From 3dac10adc20db01dfcd47a224e055ada810e38fe Mon Sep 17 00:00:00 2001 From: Arthur Suzuki Date: Tue, 4 Jun 2024 00:43:23 +0200 Subject: [PATCH] Bug 36975 : do not allow unprivileged user to batch modify records source --- Koha/BackgroundJob/BatchUpdateBiblio.pm | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Koha/BackgroundJob/BatchUpdateBiblio.pm b/Koha/BackgroundJob/BatchUpdateBiblio.pm index 64e429d0b7f..4636fa5e4d7 100644 --- a/Koha/BackgroundJob/BatchUpdateBiblio.pm +++ b/Koha/BackgroundJob/BatchUpdateBiblio.pm @@ -17,6 +17,7 @@ package Koha::BackgroundJob::BatchUpdateBiblio; use Modern::Perl; +use Koha::Patrons; use Koha::Biblios; use Koha::Virtualshelves; use Koha::SearchEngine; @@ -133,6 +134,15 @@ sub enqueue { return unless exists $args->{mmtid}; return unless exists $args->{record_ids}; + my $borrowernumber = (C4::Context->userenv) ? C4::Context->userenv->{number} : undef; + my $patron = Koha::Patrons->find($borrowernumber); + unless ( $patron->has_permission( { editcatalogue => 'edit_locked_records' } ) ) { + my @actions = GetModificationTemplateActions($args->{mmtid}); + foreach my $a ( @actions ) { + Koha::Exceptions::BackgroundJob->throw('You must have record source permissions to schedule this job') if $a->{'action'} eq 'set_record_source'; + } + } + $self->SUPER::enqueue({ job_size => scalar @{$args->{record_ids}}, job_args => $args, -- 2.45.1