Attachment 26442 Details for Bug 11759 – Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed

[patch] Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed

Bug-11759-follow-up-Prevent-access-to-the-batch-ch.patch (text/plain), 4.94 KB, created by Jonathan Druart on 2014-03-19 08:37:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2014-03-19 08:37:28 UTC

Size: 4.94 KB

patch

obsolete

>From fb87a08a1b00f993f97ee0fe21ad6379b0d3b136 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@biblibre.com>
>Date: Tue, 25 Feb 2014 10:53:36 +0100
>Subject: [PATCH] Bug 11759: (follow-up) Prevent access to the batch checkout
> if not allowed
>
>If a user pass '&batch=1' to the url, he was allowed to access to the
>batch checkout page even if the patron is not in an authorised category.
>
>This patch also fixes the link to "Batch check out" from the "Details"
>tab (cf changes in circ-menu.inc).
>---
> circ/circulation.pl                                |   22 +++++++++++++-------
> .../intranet-tmpl/prog/en/includes/circ-menu.inc   |    2 +-
> .../en/modules/circ/circulation_batch_checkouts.tt |    4 +++-
> 3 files changed, 19 insertions(+), 9 deletions(-)
>
>diff --git a/circ/circulation.pl b/circ/circulation.pl
>index 2b12a00..56a0fa0 100755
>--- a/circ/circulation.pl
>+++ b/circ/circulation.pl
>@@ -85,7 +85,6 @@ if (!C4::Context->userenv && !$branch){
> }
> 
> my $barcodes = [];
>-my $batch = $query->param('batch');
> if ( my $barcode = $query->param('barcode') ) {
>     $barcodes = [ $barcode ];
> } else {
>@@ -105,9 +104,20 @@ if ( my $barcode = $query->param('barcode') ) {
> 
> $barcodes = [ uniq @$barcodes ];
> 
>-my $template_name = $batch
>-    ? q|circ/circulation_batch_checkouts.tt|
>-    : q|circ/circulation.tt|;
>+my $template_name = q|circ/circulation.tt|;
>+my $borrowernumber = $query->param('borrowernumber');
>+my $borrower = $borrowernumber ? GetMemberDetails( $borrowernumber, 0 ) : undef;
>+my $batch = $query->param('batch');
>+my $batch_allowed = 0;
>+if ( $batch ) {
>+    $template_name = q|circ/circulation_batch_checkouts.tt|;
>+    my @batch_category_codes = split '\|', C4::Context->preference('batch_checkouts');
>+    if ( grep {/^$borrower->{categorycode}$/} @batch_category_codes ) {
>+        $batch_allowed = 1;
>+    } else {
>+        $barcodes = [];
>+    }
>+}
> 
> my ( $template, $loggedinuser, $cookie ) = get_template_and_user (
>     {
>@@ -131,7 +141,6 @@ for (@failedreturns) { $return_failed{$_} = 1; }
> 
> my $findborrower = $query->param('findborrower') || q{};
> $findborrower =~ s|,| |g;
>-my $borrowernumber = $query->param('borrowernumber');
> 
> $branch  = C4::Context->userenv->{'branch'};  
> $printer = C4::Context->userenv->{'branchprinter'};
>@@ -245,9 +254,7 @@ if ($findborrower) {
> }
> 
> # get the borrower information.....
>-my $borrower;
> if ($borrowernumber) {
>-    $borrower = GetMemberDetails( $borrowernumber, 0 );
>     my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber );
> 
>     # Warningdate is the date that the warning starts appearing
>@@ -777,6 +784,7 @@ $template->param(
>     inprocess         => $inprocess,
>     is_child          => ($borrower->{'category_type'} eq 'C'),
>     $view             => 1,
>+    batch_allowed     => $batch_allowed,
>     soundon           => C4::Context->preference("SoundOn"),
>     fast_cataloging   => $fast_cataloging,
>     CircAutoPrintQuickSlip   => C4::Context->preference("CircAutoPrintQuickSlip"),
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
>index f619c36..689d5b0 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
>@@ -65,7 +65,7 @@
> <ul>
>     [% IF ( circview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrowernumber %]">Check out</a></li>
>     [% IF Koha.Preference('batch_checkouts').split('\|').grep(categorycode).size > 0 %]
>-      [% IF ( batch_checkout_view ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrower.borrowernumber %]&amp;batch=1">Batch check out</a></li>
>+      [% IF ( batch_checkout_view ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrowernumber %]&amp;batch=1">Batch check out</a></li>
>     [% END %]
>     [% IF ( CAN_user_borrowers ) %]
>         [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Details</a></li>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
>index 899eac2..720e61a 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
>@@ -54,7 +54,9 @@ $(document).ready(function() {
> 
> <div class="yui-g">
> 
>-[% UNLESS checkout_infos %]
>+[% IF NOT batch_allowed %]
>+  <div class="dialog message">You are not allowed to use batch checkout for this patron</div>
>+[% ELSIF NOT checkout_infos %]
>   <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/circ/circulation.pl">
>     <fieldset id="circ_circulation_issue">
>       <label for="barcode">Checking out a batch to [% INCLUDE 'patron-title.inc' %]</label>
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 11759: 25255 | 25256 | 25257 | 25258 | 25260 | 25620 | 26442 | 26455 | 26806 | 26807 | 26808 | 26809 | 26810 | 26811 | 26813 | 26814 | 26815 | 26833 | 26854 | 27613 | 37603 | 37604 | 37605 | 37606 | 37607 | 37608 | 37609 | 37610 | 37611 | 37612 | 37613 | 37614 | 37650 | 37653 | 41692 | 41693 | 41694 | 41695 | 41696 | 41697 | 41698 | 41735 | 41736 | 41737 | 41738 | 41739 | 41740 | 41741 | 43626 | 43627