From fb87a08a1b00f993f97ee0fe21ad6379b0d3b136 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 25 Feb 2014 10:53:36 +0100 Subject: [PATCH] Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed If a user pass '&batch=1' to the url, he was allowed to access to the batch checkout page even if the patron is not in an authorised category. This patch also fixes the link to "Batch check out" from the "Details" tab (cf changes in circ-menu.inc). --- circ/circulation.pl | 22 +++++++++++++------- .../intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- .../en/modules/circ/circulation_batch_checkouts.tt | 4 +++- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/circ/circulation.pl b/circ/circulation.pl index 2b12a00..56a0fa0 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -85,7 +85,6 @@ if (!C4::Context->userenv && !$branch){ } my $barcodes = []; -my $batch = $query->param('batch'); if ( my $barcode = $query->param('barcode') ) { $barcodes = [ $barcode ]; } else { @@ -105,9 +104,20 @@ if ( my $barcode = $query->param('barcode') ) { $barcodes = [ uniq @$barcodes ]; -my $template_name = $batch - ? q|circ/circulation_batch_checkouts.tt| - : q|circ/circulation.tt|; +my $template_name = q|circ/circulation.tt|; +my $borrowernumber = $query->param('borrowernumber'); +my $borrower = $borrowernumber ? GetMemberDetails( $borrowernumber, 0 ) : undef; +my $batch = $query->param('batch'); +my $batch_allowed = 0; +if ( $batch ) { + $template_name = q|circ/circulation_batch_checkouts.tt|; + my @batch_category_codes = split '\|', C4::Context->preference('batch_checkouts'); + if ( grep {/^$borrower->{categorycode}$/} @batch_category_codes ) { + $batch_allowed = 1; + } else { + $barcodes = []; + } +} my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( { @@ -131,7 +141,6 @@ for (@failedreturns) { $return_failed{$_} = 1; } my $findborrower = $query->param('findborrower') || q{}; $findborrower =~ s|,| |g; -my $borrowernumber = $query->param('borrowernumber'); $branch = C4::Context->userenv->{'branch'}; $printer = C4::Context->userenv->{'branchprinter'}; @@ -245,9 +254,7 @@ if ($findborrower) { } # get the borrower information..... -my $borrower; if ($borrowernumber) { - $borrower = GetMemberDetails( $borrowernumber, 0 ); my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); # Warningdate is the date that the warning starts appearing @@ -777,6 +784,7 @@ $template->param( inprocess => $inprocess, is_child => ($borrower->{'category_type'} eq 'C'), $view => 1, + batch_allowed => $batch_allowed, soundon => C4::Context->preference("SoundOn"), fast_cataloging => $fast_cataloging, CircAutoPrintQuickSlip => C4::Context->preference("CircAutoPrintQuickSlip"), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc index f619c36..689d5b0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc @@ -65,7 +65,7 @@