Attachment 62016 Details for Bug 18403 – Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos

[patch] Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos

Bug-18403-Add-sub-outputandexitiferror---unknownpa.patch (text/plain), 50.19 KB, created by Jonathan Druart on 2017-04-10 21:32:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2017-04-10 21:32:50 UTC

Size: 50.19 KB

patch

obsolete

>From 6bf8bceae5e8af0214a91fb5eeae8ae4749662d0 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 4 Apr 2017 18:48:45 -0300
>Subject: [PATCH] Bug 18403: Add sub output_and_exit_if_error - unknown_patron
> & cannot_see_patron_infos
>
>Test plan:
>Login with a patron that is not allowed to see patron's information for patrons
>outside of his group. Try to access patron's information from scripts of the patron
>module (members/*) and circ/circulation.pl.
>You should be able to access patron's information of patrons outside of your group
>and get "You are not allowed to see the information of this patron."
>If you try and access a patron page with a borrowernumber that does not exist, you
>should get "This patron does not exist"
>
>Technical note:
>A new C4::Output subroutine is created in this patch: "output_and_exit_if_error"
>Executed at the beginning of the script it will permit not to copy/paste all the
>different checks to know if the logged in user is authorised to see patron's information.
>The design here can be discussed, but I did not find an alternative with as less changes.
>On the way I refactor what we did with 'unknowuser' previously: it will now work with all
>patron pages, not only the few that used it.
>Note that the 'or die "Not logged in";' part should not be needed, but... who trusts
>C4::Auth?
>I think it could be used as a safeguard later. I am willing to sed and remove them
>if required.
>
>Changes in discharge.pl are mainly indentation changes.
>
>With this patch we should now have a $patron variable that refer to the patron we
>want to access. That will be very useful to remove plenty of code in members/* and
>only pass this variable to the template (instead of 1 variable per patron's attribute).
>---
> C4/Output.pm                                       |  25 ++++
> .../prog/en/includes/acquisitions-toolbar.inc      |   1 +
> .../prog/en/includes/authorities-toolbar.inc       |   1 +
> .../prog/en/includes/blocking_errors.inc           |  10 ++
> .../prog/en/includes/budgets-admin-toolbar.inc     |   1 +
> .../intranet-tmpl/prog/en/includes/cat-toolbar.inc |   3 +-
> .../prog/en/includes/labels-toolbar.inc            |   1 +
> .../prog/en/includes/members-toolbar.inc           |   1 +
> .../prog/en/includes/patron-toolbar.inc            |   1 +
> .../prog/en/includes/patroncards-toolbar.inc       |   1 +
> .../prog/en/includes/reports-toolbar.inc           |   1 +
> .../en/includes/rotating-collections-toolbar.inc   |   1 +
> .../prog/en/includes/serials-toolbar.inc           |   1 +
> .../prog/en/includes/virtualshelves-toolbar.inc    |   1 +
> .../prog/en/modules/members/discharge.tt           |   4 +-
> .../prog/en/modules/members/housebound.tt          |   4 -
> .../prog/en/modules/members/moremember.tt          |  13 +-
> .../prog/en/modules/members/statistics.tt          |   6 +-
> members/boraccount.pl                              |   4 +-
> members/deletemem.pl                               |   9 +-
> members/discharge.pl                               | 141 ++++++++++-----------
> members/discharges.pl                              |   3 +
> members/files.pl                                   |   8 +-
> members/housebound.pl                              |  10 +-
> members/mancredit.pl                               |   5 +-
> members/maninvoice.pl                              |   9 +-
> members/member-flags.pl                            |   4 +-
> members/member-password.pl                         |   3 +
> members/memberentry.pl                             |   8 +-
> members/members-update-do.pl                       |   6 +
> members/mod_debarment.pl                           |   8 ++
> members/moremember.pl                              |   9 +-
> members/notices.pl                                 |   3 +
> members/pay.pl                                     |   5 +-
> members/paycollect.pl                              |   4 +
> members/print_overdues.pl                          |   6 +
> members/printfeercpt.pl                            |   5 +-
> members/printinvoice.pl                            |   5 +-
> members/printslip.pl                               |   5 +
> members/purchase-suggestions.pl                    |   6 +-
> members/readingrec.pl                              |   4 +
> members/routing-lists.pl                           |  56 ++++----
> members/setstatus.pl                               |  26 ++--
> members/statistics.pl                              |  10 +-
> members/summary-print.pl                           |   5 +-
> members/update-child.pl                            |   5 +-
> 46 files changed, 277 insertions(+), 171 deletions(-)
> create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
>
>diff --git a/C4/Output.pm b/C4/Output.pm
>index af7dd5a..58bd75a 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -50,6 +50,7 @@ BEGIN {
>     );
>     push @EXPORT, qw(
>         &output_html_with_http_headers &output_ajax_with_http_headers &output_with_http_headers
>+        &output_and_exit_if_error
>     );
> 
> }
>@@ -306,6 +307,30 @@ sub is_ajax {
>     return ( $x_req and $x_req =~ /XMLHttpRequest/i ) ? 1 : 0;
> }
> 
>+sub output_and_exit_if_error {
>+    my ( $query, $cookie, $template, $params ) = @_;
>+    my $error;
>+    if ( $params and exists $params->{module} ) {
>+        if ( $params->{module} eq 'members' ) {
>+            my $logged_in_user = $params->{logged_in_user};
>+            my $current_patron = $params->{current_patron};
>+            if ( not $current_patron ) {
>+                $error = 'unknown_patron';
>+            }
>+            elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
>+                $error = 'cannot_see_patron_infos';
>+            }
>+        }
>+    }
>+
>+    if ( $error ) {
>+        $template->param( blocking_error => $error );
>+        output_html_with_http_headers ( $query, $cookie, $template->output );
>+        exit;
>+    }
>+    return;
>+}
>+
> sub parametrized_url {
>     my $url = shift || ''; # ie page.pl?ln={LANG}
>     my $vars = shift || {}; # ie { LANG => en }
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
>index a82ab41..198c6cb 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <script type="text/javascript">
> //<![CDATA[
> function confirm_deletion() {
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc
>index 582a4ed..f4af449 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <script type="text/javascript">
> //<![CDATA[
>     $(document).ready(function() {
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
>new file mode 100644
>index 0000000..2d25a16
>--- /dev/null
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
>@@ -0,0 +1,10 @@
>+[% IF blocking_error %]
>+    [% SWITCH blocking_error %]
>+    [% CASE 'unknown_patron' %]
>+        <div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div>
>+    [% CASE 'cannot_see_patron_infos' %]You are not allowed to see the information of this patron.
