@@ -, +, @@ users /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX --- .../prog/en/modules/virtualshelves/sendshelfform.tt | 1 + virtualshelves/sendshelf.pl | 13 +++++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt @@ -3,6 +3,7 @@ [% INCLUDE 'doc-head-close.inc' %] +[% INCLUDE 'blocking_errors.inc' %]
[% IF ( email ) %] [% IF ( SENT ) %] --- a/virtualshelves/sendshelf.pl +++ a/virtualshelves/sendshelf.pl @@ -31,13 +31,16 @@ use C4::Biblio qw( GetMarcSubjects ); use C4::Items qw( GetItemsInfo ); -use C4::Output qw( output_html_with_http_headers ); +use C4::Output qw( + output_html_with_http_headers + output_and_exit +); use Koha::Email; use Koha::Virtualshelves; my $query = CGI->new; -my ( $template, $borrowernumber, $cookie ) = get_template_and_user( +my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { template_name => "virtualshelves/sendshelfform.tt", query => $query, @@ -49,7 +52,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( my $shelfid = $query->param('shelfid'); my $to_address = $query->param('email'); -my $dbh = C4::Context->dbh; +my $shelf = Koha::Virtualshelves->find( $shelfid ); + +output_and_exit( $query, $cookie, $template, 'insufficient_permission' ) + if $shelf && !$shelf->can_be_viewed( $loggedinuser ); if ($to_address) { my $comment = $query->param('comment'); @@ -63,7 +69,6 @@ if ($to_address) { } ); - my $shelf = Koha::Virtualshelves->find( $shelfid ); my $contents = $shelf->get_contents; my $marcflavour = C4::Context->preference('marcflavour'); my $iso2709; --