Bugzilla – Attachment 71506 Details for
Bug 18403
Hide patron information if not part of the logged in user library group
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos
Bug-18403-Add-sub-outputandexitiferror---unknownpa.patch (text/plain), 46.20 KB, created by
Jonathan Druart
on 2018-02-12 19:33:51 UTC
(
hide
)
Description:
Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2018-02-12 19:33:51 UTC
Size:
46.20 KB
patch
obsolete
>From cee2cf9ff927504f9c24f6519462a7d702c5c27d Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 4 Apr 2017 18:48:45 -0300 >Subject: [PATCH] Bug 18403: Add sub output_and_exit_if_error - unknown_patron > & cannot_see_patron_infos > >Test plan: >Login with a patron that is not allowed to see patron's information for patrons >outside of his group. Try to access patron's information from scripts of the patron >module (members/*) and circ/circulation.pl. >You should be able to access patron's information of patrons outside of your group >and get "You are not allowed to see the information of this patron." >If you try and access a patron page with a borrowernumber that does not exist, you >should get "This patron does not exist" > >Technical note: >A new C4::Output subroutine is created in this patch: "output_and_exit_if_error" >Executed at the beginning of the script it will permit not to copy/paste all the >different checks to know if the logged in user is authorised to see patron's information. >The design here can be discussed, but I did not find an alternative with as less changes. >On the way I refactor what we did with 'unknowuser' previously: it will now work with all >patron pages, not only the few that used it. >Note that the 'or die "Not logged in";' part should not be needed, but... who trusts >C4::Auth? >I think it could be used as a safeguard later. I am willing to sed and remove them >if required. > >Changes in discharge.pl are mainly indentation changes. > >With this patch we should now have a $patron variable that refer to the patron we >want to access. That will be very useful to remove plenty of code in members/* and >only pass this variable to the template (instead of 1 variable per patron's attribute). > >Signed-off-by: Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > C4/Output.pm | 25 +++++++++++++++++++++ > .../prog/en/includes/acquisitions-toolbar.inc | 1 + > .../prog/en/includes/authorities-toolbar.inc | 1 + > .../prog/en/includes/blocking_errors.inc | 10 +++++++++ > .../prog/en/includes/budgets-admin-toolbar.inc | 1 + > .../intranet-tmpl/prog/en/includes/cat-toolbar.inc | 1 + > .../prog/en/includes/labels-toolbar.inc | 1 + > .../prog/en/includes/members-toolbar.inc | 1 + > .../prog/en/includes/patron-toolbar.inc | 1 + > .../prog/en/includes/patroncards-toolbar.inc | 1 + > .../prog/en/includes/reports-toolbar.inc | 1 + > .../en/includes/rotating-collections-toolbar.inc | 1 + > .../prog/en/includes/serials-toolbar.inc | 1 + > .../prog/en/includes/virtualshelves-toolbar.inc | 2 ++ > .../prog/en/modules/members/discharge.tt | 4 ++-- > .../prog/en/modules/members/housebound.tt | 4 ---- > .../prog/en/modules/members/moremember.tt | 13 ++--------- > .../prog/en/modules/members/statistics.tt | 6 +++-- > members/boraccount.pl | 4 +++- > members/deletemem.pl | 13 +++++------ > members/discharge.pl | 8 ++----- > members/discharges.pl | 3 +++ > members/files.pl | 12 +++++----- > members/housebound.pl | 10 ++++----- > members/mancredit.pl | 5 ++++- > members/maninvoice.pl | 9 ++++++-- > members/member-flags.pl | 4 +++- > members/member-password.pl | 6 ++--- > members/memberentry.pl | 13 +++++------ > members/members-update-do.pl | 6 +++++ > members/mod_debarment.pl | 8 +++++++ > members/moremember.pl | 9 +++----- > members/notices.pl | 3 +++ > members/pay.pl | 9 ++++---- > members/paycollect.pl | 7 +++--- > members/print_overdues.pl | 6 +++++ > members/printfeercpt.pl | 9 ++++---- > members/printinvoice.pl | 9 ++++---- > members/printslip.pl | 5 +++++ > members/purchase-suggestions.pl | 9 ++++---- > members/readingrec.pl | 8 +++---- > members/routing-lists.pl | 9 +++----- > members/setstatus.pl | 26 ++++++++++++++-------- > members/statistics.pl | 9 +++----- > members/summary-print.pl | 9 ++++---- > members/update-child.pl | 10 ++++----- > 46 files changed, 187 insertions(+), 126 deletions(-) > create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc > >diff --git a/C4/Output.pm b/C4/Output.pm >index af7dd5a22b..58bd75a690 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -50,6 +50,7 @@ BEGIN { > ); > push @EXPORT, qw( > &output_html_with_http_headers &output_ajax_with_http_headers &output_with_http_headers >+ &output_and_exit_if_error > ); > > } >@@ -306,6 +307,30 @@ sub is_ajax { > return ( $x_req and $x_req =~ /XMLHttpRequest/i ) ? 