From 0ec9c40022c51f66e13497e30d9f93f84032f964 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 30 Jan 2024 14:53:03 +0100
Subject: [PATCH] Bug 35941: Limit club list to those from the logged in user

clubs-tab get the patron's id from the parameter. At the OPAC we must
use the one from the logged in user, to prevent leak to other users

Test plan:
Have 2 clubs: A, B
Enroll to A with patron borrowernumber=1
Enroll to B with patron borrowernumber=2
Log in with patron 1 and hit:
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
=> OK
Now hit
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
=> oops

Apply this patch, try again.
The "borrowernumber" parameter is no longer used to fetch the club list.
---
 .../opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt  |  6 +++---
 .../opac-tmpl/bootstrap/en/modules/clubs/enroll.tt     |  3 +--
 opac/clubs/clubs-tab.pl                                | 10 ++++------
 opac/clubs/enroll.pl                                   |  8 ++------
 4 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
index 25c1e0363b2..818e74d3c67 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
@@ -58,7 +58,7 @@
                     <td>[% c.name | html %]</td>
                     <td>[% c.description | html %]</td>
                     <td>
-                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && borrower.notice_email_address ) %]
+                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && patron.notice_email_address ) %]
                             <button class="btn btn-sm btn-primary load_enrollment" data-id="[% c.id | html%]">
                                 <i class="fa fa-plus" aria-hidden="true"></i> Enroll
                             </button>
@@ -76,7 +76,7 @@
 <script>
 function loadEnrollmentForm( id ) {
     $("body").css("cursor", "progress");
-    $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber | html %]&id=' + id, function() {
+    $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% patron.borrowernumber | html %]&id=' + id, function() {
         $("body").css("cursor", "default");
     });
 
@@ -91,7 +91,7 @@ function cancelEnrollment( id ) {
         data: { id: id },
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrower.borrowernumber | html %]', function() {
+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% patron.borrowernumber | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
index a8dde0bbdf3..f6d35ca76b5 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
@@ -8,7 +8,6 @@
     <form id="patron-enrollment-form">
         <legend class="sr-only">Enrollment</legend>
         <input type="hidden" name="id" value="[% club.id | html %]" />
-        <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
         <fieldset class="rows">
             <ol>
                 [% FOREACH f IN club.club_template.club_template_enrollment_fields %]
@@ -44,7 +43,7 @@ function addEnrollment() {
         data: $( "#patron-enrollment-form" ).serialize(),
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?id=[% club.id | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
diff --git a/opac/clubs/clubs-tab.pl b/opac/clubs/clubs-tab.pl
index 8c3f7583753..28fcd1ed690 100755
--- a/opac/clubs/clubs-tab.pl
+++ b/opac/clubs/clubs-tab.pl
@@ -35,17 +35,15 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
-my $borrowernumber = $cgi->param('borrowernumber');
+my $patron = Koha::Patrons->find( $loggedinuser );
 
-my $borrower = Koha::Patrons->find($borrowernumber);
-
-my @enrollments = $borrower->get_club_enrollments->as_list;
-my @clubs = $borrower->get_enrollable_clubs( my $opac = 1 )->as_list;
+my @enrollments = $patron->get_club_enrollments->as_list;
+my @clubs = $patron->get_enrollable_clubs( my $opac = 1 )->as_list;
 
 $template->param(
     enrollments => \@enrollments,
     clubs       => \@clubs,
-    borrower    => $borrower,
+    patron      => $patron,
 );
 
 output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );
diff --git a/opac/clubs/enroll.pl b/opac/clubs/enroll.pl
index a71990196fd..9fcfd360046 100755
--- a/opac/clubs/enroll.pl
+++ b/opac/clubs/enroll.pl
@@ -35,14 +35,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
-my $id             = $cgi->param('id');
-my $borrowernumber = $cgi->param('borrowernumber');
-
-my $club = Koha::Clubs->find($id);
+my $id = $cgi->param('id');
 
 $template->param(
-    club           => $club,
-    borrowernumber => $borrowernumber,
+    club => Koha::Clubs->find($id),
 );
 
 output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );
-- 
2.34.1