>+    [% CASE %][% blocking_error %]
>+    [% END %]
>+
>+    [% STOP %] [%# Will stop gracefully without processing any more of the template document.%]
>+[% END %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc
>index e9d61a1..813ee8c 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <div id="toolbar" class="btn-toolbar">
>     [% IF ( budget_period_id ) %]
>         <div class="btn-group">
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc
>index 3d6b23b..99bf63e 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc
>@@ -1,4 +1,5 @@
>-	<script type="text/javascript">
>+[% INCLUDE 'blocking_errors.inc' %]
>+<script type="text/javascript">
> 	//<![CDATA[
> 	[% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
> 	/* this function open a popup to search on z3950 server.  */
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc
>index d9bb897..aa25fb1 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <div id="toolbar" class="btn-toolbar">
>     <div class="btn-group">
>         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>index f9f64ff..644c664 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> [% USE Koha %]
> [% USE Borrowers %]
> [% USE Branches %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
>index ea89124..a1738d8 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> [% USE Categories %]
> [% USE Koha %]
> [% SET categories = Categories.all %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc
>index 9f411f7..4f39e70 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <div id="toolbar" class="btn-toolbar">
>     <div class="btn-group">
>         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
>index a425919..0875ddf 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <div id="toolbar" class="btn-toolbar">
>     [% IF ( CAN_user_reports_create_reports ) %]
>         <div class="btn-group">
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc
>index 9dd3e7a..8f66910 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <script type="text/javascript">
>     $(document).ready(function(){
>         $(".confirmdelete").click(function(){
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
>index ecc9e55..30325d5 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <script type="text/javascript">
> 	//<![CDATA[
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>index 0f034dc..815a299 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>@@ -1,3 +1,4 @@
>+[% INCLUDE 'blocking_errors.inc' %]
> <script type="text/javascript">
> //<![CDATA[
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
>index 577d56c..8e316cc 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
>@@ -2,7 +2,7 @@
> [% USE AuthorisedValues %]
> [% USE Branches %]
> [% INCLUDE 'doc-head-open.inc' %]
>-<title>Koha &rsaquo; Patrons &rsaquo; [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title>
>+<title>Koha &rsaquo; Patrons &rsaquo; [% UNLESS blocking_error  %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title>
> [% INCLUDE 'doc-head-close.inc' %]
> </head>
> <body id="discharge" class="discharge">
>@@ -12,7 +12,7 @@
> <div id="breadcrumbs">
>          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
>-&rsaquo; [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
>+&rsaquo; [% UNLESS blocking_error  %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
> </div>
> 
> <div id="doc3" class="yui-t1">
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
>index c17363f..3dac61f 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
>@@ -30,9 +30,7 @@
>     <div id="yui-main">
>       <div class="yui-b">
> 
>-        [% UNLESS ( unknowuser ) %]
>         [% INCLUDE 'members-toolbar.inc' %]
>-        [% END %]
> 
>         <div class="yui-g">
> 
>@@ -43,8 +41,6 @@
>             [% FOR m IN messages %]
>                 <div class="dialog [% m.type %]">
>                     [% SWITCH m.code %]
>-                    [% CASE 'error_on_patron_load' %]
>-                        An error occurred whilst loading the patron details.
>                     [% CASE 'error_on_profile_store' %]
>                         An error occurred whilst updating this housebound profile.
