From 999da8921b377a28123adea71f1f151ecb05923e Mon Sep 17 00:00:00 2001 From: Laura_Escamilla Date: Tue, 22 Apr 2025 15:57:22 +0000 Subject: [PATCH] Bug 33440: Added permission requirements to unauthorized_transfer Signed-off-by: Roman Dolny --- Koha/Virtualshelf.pm | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Koha/Virtualshelf.pm b/Koha/Virtualshelf.pm index 6cddd84fd3..694659ab16 100644 --- a/Koha/Virtualshelf.pm +++ b/Koha/Virtualshelf.pm @@ -337,6 +337,19 @@ sub cannot_be_transferred { if ( !Koha::Patrons->find($to) ) { return 'new_owner_not_found'; } + my $to_patron = Koha::Patrons->find($to); + + if ( $self->public ) { + return 'unauthorized_transfer' + unless C4::Auth::haspermission( + $to_patron->userid, + { + lists => [ + 'create_public_lists', 'delete_public_lists', 'edit_public_list_contents', 'edit_public_lists' + ] + } + ); + } if ( !$self->public && !$shares->search( { borrowernumber => $to } )->count ) { return 'new_owner_has_no_share'; } -- 2.39.5