From 68ae2a7bca122badd2f95c717c6c83dc8acf14ed Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 23 Apr 2025 04:37:30 +0000 Subject: [PATCH] Bug 39372: (follow-up) Add sysprefs to controller scripts By adding the sysprefs to the controller scripts, we can prevent accidental creations or malicious creations. In theory, these error conditions shouldn't be triggered, since only the allowed actions will be displayed on the UI, but we need to cover all our bases. The error messages in opac-shelves.pl aren't currently translatable. The error handling will need some refactoring to make them translatable. However, in this particular case, it should be OK, since no one but a pen tester should bump into this message. --- opac/opac-addbybiblionumber.pl | 2 +- opac/opac-shelves.pl | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/opac/opac-addbybiblionumber.pl b/opac/opac-addbybiblionumber.pl index 368b8f17682..1768a566ca1 100755 --- a/opac/opac-addbybiblionumber.pl +++ b/opac/opac-addbybiblionumber.pl @@ -61,7 +61,7 @@ if ( $op && $op !~ /^cud-/ ) { } elsif ($newvirtualshelf) { if ( $loggedinuser > 0 - and ( !$public + and ( !$public && C4::Context->preference('OpacAllowPrivateListCreation') or $public and $loggedinuser > 0 && C4::Context->preference('OpacAllowPublicListCreation') ) ) { diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl index bd908db01e2..46270e79227 100755 --- a/opac/opac-shelves.pl +++ b/opac/opac-shelves.pl @@ -121,6 +121,12 @@ if ( $op eq 'add_form' ) { if ($loggedinuser) { my $allow_changes_from = $query->param('allow_changes_from'); eval { + if ( $public && !C4::Context->preference('OpacAllowPublicListCreation') ) { + die "Public list creation is not authorized\n"; + } elsif ( !$public && !C4::Context->preference('OpacAllowPrivateListCreation') ) { + die "Private list creation is not authorized\n"; + } + $shelf = Koha::Virtualshelf->new( { shelfname => scalar $query->param('shelfname'), -- 2.39.5