>                     [% CASE 'error_on_profile_create' %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
>index d5f61d7..8866a0f 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
>@@ -5,9 +5,7 @@
> [% USE ColumnsSettings %]
> [% INCLUDE 'doc-head-open.inc' %]
> <title>Koha &rsaquo; Patrons &rsaquo;
>-[% IF ( unknowuser ) %]
>-    Patron does not exist
>-[% ELSE %]
>+[% UNLESS blocking_error %]
>     Patron details for [% INCLUDE 'patron-title.inc' %]
> [% END %]
> </title>
>@@ -136,7 +134,7 @@ function validate1(date) {
> <div id="breadcrumbs">
>          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
>-&rsaquo; [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %]
>+&rsaquo; [% UNLESS blocking_error %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %]
> </div>
> 
> <div id="doc3" class="yui-t2">
>@@ -145,9 +143,7 @@ function validate1(date) {
> 	<div id="yui-main">
> 	<div class="yui-b">
> 
>-[% UNLESS ( unknowuser ) %]
> [% INCLUDE 'members-toolbar.inc' %]
>-[% END %]
> 
> [% IF ( error ) %]
> <div class="dialog alert">
>@@ -171,9 +167,6 @@ function validate1(date) {
> [% END %]
> <div class="yui-g">
> 
>-[% IF ( unknowuser ) %]
>-   <div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div>
>-[% ELSE %]
>     [% IF ( was_renewed ) %]<div class="dialog message">Patron's account has been renewed until [% dateexpiry | $KohaDates %]</div>[% END %]
> 
>     [% IF fines %]
>@@ -612,8 +605,6 @@ function validate1(date) {
> [% END %]
> 
> </div>
>-[% END %] 
>-
> 
> </div>
> </div>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt
>index ae5c276..d7091fb 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt
>@@ -3,9 +3,7 @@
> [% USE Branches %]
> [% INCLUDE 'doc-head-open.inc' %]
> <title>Koha &rsaquo; Patrons &rsaquo;
>-[% IF ( unknowuser ) %]
>-    Patron does not exist
>-[% ELSE %]
>+[% UNLESS blocking_error %]
>     Statistics for [% INCLUDE 'patron-title.inc' %]
> [% END %]
> </title>
>@@ -30,7 +28,7 @@
> <div id="breadcrumbs">
>          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
>-&rsaquo; [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Statistics for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
>+&rsaquo; [% UNLESS blocking_error  %]Statistics for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
> </div>
> 
> <div id="doc3" class="yui-t1">
>diff --git a/members/boraccount.pl b/members/boraccount.pl
>index fd54a55..771f78c 100755
>--- a/members/boraccount.pl
>+++ b/members/boraccount.pl
>@@ -52,9 +52,11 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user(
> my $borrowernumber=$input->param('borrowernumber');
> my $action = $input->param('action') || '';
> 
>-#get patron details
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
> my $patron = Koha::Patrons->find( $borrowernumber );
> 
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> if ( $action eq 'reverse' ) {
>   ReversePayment( $input->param('accountlines_id') );
> }
>diff --git a/members/deletemem.pl b/members/deletemem.pl
>index 3273317..c9182ea 100755
>--- a/members/deletemem.pl
>+++ b/members/deletemem.pl
>@@ -39,7 +39,7 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen
> 
> my $input = new CGI;
> 
>-my ($template, $borrowernumber, $cookie)
>+my ($template, $loggedinuser, $cookie)
>                 = get_template_and_user({template_name => "members/deletemem.tt",
>                                         query => $input,
>                                         type => "intranet",
>@@ -52,11 +52,15 @@ my ($template, $borrowernumber, $cookie)
> my $member       = $input->param('member');
> 
> #Do not delete yourself...
>-if ($borrowernumber == $member ) {
>+if ( $loggedinuser == $member ) {
>     print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_YOURSELF");
>     exit 0; # Exit without error
> }
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $member );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> # Handle deletion from the Norwegian national patron database, if it is enabled
> # If the "deletelocal" parameter is set to "false", the regular deletion will be
> # short circuited, and only a deletion from the national database can be carried
>@@ -74,7 +78,6 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen
> my $issues = GetPendingIssues($member);     # FIXME: wasteful call when really, we only want the count
> my $countissues = scalar(@$issues);
> 
>-my $patron = Koha::Patrons->find( $member );
> my $flags = C4::Members::patronflags( $patron->unblessed );
> my $userenv = C4::Context->userenv;
> 
>diff --git a/members/discharge.pl b/members/discharge.pl
>index 44c8190..ed1c7ac 100755
>--- a/members/discharge.pl
>+++ b/members/discharge.pl
>@@ -58,85 +58,82 @@ unless ( C4::Context->preference('useDischarge') ) {
>    exit;
> }
> 
>-if ( $input->param('borrowernumber') ) {
>-    $borrowernumber = $input->param('borrowernumber');
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
>-    # Getting member data
>-    my $patron = Koha::Patrons->find( $borrowernumber );
>-
>-    my $can_be_discharged = Koha::Patron::Discharge::can_be_discharged({
>-        borrowernumber => $borrowernumber
>-    });
>+my $can_be_discharged = Koha::Patron::Discharge::can_be_discharged({
>+    borrowernumber => $borrowernumber
>+});
> 
>-    my $holds = $patron->holds;
>-    my $has_reserves = $holds->count;
>+my $holds = $patron->holds;
