View | Details | Raw Unified | Return to bug 20100
Collapse All | Expand All

(-)a/members/member-flags.pl (-2 / +12 lines)
Lines 84-90 if ($input->param('newflags')) { Link Here
84
    }
84
    }
85
    
85
    
86
    $sth = $dbh->prepare("UPDATE borrowers SET flags=? WHERE borrowernumber=?");
86
    $sth = $dbh->prepare("UPDATE borrowers SET flags=? WHERE borrowernumber=?");
87
    $sth->execute($module_flags, $member);
87
    if( !C4::Context->preference('ProtectSuperlibPrivs') || C4::Context->IsSuperLibrarian ) {
88
        $sth->execute($module_flags, $member);
89
    } else {
90
        my $old_flags = $patron->flags // 0;
91
        if( ( $old_flags == 1 || $module_flags == 1 ) &&
92
              $old_flags != $module_flags ) {
93
           die "Non-superlibrarian is changing superlibrarian privileges"; # Interface should not allow this, so we can just die here
94
        } else {
95
            $sth->execute($module_flags, $member);
96
        }
97
    }
88
    
98
    
89
    # deal with subpermissions
99
    # deal with subpermissions
90
    $sth = $dbh->prepare("DELETE FROM user_permissions WHERE borrowernumber = ?");
100
    $sth = $dbh->prepare("DELETE FROM user_permissions WHERE borrowernumber = ?");
Lines 221-226 $template->param( Link Here
221
    is_child       => ( $category_type eq 'C' ),
231
    is_child       => ( $category_type eq 'C' ),
222
    csrf_token =>
232
    csrf_token =>
223
        Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
233
        Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
234
    disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibPrivs') ? !C4::Context->IsSuperLibrarian : 0,
224
);
235
);
225
236
226
    output_html_with_http_headers $input, $cookie, $template->output;
237
    output_html_with_http_headers $input, $cookie, $template->output;
227
- 

Return to bug 20100