1 : 0; > } > >+sub output_and_exit_if_error { >+ my ( $query, $cookie, $template, $params ) = @_; >+ my $error; >+ if ( $params and exists $params->{module} ) { >+ if ( $params->{module} eq 'members' ) { >+ my $logged_in_user = $params->{logged_in_user}; >+ my $current_patron = $params->{current_patron}; >+ if ( not $current_patron ) { >+ $error = 'unknown_patron'; >+ } >+ elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { >+ $error = 'cannot_see_patron_infos'; >+ } >+ } >+ } >+ >+ if ( $error ) { >+ $template->param( blocking_error => $error ); >+ output_html_with_http_headers ( $query, $cookie, $template->output ); >+ exit; >+ } >+ return; >+} >+ > sub parametrized_url { > my $url = shift || ''; # ie page.pl?ln={LANG} > my $vars = shift || {}; # ie { LANG => en } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >index a82ab411a6..198c6cbbe3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <script type="text/javascript"> > //<![CDATA[ > function confirm_deletion() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc >index 4b9d779fc3..52209e1e78 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <script type="text/javascript"> > //<![CDATA[ > $(document).ready(function() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc >new file mode 100644 >index 0000000000..2d25a16da0 >--- /dev/null >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc >@@ -0,0 +1,10 @@ >+[% IF blocking_error %] >+ [% SWITCH blocking_error %] >+ [% CASE 'unknown_patron' %] >+ <div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div> >+ [% CASE 'cannot_see_patron_infos' %]You are not allowed to see the information of this patron. >+ [% CASE %][% blocking_error %] >+ [% END %] >+ >+ [% STOP %] [%# Will stop gracefully without processing any more of the template document.%] >+[% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc >index e9d61a1dea..813ee8c66e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > [% IF ( budget_period_id ) %] > <div class="btn-group"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc >index 58339781a0..781b79714d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > > [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc >index d9bb8974a1..aa25fb1b87 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > <div class="btn-group"> > <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >index 00b20717a9..231469b122 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > [% USE Koha %] > [% USE Borrowers %] > [% USE Branches %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc >index c57910bcb3..c76953d798 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > [% USE Categories %] > [% USE Koha %] > [% SET categories = Categories.all %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc >index 9f411f7394..4f39e70423 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > <div class="btn-group"> > <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc >index 2fc520f9ee..649fbe1278 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > [% IF ( CAN_user_reports_create_reports ) %] > <div class="btn-group"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc >index f46f9f2378..cfcc609c9d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > <div id="toolbar" class="btn-toolbar"> > <div class="btn-group"> > <a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=new"><i class="fa fa-plus"></i> New collection</a> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc >index 19b264d192..0c9109994d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc >@@ -1,3 +1,4 @@ >+[% INCLUDE 'blocking_errors.inc' %] > [% IF subscriptionid and ( CAN_user_serials_edit_subscription || CAN_user_serials_create_subscription || CAN_user_serials_delete_subscription || CAN_user_serials_receive_serials ) %] > <div id="toolbar" class="btn-toolbar"> > [% IF CAN_user_serials_create_subscription %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc >index 4f3c37e2f8..dacd451f1a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc >@@ -1,3 +1,5 @@ >+[% INCLUDE 'blocking_errors.inc' %] >+ > <div id="toolbar" class="btn-toolbar"> > <div class="btn-group"><a id="newshelf" class="btn btn-default btn-sm" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=add_form&referer=[% op %]"><i class="fa fa-plus"></i> New list</a></div> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt >index 577d56c743..8e316cc32f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt >@@ -2,7 +2,7 @@ > [% USE AuthorisedValues %] > [% USE Branches %] > [% INCLUDE 'doc-head-open.inc' %] >-<title>Koha › Patrons › [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title> >+<title>Koha › Patrons › [% UNLESS blocking_error %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title> > [% INCLUDE 'doc-head-close.inc' %] > </head> > <body id="discharge" class="discharge"> >@@ -12,7 +12,7 @@ > <div id="breadcrumbs"> > <a href="/cgi-bin/koha/mainpage.pl">Home</a> > › <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> >-› [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %] >+› [% UNLESS blocking_error %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %] > </div> > > <div id="doc3" class="yui-t1"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >index e754a312b2..49e965f85f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >@@ -30,9 +30,7 @@ > <div id="yui-main"> > <div class="yui-b"> > >- [% UNLESS ( unknowuser ) %] > [% INCLUDE 'members-toolbar.inc' %] >- [% END %] > > <div class="yui-g"> > >@@ -43,8 +41,6 @@ > [% FOR m IN messages %] > <div class="dialog [% m.type %]"> > [% SWITCH m.code %] >- [% CASE 'error_on_patron_load' %] >- An error occurred whilst loading the patron details. > [% CASE 'error_on_profile_store' %] > An error occurred whilst updating this housebound profile. > [% CASE 'error_on_profile_create' %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >index cee748ac58..3898166eb4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >@@ -5,9 +5,7 @@ > [% USE ColumnsSettings %] > [% INCLUDE 'doc-head-open.inc' %] > <title>Koha › Patrons › >-[% IF ( unknowuser ) %] >- Patron does not exist >-[% ELSE %] >+[% UNLESS blocking_error %] > Patron details for [% INCLUDE 'patron-title.inc' no_html = 1 %] > [% END %] > </title> >@@ -144,7 +142,7 @@ function validate1(date) { > <div id="breadcrumbs"> > <a href="/cgi-bin/koha/mainpage.pl">Home</a> > › <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> >-› [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %] >+› [% UNLESS blocking_error %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %] > </div> > > <div id="doc3" class="yui-t2"> >@@ -153,9 +151,7 @@ function validate1(date) { > <div id="yui-main"> > <div class="yui-b"> > >-[% UNLESS ( unknowuser ) %] > [% INCLUDE 'members-toolbar.inc' %] >-[% END %] > > [% IF ( error ) %] > <div class="dialog alert"> >@@ -179,9 +175,6 @@ function validate1(date) { > [% END %] > <div class="yui-g"> > >-[% IF ( unknowuser ) %] >- <div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div> >-[% ELSE %] > [% IF ( was_renewed ) %]<div class="dialog message">Patron's account has been renewed until [% dateexpiry | $KohaDates %]</div>[% END %] > > [% IF fines %] >@@ -657,8 +650,6 @@ function validate1(date) { > [% END %] > > </div> >-[% END %] <!-- unknowuser --> >- > > </div> > </div> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >index d4e5ca5f78..35d4474802 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >@@ -3,7 +3,9 @@ > [% USE Branches %] > [% INCLUDE 'doc-head-open.inc' %] > <title>Koha › Patrons › >-Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %] >+[% UNLESS blocking_error %] >+ Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %] >+[% END %] > </title> > [% INCLUDE 'doc-head-close.inc' %] > <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables_[% KOHA_VERSION %].css" /> >@@ -26,7 +28,7 @@ Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %] > <div id="breadcrumbs"> > <a href="/cgi-bin/koha/mainpage.pl">Home</a> > › <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> >-› [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Statistics for [% INCLUDE 'patron-title.inc' invert_name = 1 %][% END %] >+› [% UNLESS blocking_error %]Statistics