From 6313752c9406ee6c841c380225624f57f408959a Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 6 Apr 2017 12:42:03 -0300
Subject: [PATCH] Bug 18403: Add new methods Koha::Patrons->search_limited and
 use it where needed

Most of the time when we search for patrons we do not want to search for all patrons,
but just the ones the logged in user is allowed to see the information.
This patch takes care of that by adding a new search_limited method to Koha::Patrons.
When called this method only search for patrons that the logged in user is allowed
to see.

Test plan:
Patron autocomplete search should be limited

Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com>
---
 Koha/Patrons.pm          | 35 +++++++++++++++++++++++++++++++++++
 circ/ysearch.pl          |  2 +-
 members/memberentry.pl   |  2 +-
 opac/opac-memberentry.pl |  2 +-
 4 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/Koha/Patrons.pm b/Koha/Patrons.pm
index b8aebeb..1dfb396 100644
--- a/Koha/Patrons.pm
+++ b/Koha/Patrons.pm
@@ -41,6 +41,41 @@ Koha::Patron - Koha Patron Object class
 
 =cut
 
+=head3 search_limited
+
+my $patrons = Koha::Patrons->search_limit( $params, $attributes );
+
+Returns all the patrons the logged in user is allowed to see
+
+=cut
+
+sub search_limited {
+    my ( $self, $params, $attributes ) = @_;
+
+    my $userenv = C4::Context->userenv;
+    my @restricted_branchcodes;
+    my $logged_in_user = Koha::Patrons->find( $userenv->{number} );
+    if ( $logged_in_user and not
+        $logged_in_user->can(
+            { borrowers => 'view_borrower_infos_from_any_libraries' }
+        )
+      )
+    {
+        if ( my $library_groups = $logged_in_user->library->library_groups )
+        {
+            while ( my $library_group = $library_groups->next ) {
+                push @restricted_branchcodes,
+                  $library_group->parent->children->get_column('branchcode');
+            }
+        }
+        else {
+            push @restricted_branchcodes, $userenv->{branch};
+        }
+    }
+    $params->{'me.branchcode'} = { -in => \@restricted_branchcodes } if @restricted_branchcodes;
+    return $self->search( $params, $attributes );
+}
+
 =head3 search_housebound_choosers
 
 Returns all Patrons which are Housebound choosers.
diff --git a/circ/ysearch.pl b/circ/ysearch.pl
index 37eaed4..7a75c80 100755
--- a/circ/ysearch.pl
+++ b/circ/ysearch.pl
@@ -67,7 +67,7 @@ foreach my $p (@parts) {
 
 push( @params, { branchcode => C4::Context->userenv->{branch} } ) if $limit_on_branch;
 
-my $borrowers_rs = Koha::Patrons->search(
+my $borrowers_rs = Koha::Patrons->search_limited(
     { -and => \@params },
     {
         # Get the first 10 results
diff --git a/members/memberentry.pl b/members/memberentry.pl
index 4a1394c..c6d9ccd 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -241,7 +241,7 @@ if ( ( $op eq 'insert' ) and !$nodouble ) {
         $conditions->{dateofbirth} = $newdata{dateofbirth} if $newdata{dateofbirth};
     }
     $nodouble = 1;
-    my $patrons = Koha::Patrons->search($conditions);
+    my $patrons = Koha::Patrons->search($conditions); # FIXME Should be search_limited?
     if ( $patrons->count > 0) {
         $nodouble = 0;
         $check_member = $patrons->next->borrowernumber;
diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl
index dfaa965..487e000 100755
--- a/opac/opac-memberentry.pl
+++ b/opac/opac-memberentry.pl
@@ -391,7 +391,7 @@ sub CheckForInvalidFields {
         unless ( Email::Valid->address($borrower->{'email'}) ) {
             push(@invalidFields, "email");
         } elsif ( C4::Context->preference("PatronSelfRegistrationEmailMustBeUnique") ) {
-            my $patrons_with_same_email = Koha::Patrons->search( { email => $borrower->{email} })->count;
+            my $patrons_with_same_email = Koha::Patrons->search( { email => $borrower->{email} })->count; # FIXME Should be search_limited?
             if ( $patrons_with_same_email ) {
                 push @invalidFields, "duplicate_email";
             }
-- 
2.1.4