From 8996d840f3367c02ae865b2a4a8c4e30d61affde Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 3 Sep 2021 12:01:12 +0200 Subject: [PATCH] Bug 28947: Prevent OPAC user to create new users Content-Type: text/plain; charset=utf-8 This patch prevents an existing user from exploiting the patron edit form in order to force create new patrons To test: Try all combinations of PatronSelfRegistration and PatronSelfRegistrationVerifyByEmail with and without this patch. Signed-off-by: Nick Clemens Signed-off-by: Marcel de Rooy --- opac/opac-memberentry.pl | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index c940a6e1af..475ee6e943 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -64,6 +64,11 @@ unless ( C4::Context->preference('PatronSelfRegistration') || $borrowernumber ) } my $action = $cgi->param('action') || q{}; +if ( $borrowernumber && ( $action eq 'create' || $action eq 'new' ) ) { + print $cgi->redirect("/cgi-bin/koha/opac-main.pl"); + exit; +} + if ( $action eq q{} ) { if ($borrowernumber) { $action = 'edit'; -- 2.20.1