@@ -, +, @@
users
/cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX
---
.../prog/en/modules/virtualshelves/sendshelfform.tt | 1 +
virtualshelves/sendshelf.pl | 13 +++++++++----
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
@@ -3,6 +3,7 @@
[% INCLUDE 'doc-head-close.inc' %]
+[% INCLUDE 'blocking_errors.inc' %]
[% IF ( email ) %]
[% IF ( SENT ) %]
--- a/virtualshelves/sendshelf.pl
+++ a/virtualshelves/sendshelf.pl
@@ -31,13 +31,16 @@ use C4::Biblio qw(
GetMarcSubjects
);
use C4::Items qw( GetItemsInfo );
-use C4::Output qw( output_html_with_http_headers );
+use C4::Output qw(
+ output_html_with_http_headers
+ output_and_exit
+);
use Koha::Email;
use Koha::Virtualshelves;
my $query = CGI->new;
-my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
+my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "virtualshelves/sendshelfform.tt",
query => $query,
@@ -49,7 +52,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my $shelfid = $query->param('shelfid');
my $to_address = $query->param('email');
-my $dbh = C4::Context->dbh;
+my $shelf = Koha::Virtualshelves->find( $shelfid );
+
+output_and_exit( $query, $cookie, $template, 'insufficient_permission' )
+ if $shelf && !$shelf->can_be_viewed( $loggedinuser );
if ($to_address) {
my $comment = $query->param('comment');
@@ -63,7 +69,6 @@ if ($to_address) {
}
);
- my $shelf = Koha::Virtualshelves->find( $shelfid );
my $contents = $shelf->get_contents;
my $marcflavour = C4::Context->preference('marcflavour');
my $iso2709;
--