>+my $has_reserves = $holds->count;
> 
>-    # Generating discharge if needed
>-    if ( $input->param('discharge') and $can_be_discharged ) {
>-        my $is_discharged = Koha::Patron::Discharge::is_discharged({
>-            borrowernumber => $borrowernumber,
>+# Generating discharge if needed
>+if ( $input->param('discharge') and $can_be_discharged ) {
>+    my $is_discharged = Koha::Patron::Discharge::is_discharged({
>+        borrowernumber => $borrowernumber,
>+    });
>+    unless ($is_discharged) {
>+        Koha::Patron::Discharge::discharge({
>+            borrowernumber => $borrowernumber
>         });
>-        unless ($is_discharged) {
>-            Koha::Patron::Discharge::discharge({
>-                borrowernumber => $borrowernumber
>-            });
>-        }
>-        eval {
>-            my $pdf_path = Koha::Patron::Discharge::generate_as_pdf(
>-                { borrowernumber => $borrowernumber, branchcode => $patron->branchcode } );
>-
>-            binmode(STDOUT);
>-            print $input->header(
>-                -type       => 'application/pdf',
>-                -charset    => 'utf-8',
>-                -attachment => "discharge_$borrowernumber.pdf",
>-            );
>-            open my $fh, '<', $pdf_path;
>-            my @lines = <$fh>;
>-            close $fh;
>-            print @lines;
>-            exit;
>-        };
>-        if ( $@ ) {
>-            carp $@;
>-            $template->param( messages => [ {type => 'error', code => 'unable_to_generate_pdf'} ] );
>-        }
>     }
>+    eval {
>+        my $pdf_path = Koha::Patron::Discharge::generate_as_pdf(
>+            { borrowernumber => $borrowernumber, branchcode => $patron->branchcode } );
>+
>+        binmode(STDOUT);
>+        print $input->header(
>+            -type       => 'application/pdf',
>+            -charset    => 'utf-8',
>+            -attachment => "discharge_$borrowernumber.pdf",
>+        );
>+        open my $fh, '<', $pdf_path;
>+        my @lines = <$fh>;
>+        close $fh;
>+        print @lines;
>+        exit;
>+    };
>+    if ( $@ ) {
>+        carp $@;
>+        $template->param( messages => [ {type => 'error', code => 'unable_to_generate_pdf'} ] );
>+    }
>+}
> 
>-    # Already generated discharges
>-    my $validated_discharges = Koha::Patron::Discharge::get_validated({
>-        borrowernumber => $borrowernumber,
>-    });
>+# Already generated discharges
>+my $validated_discharges = Koha::Patron::Discharge::get_validated({
>+    borrowernumber => $borrowernumber,
>+});
> 
>-    $template->param( picture => 1 ) if $patron->image;
>-
>-    $template->param(
>-        # FIXME The patron object should be passed to the template
>-        borrowernumber    => $borrowernumber,
>-        title             => $patron->title,
>-        initials          => $patron->initials,
>-        surname           => $patron->surname,
>-        borrowernumber    => $borrowernumber,
>-        firstname         => $patron->firstname,
>-        cardnumber        => $patron->cardnumber,
>-        categorycode      => $patron->categorycode,
>-        category_type     => $patron->category->category_type,
>-        categoryname      => $patron->category->description,
>-        address           => $patron->address,
>-        streetnumber      => $patron->streetnumber,
>-        streettype        => $patron->streettype,
>-        address2          => $patron->address2,
>-        city              => $patron->city,
>-        zipcode           => $patron->zipcode,
>-        country           => $patron->country,
>-        phone             => $patron->phone,
>-        email             => $patron->email,
>-        branchcode        => $patron->branchcode,
>-        has_reserves      => $has_reserves,
>-        can_be_discharged => $can_be_discharged,
>-        validated_discharges => $validated_discharges,
>-    );
>-}
>+$template->param( picture => 1 ) if $patron->image;
>+
>+$template->param(
>+    # FIXME The patron object should be passed to the template
>+    borrowernumber    => $borrowernumber,
>+    title             => $patron->title,
>+    initials          => $patron->initials,
>+    surname           => $patron->surname,
>+    borrowernumber    => $borrowernumber,
>+    firstname         => $patron->firstname,
>+    cardnumber        => $patron->cardnumber,
>+    categorycode      => $patron->categorycode,
>+    category_type     => $patron->category->category_type,
>+    categoryname      => $patron->category->description,
>+    address           => $patron->address,
>+    streetnumber      => $patron->streetnumber,
>+    streettype        => $patron->streettype,
>+    address2          => $patron->address2,
>+    city              => $patron->city,
>+    zipcode           => $patron->zipcode,
>+    country           => $patron->country,
>+    phone             => $patron->phone,
>+    email             => $patron->email,
>+    branchcode        => $patron->branchcode,
>+    has_reserves      => $has_reserves,
>+    can_be_discharged => $can_be_discharged,
>+    validated_discharges => $validated_discharges,
>+);
> 
> $template->param( dischargeview => 1, );
> 
>diff --git a/members/discharges.pl b/members/discharges.pl
>index 38a7355..165a1cb 100755
>--- a/members/discharges.pl
>+++ b/members/discharges.pl
>@@ -44,6 +44,9 @@ my $branchcode =
> 
> if( $op eq 'allow' ) {
