From b69a4887cdf88301dddf7f52b6b7994b6a60e641 Mon Sep 17 00:00:00 2001
From: simith <simith@inlibro.com>
Date: Wed, 30 Jul 2014 11:25:00 -0400
Subject: [PATCH] Bug 12528 - Enable staff to deny message setting access to
 patrons on the OPAC

QA Follow up

This patch will stop a person without access hitting the url directly and
being able to change their messaging preferences.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
I fixed some minor conflicts, so I'm sending all patches w/ signoff
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt |    6 +++++-
 opac/opac-messaging.pl                                     |    4 +++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
index c13adc4..5656d35 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
@@ -5,7 +5,6 @@
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='opac-messaging' %]
 [% INCLUDE 'masthead.inc' %]
-
 <div class="main">
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
@@ -21,6 +20,7 @@
                 </div>
             </div>
             <div class="span10">
+                [% IF (Authorized) %]
                 <div id="usermessaging">
                     <h3>Your messaging settings</h3>
                     [% IF ( settings_updated ) %]
@@ -120,6 +120,10 @@
                         </fieldset>
                     </form>
                 </div> <!-- / #usermessaging -->
+                [% ELSE %]
+                    <h4>You are not allowed to call this page directly</h4>
+                    <span> To report this problem, you can <a href="mailto:[% admin %]">email the Koha Administrator</a>.</span>
+                [% END %]
             </div> <!-- / .span10 -->
         </div> <!-- / .row-fluid -->
     </div> <!-- / .container-fluid -->
diff --git a/opac/opac-messaging.pl b/opac/opac-messaging.pl
index b0c1cde..d365e32 100755
--- a/opac/opac-messaging.pl
+++ b/opac/opac-messaging.pl
@@ -68,6 +68,8 @@ $template->param( BORROWER_INFO         => [ $borrower ],
                   messagingview         => 1,
                   SMSnumber => defined $borrower->{'smsalertnumber'} ? $borrower->{'smsalertnumber'} : $borrower->{'mobile'},
                   SMSSendDriver                =>  C4::Context->preference("SMSSendDriver"),
-                  TalkingTechItivaPhone        =>  C4::Context->preference("TalkingTechItivaPhoneNotification") );
+                  TalkingTechItivaPhone        =>  C4::Context->preference("TalkingTechItivaPhoneNotification"),
+                  admin                        =>  C4::Context->preference('KohaAdminEmailAddress'),
+                  Authorized                   =>  C4::Context->preference('OPACEnhancedMessagingPreferences'));
 
 output_html_with_http_headers $query, $cookie, $template->output;
-- 
1.7.10.4