From ad085628c46fbb7e43b8d9cf96caf2ffc17e2fe9 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 25 Feb 2014 10:53:36 +0100 Subject: [PATCH] Bug 11759: (follow-up) Prevent access to the batch checkout if not allowed If a user pass '&batch=1' to the url, he was allowed to access to the batch checkout page even if the patron is not in an authorised category. This patch also fixes the link to "Batch check out" from the "Details" tab (cf changes in circ-menu.inc). --- circ/circulation.pl | 21 ++++++++++++++------ .../intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- .../en/modules/circ/circulation_batch_checkouts.tt | 4 +++- 3 files changed, 19 insertions(+), 8 deletions(-) diff --git a/circ/circulation.pl b/circ/circulation.pl index 2b12a00..cc6d05f 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -85,7 +85,6 @@ if (!C4::Context->userenv && !$branch){ } my $barcodes = []; -my $batch = $query->param('batch'); if ( my $barcode = $query->param('barcode') ) { $barcodes = [ $barcode ]; } else { @@ -105,9 +104,20 @@ if ( my $barcode = $query->param('barcode') ) { $barcodes = [ uniq @$barcodes ]; -my $template_name = $batch - ? q|circ/circulation_batch_checkouts.tt| - : q|circ/circulation.tt|; +my $template_name = q|circ/circulation.tt|; +my $borrowernumber = $query->param('borrowernumber'); +my $borrower = $borrowernumber ? GetMember( { borrowernumber => $borrowernumber} ) : undef; +my $batch = $query->param('batch'); +my $batch_allowed = 0; +if ( $batch ) { + $template_name = q|circ/circulation_batch_checkouts.tt|; + my @batch_category_codes = split '\|', C4::Context->preference('batch_checkouts'); + if ( grep {/^$borrower->{categorycode}$/} @batch_category_codes ) { + $batch_allowed = 1; + } else { + $barcodes = []; + } +} my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( { @@ -131,7 +141,6 @@ for (@failedreturns) { $return_failed{$_} = 1; } my $findborrower = $query->param('findborrower') || q{}; $findborrower =~ s|,| |g; -my $borrowernumber = $query->param('borrowernumber'); $branch = C4::Context->userenv->{'branch'}; $printer = C4::Context->userenv->{'branchprinter'}; @@ -245,7 +254,6 @@ if ($findborrower) { } # get the borrower information..... -my $borrower; if ($borrowernumber) { $borrower = GetMemberDetails( $borrowernumber, 0 ); my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); @@ -777,6 +785,7 @@ $template->param( inprocess => $inprocess, is_child => ($borrower->{'category_type'} eq 'C'), $view => 1, + batch_allowed => $batch_allowed, soundon => C4::Context->preference("SoundOn"), fast_cataloging => $fast_cataloging, CircAutoPrintQuickSlip => C4::Context->preference("CircAutoPrintQuickSlip"), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc index f619c36..689d5b0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc @@ -65,7 +65,7 @@