>     my $borrowernumber = $input->param('borrowernumber');
>+    my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+    my $patron         = Koha::Patrons->find($borrowernumber);
>+    output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>     Koha::Patron::Discharge::discharge({
>         borrowernumber => $borrowernumber
>     }) if $borrowernumber;
>diff --git a/members/files.pl b/members/files.pl
>index f78ad33..e8a1009 100755
>--- a/members/files.pl
>+++ b/members/files.pl
>@@ -47,7 +47,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> $template->param( 'borrower_files' => 1 );
> 
> my $borrowernumber = $cgi->param('borrowernumber');
>-my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber );
>+
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find($borrowernumber);
>+output_and_exit_if_error( $cgi, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
>+my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber ); # FIXME Should be $patron->get_files. Koha::Patron::Files needs to be Koha::Objects based first
> 
> my $op = $cgi->param('op') || '';
> 
>@@ -63,7 +68,6 @@ if ( $op eq 'download' ) {
>     print $file->{'file_content'};
> }
> else {
>-    my $patron = Koha::Patrons->find( $borrowernumber );
>     $template->param(%{ $patron->unblessed});
> 
>     my %errors;
>diff --git a/members/housebound.pl b/members/housebound.pl
>index 01f6ec6..86d5470 100755
>--- a/members/housebound.pl
>+++ b/members/housebound.pl
>@@ -56,12 +56,10 @@ my $method = $input->param('method') // q{};
> my $visit_id = $input->param('visit_id') // q{};
> 
> # Get patron
>-my $patron = eval {
>-    my $borrowernumber = $input->param('borrowernumber') // q{};
>-    return Koha::Patrons->find($borrowernumber);
>-};
>-push @messages, { type => 'error', code => 'error_on_patron_load' }
>-    if ( $@ or !$patron );
>+my $borrowernumber = $input->param('borrowernumber');
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron = Koha::Patrons->find($borrowernumber);
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
> # Get supporting cast
> my ( $branch, $category, $houseboundprofile, $visit, $patron_image );
>diff --git a/members/mancredit.pl b/members/mancredit.pl
>index dc9dba7..0652dca 100755
>--- a/members/mancredit.pl
>+++ b/members/mancredit.pl
>@@ -47,6 +47,8 @@ my $add=$input->param('add');
> 
> if ($add){
>     if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
>+        # Note: If the logged in user is not allowed to see this patron an invoice can be forced
>+        # Here we are trusting librarians not to hack the system
>         my $barcode = $input->param('barcode');
>         my $itemnum;
>         if ($barcode) {
>@@ -72,7 +74,8 @@ if ($add){
>             debug           => 1,
>         }
>     );
>-					  
>+    my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+    output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>     if ( $patron->category->category_type eq 'C') {
>         my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
>         $template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1;
>diff --git a/members/maninvoice.pl b/members/maninvoice.pl
>index afd5dd0..a354482 100755
>--- a/members/maninvoice.pl
>+++ b/members/maninvoice.pl
>@@ -46,7 +46,8 @@ my $patron = Koha::Patrons->find( $borrowernumber );
> my $add=$input->param('add');
> if ($add){
>     if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
>-        #  print $input->header;
>+        # Note: If the logged in user is not allowed to see this patron an invoice can be forced
>+        # Here we are trusting librarians not to hack the system
>         my $barcode=$input->param('barcode');
>         my $itemnum;
>         if ($barcode) {
>@@ -88,7 +89,11 @@ if ($add){
>                              updatecharges => 'remaining_permissions' },
>         debug           => 1,
>     });
>-					
>+
>+    my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+    my $patron         = Koha::Patrons->find($borrowernumber);
>+    output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
>   # get authorised values with type of MANUAL_INV
>   my @invoice_types;
>   my $dbh = C4::Context->dbh;
>diff --git a/members/member-flags.pl b/members/member-flags.pl
>index a2f08dc..95723d1 100755
>--- a/members/member-flags.pl
>+++ b/members/member-flags.pl
>@@ -29,7 +29,7 @@ my $member=$input->param('member');
> my $patron = Koha::Patrons->find( $member );
> my $category_type = $patron->category->category_type;
> my $bor = $patron->unblessed;
>-if( $category_type eq 'S' )  {
>+if( $category_type eq 'S' )  { # FIXME Is this really needed?
> 	$flagsrequired->{'staffaccess'} = 1;
> }
> my ($template, $loggedinuser, $cookie) = get_template_and_user({
>@@ -41,6 +41,8 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({
>         debug           => 1,
> });
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
> my %member2;
> $member2{'borrowernumber'}=$member;
>diff --git a/members/member-password.pl b/members/member-password.pl
>index 2f9a47c..dd21082 100755
>--- a/members/member-password.pl
>+++ b/members/member-password.pl
>@@ -45,7 +45,10 @@ my $newpassword2 = $input->param('newpassword2');
> 
> my @errors;
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
> my $patron = Koha::Patrons->find( $member );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category_type = $patron->category->category_type;
