From 9c50e410a0fa9cf77b7539a53a0bb4bef25cb3f1 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 6 Apr 2017 12:42:03 -0300 Subject: [PATCH] Bug 18403: Add new methods Koha::Patrons->search_limited and use it where needed Most of the time when we search for patrons we do not want to search for all patrons, but just the ones the logged in user is allowed to see the information. This patch takes care of that by adding a new search_limited method to Koha::Patrons. When called this method only search for patrons that the logged in user is allowed to see. Test plan: Patron autocomplete search should be limited --- Koha/Patrons.pm | 35 +++++++++++++++++++++++++++++++++++ circ/ysearch.pl | 2 +- members/memberentry.pl | 2 +- opac/opac-memberentry.pl | 2 +- 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/Koha/Patrons.pm b/Koha/Patrons.pm index 6548f02..4749b12 100644 --- a/Koha/Patrons.pm +++ b/Koha/Patrons.pm @@ -41,6 +41,41 @@ Koha::Patron - Koha Patron Object class =cut +=head3 search_limited + +my $patrons = Koha::Patrons->search_limit( $params, $attributes ); + +Returns all the patrons the logged in user is allowed to see + +=cut + +sub search_limited { + my ( $self, $params, $attributes ) = @_; + + my $userenv = C4::Context->userenv; + my @restricted_branchcodes; + my $logged_in_user = Koha::Patrons->find( $userenv->{number} ); + if ( $logged_in_user and not + $logged_in_user->can( + { borrowers => 'view_borrower_infos_from_any_libraries' } + ) + ) + { + if ( my $library_groups = $logged_in_user->library->library_groups ) + { + while ( my $library_group = $library_groups->next ) { + push @restricted_branchcodes, + $library_group->parent->children->get_column('branchcode'); + } + } + else { + push @restricted_branchcodes, $userenv->{branch}; + } + } + $params->{'me.branchcode'} = { -in => \@restricted_branchcodes } if @restricted_branchcodes; + return $self->search( $params, $attributes ); +} + =head3 search_housebound_choosers Returns all Patrons which are Housebound choosers. diff --git a/circ/ysearch.pl b/circ/ysearch.pl index 37eaed4..7a75c80 100755 --- a/circ/ysearch.pl +++ b/circ/ysearch.pl @@ -67,7 +67,7 @@ foreach my $p (@parts) { push( @params, { branchcode => C4::Context->userenv->{branch} } ) if $limit_on_branch; -my $borrowers_rs = Koha::Patrons->search( +my $borrowers_rs = Koha::Patrons->search_limited( { -and => \@params }, { # Get the first 10 results diff --git a/members/memberentry.pl b/members/memberentry.pl index 4a1394c..c6d9ccd 100755 --- a/members/memberentry.pl +++ b/members/memberentry.pl @@ -241,7 +241,7 @@ if ( ( $op eq 'insert' ) and !$nodouble ) { $conditions->{dateofbirth} = $newdata{dateofbirth} if $newdata{dateofbirth}; } $nodouble = 1; - my $patrons = Koha::Patrons->search($conditions); + my $patrons = Koha::Patrons->search($conditions); # FIXME Should be search_limited? if ( $patrons->count > 0) { $nodouble = 0; $check_member = $patrons->next->borrowernumber; diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index dfaa965..487e000 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -391,7 +391,7 @@ sub CheckForInvalidFields { unless ( Email::Valid->address($borrower->{'email'}) ) { push(@invalidFields, "email"); } elsif ( C4::Context->preference("PatronSelfRegistrationEmailMustBeUnique") ) { - my $patrons_with_same_email = Koha::Patrons->search( { email => $borrower->{email} })->count; + my $patrons_with_same_email = Koha::Patrons->search( { email => $borrower->{email} })->count; # FIXME Should be search_limited? if ( $patrons_with_same_email ) { push @invalidFields, "duplicate_email"; } -- 2.9.3