($borrowernumber);
>-
>-my @enrollments = $borrower->get_club_enrollments->as_list;
>-my @clubs = $borrower->get_enrollable_clubs( my $opac = 1 )->as_list;
>+my @enrollments = $patron->get_club_enrollments->as_list;
>+my @clubs = $patron->get_enrollable_clubs( my $opac = 1 )->as_list;
> 
> $template->param(
>     enrollments => \@enrollments,
>     clubs       => \@clubs,
>-    borrower    => $borrower,
>+    patron      => $patron,
> );
> 
> output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );
>diff --git a/opac/clubs/enroll.pl b/opac/clubs/enroll.pl
>index a71990196fd..9fcfd360046 100755
>--- a/opac/clubs/enroll.pl
>+++ b/opac/clubs/enroll.pl
>@@ -35,14 +35,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     }
> );
> 
>-my $id             = $cgi->param('id');
>-my $borrowernumber = $cgi->param('borrowernumber');
>-
>-my $club = Koha::Clubs->find($id);
>+my $id = $cgi->param('id');
> 
> $template->param(
>-    club           => $club,
>-    borrowernumber => $borrowernumber,
>+    club => Koha::Clubs->find($id),
> );
> 
> output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 35941: 161637 | 161643 | 161644 | 161687 | 161688