> my $bor = $patron->unblessed;
> 
>diff --git a/members/memberentry.pl b/members/memberentry.pl
>index be031d0..4a1394c 100755
>--- a/members/memberentry.pl
>+++ b/members/memberentry.pl
>@@ -75,13 +75,17 @@ my ($template, $loggedinuser, $cookie)
>            debug => ($debug) ? 1 : 0,
>        });
> 
>+my $borrowernumber = $input->param('borrowernumber');
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find($borrowernumber);
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> if ( C4::Context->preference('SMSSendDriver') eq 'Email' ) {
>     my @providers = Koha::SMS::Providers->search();
>     $template->param( sms_providers => \@providers );
> }
> 
> my $guarantorid    = $input->param('guarantorid');
>-my $borrowernumber = $input->param('borrowernumber');
> my $actionType     = $input->param('actionType') || '';
> my $modify         = $input->param('modify');
> my $delete         = $input->param('delete');
>@@ -154,7 +158,6 @@ $template->param( "quickadd" => 1 ) if ( $quickadd );
> $template->param( "duplicate" => 1 ) if ( $op eq 'duplicate' );
> $template->param( "checked" => 1 ) if ( defined($nodouble) && $nodouble eq 1 );
> if ( $op eq 'modify' or $op eq 'save' or $op eq 'duplicate' ) {
>-    my $patron = Koha::Patrons->find( $borrowernumber );
>     $borrower_data = $patron->unblessed;
>     $borrower_data->{category_type} = $patron->category->category_type;
> }
>@@ -311,7 +314,6 @@ if ($op eq 'save' || $op eq 'insert'){
> 
>     my $dateofbirth;
>     if ($op eq 'save' && $step == 3) {
>-        my $patron = Koha::Patrons->find( $borrowernumber );
>         $dateofbirth = $patron->dateofbirth;
>     }
>     else {
>diff --git a/members/members-update-do.pl b/members/members-update-do.pl
>index 7409c0a..627d766 100755
>--- a/members/members-update-do.pl
>+++ b/members/members-update-do.pl
>@@ -28,6 +28,7 @@ use Koha::Patron::Modifications;
> 
> my $query = new CGI;
> 
>+# FIXME Should be a checkauth call
> my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     {
>         template_name   => "about.tt",
>@@ -39,12 +40,17 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     }
> );
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+
> my @params = $query->param;
> 
> foreach my $param (@params) {
>     if ( $param =~ "^modify_" ) {
>         my (undef, $borrowernumber) = split( /_/, $param );
> 
>+        my $patron = Koha::Patrons->find($borrowernumber);
>+        next unless $logged_in_user->can_see_patron_infos( $patron );
>+
>         my $action = $query->param($param);
> 
>         if ( $action eq 'approve' ) {
>diff --git a/members/mod_debarment.pl b/members/mod_debarment.pl
>index 8958dd6..71a5cec 100755
>--- a/members/mod_debarment.pl
>+++ b/members/mod_debarment.pl
>@@ -32,6 +32,14 @@ my ( $loggedinuser, $cookie, $sessionID ) = checkauth( $cgi, 0, { borrowers => '
> my $borrowernumber = $cgi->param('borrowernumber');
> my $action         = $cgi->param('action');
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find($borrowernumber);
>+
>+# Ideally we should display a warning on the interface if the patron is not allowed
>+# to modify a debarment
>+# But a librarian is not supposed to hack the system
>+$action = '' unless $logged_in_user->can_see_patron_infos( $patron );
>+
> if ( $action eq 'del' ) {
>     DelDebarment( $cgi->param('borrower_debarment_id') );
> } elsif ( $action eq 'add' ) {
>diff --git a/members/moremember.pl b/members/moremember.pl
>index ff9969a..6b08ef6 100755
>--- a/members/moremember.pl
>+++ b/members/moremember.pl
>@@ -119,12 +119,9 @@ my $borrowernumber = $input->param('borrowernumber');
> my $error = $input->param('error');
> $template->param( error => $error ) if ( $error );
> 
>-my $patron        = Koha::Patrons->find($borrowernumber);
>-unless ( $patron ) {
>-    $template->param (unknowuser => 1);
>-    output_html_with_http_headers $input, $cookie, $template->output;
>-    exit;
>-}
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
> my $issues        = $patron->checkouts;
> my $balance       = $patron->account->balance;
>diff --git a/members/notices.pl b/members/notices.pl
>index c5e647b..760e4c9 100755
>--- a/members/notices.pl
>+++ b/members/notices.pl
>@@ -45,6 +45,9 @@ my ($template, $loggedinuser, $cookie)
> 				debug => 1,
> 				});
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> $template->param( $borrower );
> $template->param( picture => 1 ) if $patron->image;
> 
>diff --git a/members/pay.pl b/members/pay.pl
>index a5f1e7e..ba71c57 100755
>--- a/members/pay.pl
>+++ b/members/pay.pl
>@@ -67,7 +67,10 @@ if ( !$borrowernumber ) {
> }
> 
> # get borrower details
>-my $patron = Koha::Patrons->find( $borrowernumber );
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find($borrowernumber);
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category = $patron->category;
> our $borrower = $patron->unblessed;
> $borrower->{description} = $category->description;
>diff --git a/members/paycollect.pl b/members/paycollect.pl
>index 7623ca5..2b6cbb8 100755
>--- a/members/paycollect.pl
>+++ b/members/paycollect.pl
>@@ -50,6 +50,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> # get borrower details
> my $borrowernumber = $input->param('borrowernumber');
> my $patron         = Koha::Patrons->find( $borrowernumber );
>+