for [% INCLUDE 'patron-title.inc' invert_name = 1 %][% END %] > </div> > > <div id="doc3" class="yui-t1"> >diff --git a/members/boraccount.pl b/members/boraccount.pl >index a22f335174..7f6bfda11c 100755 >--- a/members/boraccount.pl >+++ b/members/boraccount.pl >@@ -51,13 +51,15 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user( > my $borrowernumber=$input->param('borrowernumber'); > my $action = $input->param('action') || ''; > >-#get patron details >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; > my $patron = Koha::Patrons->find( $borrowernumber ); > unless ( $patron ) { > print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); > exit; > } > >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > if ( $action eq 'reverse' ) { > ReversePayment( scalar $input->param('accountlines_id') ); > } >diff --git a/members/deletemem.pl b/members/deletemem.pl >index 87eb338d4e..5a1e3f5cb7 100755 >--- a/members/deletemem.pl >+++ b/members/deletemem.pl >@@ -38,7 +38,7 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen > > my $input = new CGI; > >-my ($template, $borrowernumber, $cookie) >+my ($template, $loggedinuser, $cookie) > = get_template_and_user({template_name => "members/deletemem.tt", > query => $input, > type => "intranet", >@@ -51,11 +51,15 @@ my ($template, $borrowernumber, $cookie) > my $member = $input->param('member'); > > #Do not delete yourself... >-if ($borrowernumber == $member ) { >+if ( $loggedinuser == $member ) { > print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_YOURSELF"); > exit 0; # Exit without error > } > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $member ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > # Handle deletion from the Norwegian national patron database, if it is enabled > # If the "deletelocal" parameter is set to "false", the regular deletion will be > # short circuited, and only a deletion from the national database can be carried >@@ -73,11 +77,6 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen > my $issues = GetPendingIssues($member); # FIXME: wasteful call when really, we only want the count > my $countissues = scalar(@$issues); > >-my $patron = Koha::Patrons->find( $member ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$member"); >- exit; >-} > my $flags = C4::Members::patronflags( $patron->unblessed ); > my $userenv = C4::Context->userenv; > >diff --git a/members/discharge.pl b/members/discharge.pl >index 97184fd2df..ed1c7acb54 100755 >--- a/members/discharge.pl >+++ b/members/discharge.pl >@@ -58,13 +58,9 @@ unless ( C4::Context->preference('useDischarge') ) { > exit; > } > >-$borrowernumber = $input->param('borrowernumber'); >- >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; > my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $can_be_discharged = Koha::Patron::Discharge::can_be_discharged({ > borrowernumber => $borrowernumber >diff --git a/members/discharges.pl b/members/discharges.pl >index 38a7355068..165a1cb90d 100755 >--- a/members/discharges.pl >+++ b/members/discharges.pl >@@ -44,6 +44,9 @@ my $branchcode = > > if( $op eq 'allow' ) { > my $borrowernumber = $input->param('borrowernumber'); >+ my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ my $patron = Koha::Patrons->find($borrowernumber); >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > Koha::Patron::Discharge::discharge({ > borrowernumber => $borrowernumber > }) if $borrowernumber; >diff --git a/members/files.pl b/members/files.pl >index 4569a160d0..40d4c65a9a 100755 >--- a/members/files.pl >+++ b/members/files.pl >@@ -46,7 +46,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > $template->param( 'borrower_files' => 1 ); > > my $borrowernumber = $cgi->param('borrowernumber'); >-my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber ); >+ >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find($borrowernumber); >+output_and_exit_if_error( $cgi, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ >+my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber ); # FIXME Should be $patron->get_files. Koha::Patron::Files needs to be Koha::Objects based first > > my $op = $cgi->param('op') || ''; > >@@ -62,11 +67,6 @@ if ( $op eq 'download' ) { > print $file->{'file_content'}; > } > else { >- my $patron = Koha::Patrons->find( $borrowernumber ); >- unless ( $patron ) { >- print $cgi->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >- } > > my $patron_category = $patron->category; > $template->param(%{ $patron->unblessed}); >diff --git a/members/housebound.pl b/members/housebound.pl >index dba49a7f37..64f4c54136 100755 >--- a/members/housebound.pl >+++ b/members/housebound.pl >@@ -56,12 +56,10 @@ my $method = $input->param('method') // q{}; > my $visit_id = $input->param('visit_id') // q{}; > > # Get patron >-my $patron = eval { >- my $borrowernumber = $input->param('borrowernumber') // q{}; >- return Koha::Patrons->find($borrowernumber); >-}; >-push @messages, { type => 'error', code => 'error_on_patron_load' } >- if ( $@ or !$patron ); >+my $borrowernumber = $input->param('borrowernumber'); >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find($borrowernumber); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > # Get supporting cast > my ( $branch, $category, $houseboundprofile, $visit, $patron_image ); >diff --git a/members/mancredit.pl b/members/mancredit.pl >index 85405eaf05..a8e3b87dd5 100755 >--- a/members/mancredit.pl >+++ b/members/mancredit.pl >@@ -50,6 +50,8 @@ my $add=$input->param('add'); > > if ($add){ > if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) { >+ # Note: If the logged in user is not allowed to see this patron an invoice can be forced >+ # Here we are trusting librarians not to hack the system > my $barcode = $input->param('barcode'); > my $itemnum; > if ($barcode) { >@@ -75,7 +77,8 @@ if ($add){ > debug => 1, > } > ); >- >+ my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > if ( $patron->category->category_type eq 'C') { > my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']}); > $template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1; >diff --git a/members/maninvoice.pl b/members/maninvoice.pl >index 9478c7a61a..d3de811b0b 100755 >--- a/members/maninvoice.pl >+++ b/members/maninvoice.pl >@@ -50,7 +50,8 @@ unless ( $patron ) { > my $add=$input->param('add'); > if ($add){ > if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) { >- # print $input->header; >+ # Note: If the logged in user is not allowed to see this patron an invoice can be forced >+ # Here we are trusting librarians not to hack the system > my $barcode=$input->param('barcode'); > my $itemnum; > if ($barcode) { >@@ -92,7 +93,11 @@ if ($add){ > updatecharges => 'remaining_permissions' }, > debug => 1, > }); >- >+ >+ my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ my $patron = Koha::Patrons->find($borrowernumber); >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > # get authorised values with type of MANUAL_INV > my @invoice_types; > my $dbh = C4::Context->dbh; >diff --git a/members/member-flags.pl b/members/member-flags.pl >index 746cef81c1..21618e50e9 100755 >--- a/members/member-flags.pl >+++ b/members/member-flags.pl >@@ -33,7 +33,7 @@ unless ( $patron ) { > > my $category_type = $patron->category->category_type; > my $bor = $patron->unblessed; >-if( $category_type eq 'S' ) { >+if( $category_type eq 'S' ) { # FIXME Is this really needed? > $flagsrequired->{'staffaccess'} = 1; > } > my ($template, $loggedinuser, $cookie) = get_template_and_user({ >@@ -45,6 +45,8 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({ > debug => 1, > }); > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my %member2; > $member2{'borrowernumber'}=$member; >diff --git a/members/member-password.pl b/members/member-password.pl >index 716d054ba7..374d17a7c2 100755 >--- a/members/member-password.pl >+++ b/members/member-password.pl >@@ -45,11 +45,9 @@ my $newpassword2 = $input->param('newpassword2'); > > my @errors; > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; > my $patron = Koha::Patrons->find( $member ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$member"); >- exit; >-} >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $category_type = $patron->category->category_type; > my $bor = $patron->unblessed; >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 365db68cec..27311e31d8 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -75,13 +75,16 @@ my ($template, $loggedinuser, $cookie) > debug => ($debug) ? 