From 1bd020647032d506b012d0015403bf6d3944b9a0 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Wed, 23 Apr 2014 12:59:25 -0400
Subject: [PATCH] Bug 6322 - It's possible to view lists/virtualshelves even
 when virtualshelves is off
Content-Type: text/plain; charset="utf-8"

If the user knows the URL for OPAC lists they can access them even with
the virtualshelves preference turned off. This patch copies the solution
added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists
pages.

To test, apply the patch and set the virtualshelves system preference to
"don't allow."

- Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to
  an Error 404 page.
- Also check:
  - /cgi-bin/koha/opac-shareshelf.pl.
  - /cgi-bin/koha/opac-downloadshelf.pl
  - /cgi-bin/koha/opac-sendshelf.pl
  - /cgi-bin/koha/opac-addbybiblionumber.pl
- Turn virtualshelves back on. Access to lists and list sharing should
  be restored.
---
 opac/opac-addbybiblionumber.pl |    6 ++++++
 opac/opac-downloadshelf.pl     |    6 ++++++
 opac/opac-sendshelf.pl         |    6 ++++++
 opac/opac-shareshelf.pl        |    8 ++++++++
 opac/opac-shelves.pl           |    6 ++++++
 5 files changed, 32 insertions(+)

diff --git a/opac/opac-addbybiblionumber.pl b/opac/opac-addbybiblionumber.pl
index 004577d..62186f0 100755
--- a/opac/opac-addbybiblionumber.pl
+++ b/opac/opac-addbybiblionumber.pl
@@ -42,6 +42,12 @@ our $authorized          = 1;
 our $errcode		= 0;
 our @biblios;
 
+# if virtualshelves is disabled, leave immediately
+if ( ! C4::Context->preference('virtualshelves') ) {
+    print $query->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 our ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
         template_name   => "opac-addbybiblionumber.tmpl",
diff --git a/opac/opac-downloadshelf.pl b/opac/opac-downloadshelf.pl
index e94b76c..127cd0c 100755
--- a/opac/opac-downloadshelf.pl
+++ b/opac/opac-downloadshelf.pl
@@ -34,6 +34,12 @@ use C4::Csv;
 use utf8;
 my $query = new CGI;
 
+# if virtualshelves is disabled, leave immediately
+if ( ! C4::Context->preference('virtualshelves') ) {
+    print $query->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 my ( $template, $borrowernumber, $cookie ) = get_template_and_user (
     {
         template_name   => "opac-downloadshelf.tmpl",
diff --git a/opac/opac-sendshelf.pl b/opac/opac-sendshelf.pl
index 852ef8d..4155772 100755
--- a/opac/opac-sendshelf.pl
+++ b/opac/opac-sendshelf.pl
@@ -36,6 +36,12 @@ use C4::Members;
 
 my $query = new CGI;
 
+# if virtualshelves is disabled, leave immediately
+if ( ! C4::Context->preference('virtualshelves') ) {
+    print $query->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 my ( $template, $borrowernumber, $cookie ) = get_template_and_user (
     {
         template_name   => "opac-sendshelfform.tmpl",
diff --git a/opac/opac-shareshelf.pl b/opac/opac-shareshelf.pl
index b12765b..fb5793e 100755
--- a/opac/opac-shareshelf.pl
+++ b/opac/opac-shareshelf.pl
@@ -34,6 +34,14 @@ use C4::Members ();
 use C4::Output;
 use C4::VirtualShelves;
 
+
+# if virtualshelves is disabled, leave immediately
+if ( ! C4::Context->preference('virtualshelves') ) {
+    my $query = new CGI;
+    print $query->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 #-------------------------------------------------------------------------------
 
 my $pvar = _init( {} );
diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl
index e17e95f..b336e16 100755
--- a/opac/opac-shelves.pl
+++ b/opac/opac-shelves.pl
@@ -25,6 +25,12 @@ use C4::Auth;
 
 my $query = CGI->new();
 
+# if virtualshelves is disabled, leave immediately
+if ( ! C4::Context->preference('virtualshelves') ) {
+    print $query->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
         template_name   => "opac-shelves.tmpl",
         query           => $query,
-- 
1.7.9.5