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $borrower       = $patron->unblessed;
> my $category       = $patron->category;
> $borrower->{description} = $category->description;
>diff --git a/members/print_overdues.pl b/members/print_overdues.pl
>index b63dec9..1606ce2 100755
>--- a/members/print_overdues.pl
>+++ b/members/print_overdues.pl
>@@ -27,6 +27,8 @@ use C4::Output;
> use C4::Members qw(GetOverduesForPatron);
> use C4::Overdues qw(parse_overdues_letter);
> 
>+use Koha::Patrons;
>+
> my $input = new CGI;
> 
> my $flagsrequired = { circulate => "circulate_remaining_permissions" };
>@@ -45,6 +47,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> my $borrowernumber = $input->param('borrowernumber');
> my $branchcode     = C4::Context->userenv->{'branch'};
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $overdues = GetOverduesForPatron($borrowernumber);
> 
> my $letter = parse_overdues_letter(
>diff --git a/members/printfeercpt.pl b/members/printfeercpt.pl
>index 21c7bbf..967b5f0 100755
>--- a/members/printfeercpt.pl
>+++ b/members/printfeercpt.pl
>@@ -50,7 +50,10 @@ my $borrowernumber=$input->param('borrowernumber');
> my $action = $input->param('action') || '';
> my $accountlines_id = $input->param('accountlines_id');
> 
>-my $patron = Koha::Patrons->find( $borrowernumber );
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category = $patron->category;
> my $data = $patron->unblessed;
> $data->{description} = $category->description;
>diff --git a/members/printinvoice.pl b/members/printinvoice.pl
>index bf86ac0..25e81cc 100755
>--- a/members/printinvoice.pl
>+++ b/members/printinvoice.pl
>@@ -49,7 +49,10 @@ my $borrowernumber  = $input->param('borrowernumber');
> my $action          = $input->param('action') || '';
> my $accountlines_id = $input->param('accountlines_id');
> 
>-my $patron = Koha::Patrons->find( $borrowernumber );
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category = $patron->category;
> my $data = $patron->unblessed;
> $data->{description} = $category->description;
>diff --git a/members/printslip.pl b/members/printslip.pl
>index dfe93d7..f7a0ea6 100755
>--- a/members/printslip.pl
>+++ b/members/printslip.pl
>@@ -74,6 +74,11 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> );
> 
> my $borrowernumber = $input->param('borrowernumber');
>+
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $branch=C4::Context->userenv->{'branch'};
> my ($slip, $is_html);
> if (my $letter = IssueSlip ($session->param('branch') || $branch, $borrowernumber, $print eq "qslip")) {
>diff --git a/members/purchase-suggestions.pl b/members/purchase-suggestions.pl
>index e93f948..537cd7d 100755
>--- a/members/purchase-suggestions.pl
>+++ b/members/purchase-suggestions.pl
>@@ -42,8 +42,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> 
> my $borrowernumber = $input->param('borrowernumber');
> 
>-# Set informations for the patron
>-my $patron = Koha::Patrons->find( $borrowernumber );
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category = $patron->category;
> my $data = $patron->unblessed;
> $data->{description} = $category->description;
>diff --git a/members/readingrec.pl b/members/readingrec.pl
>index 46d8ba0..0429b22 100755
>--- a/members/readingrec.pl
>+++ b/members/readingrec.pl
>@@ -64,6 +64,9 @@ if ($input->param('borrowernumber')) {
>     $data = $patron->unblessed;
> }
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $order = 'date_due desc';
> my $limit = 0;
> my $issues = ();
>@@ -78,6 +81,7 @@ if ( $borrowernumber eq C4::Context->preference('AnonymousPatron') ){
> 
> #   barcode export
> if ( $op eq 'export_barcodes' ) {
>+    # FIXME This should be moved out of this script
>     if ( $data->{'privacy'} < 2) {
>         my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 });
>         my @barcodes =
>diff --git a/members/routing-lists.pl b/members/routing-lists.pl
>index 2942472..fef3a56 100755
>--- a/members/routing-lists.pl
>+++ b/members/routing-lists.pl
>@@ -1,4 +1,3 @@
>-#!/usr/bin/perl
> 
> # Copyright 2012 Prosentient Systems
> #
>@@ -48,36 +47,35 @@ my $borrowernumber = $query->param('borrowernumber');
> 
> my $branch = C4::Context->userenv->{'branch'};
> 
>-# get the borrower information.....
>-my ( $patron, $patron_info );
>-if ($borrowernumber) {
>-    $patron = Koha::Patrons->find( $borrowernumber );
>-    my $category = $patron->category;
>-    my $patron_info = $patron->unblessed;
>-    $patron_info->{description} = $category->description;
>-    $patron_info->{category_type} = $category->category_type;
>-
>-  my $count;
>-  my @borrowerSubscriptions;
>-  ($count, @borrowerSubscriptions) = GetSubscriptionsFromBorrower($borrowernumber );
>-  my @subscripLoop;
>-
>-    foreach my $num_res (@borrowerSubscriptions) {
>-        my %getSubscrip;
>-        $getSubscrip{subscriptionid}	= $num_res->{'subscriptionid'};
>-        $getSubscrip{title}			= $num_res->{'title'};
>-        $getSubscrip{borrowernumber}		= $num_res->{'borrowernumber'};
>-        push( @subscripLoop, \%getSubscrip );
>-    }
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $query, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
>+my $category = $patron->category;
>+my $patron_info = $patron->unblessed;
>+$patron_info->{description} = $category->description;
>+$patron_info->{category_type} = $category->category_type;
>+
>+my $count;
>+my @borrowerSubscriptions;
