From 9f2e6af729d169b320044f02d342f357cb1903bc Mon Sep 17 00:00:00 2001
From: Christophe Croullebois <christophe.croullebois@biblibre.com>
Date: Thu, 8 Jun 2017 13:17:56 +0000
Subject: [PATCH] Bug 18756: Users can view aq.baskets even if they are not
 allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket
---
 C4/Acquisition.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
index ed80b26..b3b72b9 100644
--- a/C4/Acquisition.pm
+++ b/C4/Acquisition.pm
@@ -859,8 +859,8 @@ sub CanUserManageBasket {
 
         if ($AcqViewBaskets eq 'user'
         && $basket->{authorisedby} != $borrowernumber
-        && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
-            return 0;
+        && ! grep { $borrowernumber eq $_ } GetBasketUsers($basketno)) {
+             return 0;
         }
 
         if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
-- 
2.7.4