From cf0056d0cfb30d94df09df6257e3bcff853b4bdf Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 23 Apr 2025 04:37:30 +0000 Subject: [PATCH] Bug 39372: (follow-up) Add sysprefs to controller scripts By adding the sysprefs to the controller scripts, we can prevent accidental creations or malicious creations. In theory, these error conditions shouldn't be triggered, since only the allowed actions will be displayed on the UI, but we need to cover all our bases. The error messages in opac-shelves.pl aren't currently translatable. The error handling will need some refactoring to make them translatable. However, in this particular case, it should be OK, since no one but a pen tester should bump into this message. --- opac/opac-addbybiblionumber.pl | 2 +- opac/opac-shelves.pl | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/opac/opac-addbybiblionumber.pl b/opac/opac-addbybiblionumber.pl index 23c03ab0de..f886dc61c2 100755 --- a/opac/opac-addbybiblionumber.pl +++ b/opac/opac-addbybiblionumber.pl @@ -61,7 +61,7 @@ if ( $op && $op !~ /^cud-/ ) { } elsif ($newvirtualshelf) { if ( $loggedinuser > 0 - and ( !$public + and ( !$public && C4::Context->preference('OpacAllowPrivateListCreation') or $public and $loggedinuser > 0 && C4::Context->preference('OpacAllowPublicListCreation') ) ) { diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl index e7dfc65c58..76160e8ba0 100755 --- a/opac/opac-shelves.pl +++ b/opac/opac-shelves.pl @@ -121,6 +121,12 @@ if ( $op eq 'add_form' ) { if ($loggedinuser) { my $allow_changes_from = $query->param('allow_changes_from'); eval { + if ( $public && !C4::Context->preference('OpacAllowPublicListCreation') ) { + die "Public list creation is not authorized\n"; + } elsif ( !$public && !C4::Context->preference('OpacAllowPrivateListCreation') ) { + die "Private list creation is not authorized\n"; + } + $shelf = Koha::Virtualshelf->new( { shelfname => scalar $query->param('shelfname'), -- 2.39.5