>+($count, @borrowerSubscriptions) = GetSubscriptionsFromBorrower($borrowernumber );
>+my @subscripLoop;
>+
>+foreach my $num_res (@borrowerSubscriptions) {
>+    my %getSubscrip;
>+    $getSubscrip{subscriptionid} = $num_res->{'subscriptionid'};
>+    $getSubscrip{title}          = $num_res->{'title'};
>+    $getSubscrip{borrowernumber} = $num_res->{'borrowernumber'};
>+    push( @subscripLoop, \%getSubscrip );
>+}
> 
>-    $template->param(
>-        countSubscrip => scalar @subscripLoop,
>-        subscripLoop  => \@subscripLoop,
>-        routinglistview => 1
>-    );
>+$template->param(
>+    countSubscrip => scalar @subscripLoop,
>+    subscripLoop  => \@subscripLoop,
>+    routinglistview => 1
>+);
> 
>-    $template->param( adultborrower => 1 ) if ( $patron_info->{category_type} eq 'A' );
>-}
>+$template->param( adultborrower => 1 ) if ( $patron_info->{category_type} eq 'A' );
> 
> ##################################################################################
> 
>diff --git a/members/setstatus.pl b/members/setstatus.pl
>index 0eb8ce5..6667b70 100755
>--- a/members/setstatus.pl
>+++ b/members/setstatus.pl
>@@ -35,7 +35,7 @@ use Koha::Patrons;
> 
> my $input = new CGI;
> 
>-checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
>+my ( $loggedinuser ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
> 
> my $destination = $input->param("destination") || '';
> my $borrowernumber=$input->param('borrowernumber');
>@@ -45,14 +45,22 @@ my $reregistration = $input->param('reregistration') || '';
> my $dbh = C4::Context->dbh;
> my $dateexpiry;
> 
>-if ( $reregistration eq 'y' ) {
>-    # re-reregistration function to automatic calcul of date expiry
>-    $dateexpiry = Koha::Patrons->find( $borrowernumber )->renew_account;
>-} else {
>-    my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
>-    $sth->execute( $status, $borrowernumber );
>-	$sth->finish;
>-	}
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+
>+# Ideally we should display a warning on the interface if the logged in user is
>+# not allowed to modify this patron.
>+# But a librarian is not supposed to hack the system
>+unless ( $logged_in_user->can_see_patron_infos($patron) ) {
>+    if ( $reregistration eq 'y' ) {
>+        # re-reregistration function to automatic calcul of date expiry
>+        $dateexpiry = $patron->renew_account;
>+    } else {
>+        my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
>+        $sth->execute( $status, $borrowernumber );
>+        $sth->finish;
>+    }
>+}
> 
> if($destination eq "circ"){
>     if($dateexpiry){
>diff --git a/members/statistics.pl b/members/statistics.pl
>index cec42ee..9f6d551 100755
>--- a/members/statistics.pl
>+++ b/members/statistics.pl
>@@ -47,13 +47,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
> 
> my $borrowernumber = $input->param('borrowernumber');
> 
>-# Set informations for the patron
>-my $patron = Koha::Patrons->find( $borrowernumber );
>-unless ( $patron ) {
>-    $template->param (unknowuser => 1);
>-    output_html_with_http_headers $input, $cookie, $template->output;
>-    exit;
>-}
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
> 
> my $category = $patron->category;
> my $borrower= $patron->unblessed;
>diff --git a/members/summary-print.pl b/members/summary-print.pl
>index 0a30587..1981a49 100755
>--- a/members/summary-print.pl
>+++ b/members/summary-print.pl
>@@ -43,7 +43,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     }
> );
> 
>-my $patron = Koha::Patrons->find( $borrowernumber );
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> my $category = $patron->category;
> my $data = $patron->unblessed;
> $data->{description} = $category->description;
>diff --git a/members/update-child.pl b/members/update-child.pl
>index 81bd05b..3d25a67 100755
>--- a/members/update-child.pl
>+++ b/members/update-child.pl
>@@ -58,6 +58,10 @@ my $cattype        = $input->param('cattype');
> my $catcode_multi = $input->param('catcode_multi');
> my $op             = $input->param('op');
> 
>+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
>+my $patron         = Koha::Patrons->find( $borrowernumber );
>+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
>+
> if ( $op eq 'multi' ) {
>     # FIXME - what are the possible upgrade paths?  C -> A , C -> S ...
>     #   currently just allowing C -> A
>@@ -72,7 +76,6 @@ if ( $op eq 'multi' ) {
> }
> 
> elsif ( $op eq 'update' ) {
>-    my $patron = Koha::Patrons->find( $borrowernumber );
>     my $member = $patron->unblessed;
>     $member->{'guarantorid'}  = 0;
>     $member->{'categorycode'} = $catcode;
>-- 
>2.9.3

Actions: View | Diff | Splinter Review

Attachments on bug 18403: 62010 | 62011 | 62012 | 62013 | 62014 | 62015 | 62016 | 62017 | 62018 | 62019 | 62020 | 62021 | 62022 | 62023 | 62024 | 62025 | 62026 | 62027 | 62028 | 62029 | 62030 | 62031 | 62032 | 62033 | 62302 | 62303 | 62830 | 62831 | 62832 | 62833 | 62834 | 62835 | 62836 | 62837 | 62838 | 62839 | 62840 | 62841 | 62842 | 62843 | 62844 | 62845 | 62846 | 62847 | 62848 | 62849 | 62850 | 62851 | 62852 | 62853 | 62854 | 62855 | 71392 | 71394 | 71500 | 71501 | 71502 | 71503 | 71504 | 71505 | 71506 | 71507 | 71508 | 71509 | 71510 | 71511 | 71512 | 71513 | 71514 | 71515 | 71516 | 71517 | 71518 | 71519 | 71520 | 71521 | 71522 | 71523 | 71524 | 71525 | 71526 | 71527 | 71528 | 71529 | 71530 | 71767