1 : 0, > }); > >+my $borrowernumber = $input->param('borrowernumber'); >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find($borrowernumber); >+ > if ( C4::Context->preference('SMSSendDriver') eq 'Email' ) { > my @providers = Koha::SMS::Providers->search(); > $template->param( sms_providers => \@providers ); > } > > my $guarantorid = $input->param('guarantorid'); >-my $borrowernumber = $input->param('borrowernumber'); > my $actionType = $input->param('actionType') || ''; > my $modify = $input->param('modify'); > my $delete = $input->param('delete'); >@@ -151,12 +154,7 @@ $template->param( "quickadd" => 1 ) if ( $quickadd ); > $template->param( "duplicate" => 1 ) if ( $op eq 'duplicate' ); > $template->param( "checked" => 1 ) if ( defined($nodouble) && $nodouble eq 1 ); > if ( $op eq 'modify' or $op eq 'save' or $op eq 'duplicate' ) { >- my $patron = Koha::Patrons->find( $borrowernumber ); >- unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >- } >- >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > $borrower_data = $patron->unblessed; > $borrower_data->{category_type} = $patron->category->category_type; > } >@@ -315,7 +313,6 @@ if ($op eq 'save' || $op eq 'insert'){ > > my $dateofbirth; > if ($op eq 'save' && $step == 3) { >- my $patron = Koha::Patrons->find( $borrowernumber ); > $dateofbirth = $patron->dateofbirth; > } > else { >diff --git a/members/members-update-do.pl b/members/members-update-do.pl >index 1ac1de0eb9..2f64096941 100755 >--- a/members/members-update-do.pl >+++ b/members/members-update-do.pl >@@ -27,6 +27,7 @@ use Koha::Patron::Modifications; > > my $query = new CGI; > >+# FIXME Should be a checkauth call > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > { > template_name => "about.tt", >@@ -38,12 +39,17 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > } > ); > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ > my @params = $query->param; > > foreach my $param (@params) { > if ( $param =~ "^modify_" ) { > my (undef, $borrowernumber) = split( /_/, $param ); > >+ my $patron = Koha::Patrons->find($borrowernumber); >+ next unless $logged_in_user->can_see_patron_infos( $patron ); >+ > my $action = $query->param($param); > > if ( $action eq 'approve' ) { >diff --git a/members/mod_debarment.pl b/members/mod_debarment.pl >index 2bf637b7ff..8c18df83ec 100755 >--- a/members/mod_debarment.pl >+++ b/members/mod_debarment.pl >@@ -32,6 +32,14 @@ my ( $loggedinuser, $cookie, $sessionID ) = checkauth( $cgi, 0, { borrowers => ' > my $borrowernumber = $cgi->param('borrowernumber'); > my $action = $cgi->param('action'); > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find($borrowernumber); >+ >+# Ideally we should display a warning on the interface if the patron is not allowed >+# to modify a debarment >+# But a librarian is not supposed to hack the system >+$action = '' unless $logged_in_user->can_see_patron_infos( $patron ); >+ > if ( $action eq 'del' ) { > DelDebarment( scalar $cgi->param('borrower_debarment_id') ); > } elsif ( $action eq 'add' ) { >diff --git a/members/moremember.pl b/members/moremember.pl >index 1219b9dfd1..2f2e14234a 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -121,12 +121,9 @@ $borrowernumber = HTML::Entities::encode($borrowernumber); > my $error = $input->param('error'); > $template->param( error => $error ) if ( $error ); > >-my $patron = Koha::Patrons->find($borrowernumber); >-unless ( $patron ) { >- $template->param (unknowuser => 1); >- output_html_with_http_headers $input, $cookie, $template->output; >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $issues = $patron->checkouts; > my $balance = $patron->account->balance; >diff --git a/members/notices.pl b/members/notices.pl >index cdc5f9f250..4b1abb73e8 100755 >--- a/members/notices.pl >+++ b/members/notices.pl >@@ -48,6 +48,9 @@ my ($template, $loggedinuser, $cookie) > debug => 1, > }); > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > $template->param( $borrower ); > $template->param( picture => 1 ) if $patron->image; > >diff --git a/members/pay.pl b/members/pay.pl >index bb1f8218a8..f51d56d551 100755 >--- a/members/pay.pl >+++ b/members/pay.pl >@@ -66,11 +66,10 @@ if ( !$borrowernumber ) { > } > > # get borrower details >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find($borrowernumber); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $category = $patron->category; > our $borrower = $patron->unblessed; > $borrower->{description} = $category->description; >diff --git a/members/paycollect.pl b/members/paycollect.pl >index 091f1d57c9..1eb418437f 100755 >--- a/members/paycollect.pl >+++ b/members/paycollect.pl >@@ -49,11 +49,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > > # get borrower details > my $borrowernumber = $input->param('borrowernumber'); >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; > my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $borrower = $patron->unblessed; > my $category = $patron->category; > $borrower->{description} = $category->description; >diff --git a/members/print_overdues.pl b/members/print_overdues.pl >index b63dec94be..1606ce2d80 100755 >--- a/members/print_overdues.pl >+++ b/members/print_overdues.pl >@@ -27,6 +27,8 @@ use C4::Output; > use C4::Members qw(GetOverduesForPatron); > use C4::Overdues qw(parse_overdues_letter); > >+use Koha::Patrons; >+ > my $input = new CGI; > > my $flagsrequired = { circulate => "circulate_remaining_permissions" }; >@@ -45,6 +47,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > my $borrowernumber = $input->param('borrowernumber'); > my $branchcode = C4::Context->userenv->{'branch'}; > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $overdues = GetOverduesForPatron($borrowernumber); > > my $letter = parse_overdues_letter( >diff --git a/members/printfeercpt.pl b/members/printfeercpt.pl >index d5af0e92c4..748242f530 100755 >--- a/members/printfeercpt.pl >+++ b/members/printfeercpt.pl >@@ -49,11 +49,10 @@ my $borrowernumber=$input->param('borrowernumber'); > my $action = $input->param('action') || ''; > my $accountlines_id = $input->param('accountlines_id'); > >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $category = $patron->category; > my $data = $patron->unblessed; > $data->{description} = $category->description; >diff --git a/members/printinvoice.pl b/members/printinvoice.pl >index a8ea225d40..66c19c2a0b 100755 >--- a/members/printinvoice.pl >+++ b/members/printinvoice.pl >@@ -48,11 +48,10 @@ my $borrowernumber = $input->param('borrowernumber'); > my $action = $input->param('action') || ''; > my $accountlines_id = $input->param('accountlines_id'); > >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $category = $patron->category; > my $data = $patron->unblessed; > $data->{description} = $category->description; >diff --git a/members/printslip.pl b/members/printslip.pl >index c7331af442..a3d2d50031 100755 >--- a/members/printslip.pl >+++ b/members/printslip.pl >@@ -73,6 +73,11 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > ); > > my $borrowernumber = $input->param('borrowernumber'); >+ >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $branch=C4::Context->userenv->{'branch'}; > my ($slip, $is_html); > if (my $letter = IssueSlip ($session->param('branch') || $branch, $borrowernumber, $print eq "qslip")) { >diff --git a/members/purchase-suggestions.pl b/members/purchase-suggestions.pl >index c2dc15616d..21e656d970 100755 >--- a/members/purchase-suggestions.pl >+++ b/members/purchase-suggestions.pl >@@ -42,11 +42,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > > my $borrowernumber = $input->param('borrowernumber'); > >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $category = $patron->category; > my $data = $patron->unblessed; > $data->{description} = $category->description; >diff --git a/members/readingrec.pl b/members/readingrec.pl >index ca3b04de0a..90157b52bb 100755 >--- a/members/readingrec.pl >+++ b/members/readingrec.pl >@@ -60,10 +60,9 @@ if ($input->param('borrowernumber')) { > $patron = Koha::Patrons->find( $borrowernumber ); > } > >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > $data = $patron->unblessed; > $borrowernumber = $patron->borrowernumber; > >@@ -81,6 +80,7 @@ if ( $borrowernumber eq C4::Context->preference('AnonymousPatron') ){ > > # barcode export > if ( $op eq 'export_barcodes' ) { >+ # FIXME This should be moved out of this script > if ( $data->{'privacy'} < 2) { > my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 }); > my @barcodes = >diff --git a/members/routing-lists.pl b/members/routing-lists.pl >index 8c8a301e67..d298a95b1e 100755 >--- a/members/routing-lists.pl >+++ b/members/routing-lists.pl >@@ -47,12 +47,9 @@ my $borrowernumber = $query->param('borrowernumber'); > > my $branch = C4::Context->userenv->{'branch'}; > >-my $patron; >-$patron = Koha::Patrons->find( $borrowernumber ) if $borrowernumber; >-unless ( $patron ) { >- print $query->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $query, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $category = $patron->category; > my $patron_info = $patron->unblessed; >diff --git a/members/setstatus.pl b/members/setstatus.pl >index c598433147..ff4b74b119 100755 >--- a/members/setstatus.pl >+++ b/members/setstatus.pl >@@ -34,7 +34,7 @@ use Koha::Patrons; > > my $input = new CGI; > >-checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet'); >+my ( $loggedinuser ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet'); > > my $destination = $input->param("destination") || ''; > my $borrowernumber=$input->param('borrowernumber'); >@@ -44,14 +44,22 @@ my $reregistration = $input->param('reregistration') || ''; > my $dbh = C4::Context->dbh; > my $dateexpiry; > >-if ( $reregistration eq 'y' ) { >- # re-reregistration function to automatic calcul of date expiry >- $dateexpiry = Koha::Patrons->find( $borrowernumber )->renew_account; >-} else { >- my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?"); >- $sth->execute( $status, $borrowernumber ); >- $sth->finish; >- } >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+ >+# Ideally we should display a warning on the interface if the logged in user is >+# not allowed to modify this patron. >+# But a librarian is not supposed to hack the system >+unless ( $logged_in_user->can_see_patron_infos($patron) ) { >+ if ( $reregistration eq 'y' ) { >+ # re-reregistration function to automatic calcul of date expiry >+ $dateexpiry = $patron->renew_account; >+ } else { >+ my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?"); >+ $sth->execute( $status, $borrowernumber ); >+ $sth->finish; >+ } >+} > > if($destination eq "circ"){ > if($dateexpiry){ >diff --git a/members/statistics.pl b/members/statistics.pl >index bcefd9f659..616449603a 100755 >--- a/members/statistics.pl >+++ b/members/statistics.pl >@@ -47,12 +47,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > > my $borrowernumber = $input->param('borrowernumber'); > >-# Set informations for the patron >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $category = $patron->category; > my $borrower= $patron->unblessed; >diff --git a/members/summary-print.pl b/members/summary-print.pl >index a6a0e36194..9c1c6122eb 100755 >--- a/members/summary-print.pl >+++ b/members/summary-print.pl >@@ -43,11 +43,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > } > ); > >-my $patron = Koha::Patrons->find( $borrowernumber ); >-unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+my $patron = Koha::Patrons->find( $borrowernumber ); >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $category = $patron->category; > my $data = $patron->unblessed; > $data->{description} = $category->description; >diff --git a/members/update-child.pl b/members/update-child.pl >index d879ac87b8..cc942e2704 100755 >--- a/members/update-child.pl >+++ b/members/update-child.pl >@@ -57,6 +57,8 @@ my $cattype = $input->param('cattype'); > my $catcode_multi = $input->param('catcode_multi'); > my $op = $input->param('op'); > >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ > if ( $op eq 'multi' ) { > # FIXME - what are the possible upgrade paths? C -> A , C -> S ... > # currently just allowing C -> A >@@ -71,11 +73,9 @@ if ( $op eq 'multi' ) { > } > > elsif ( $op eq 'update' ) { >- my $patron = Koha::Patrons->find( $borrowernumber ); >- unless ( $patron ) { >- print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); >- exit; >- } >+ my $patron = Koha::Patrons->find( $borrowernumber ); >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >+ > my $member = $patron->unblessed; > $member->{'guarantorid'} = 0; > $member->{'categorycode'} = $catcode; >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 18403
:
62010
|
62011
|
62012
|
62013
|
62014
|
62015
|
62016
|
62017
|
62018
|
62019
|
62020
|
62021
|
62022
|
62023
|
62024
|
62025
|
62026
|
62027
|
62028
|
62029
|
62030
|
62031
|
62032
|
62033
|
62302
|
62303
|
62830
|
62831
|
62832
|
62833
|
62834
|
62835
|
62836
|
62837
|
62838
|
62839
|
62840
|
62841
|
62842
|
62843
|
62844
|
62845
|
62846
|
62847
|
62848
|
62849
|
62850
|
62851
|
62852
|
62853
|
62854
|
62855
|
71392
|
71394
|
71500
|
71501
|
71502
|
71503
|
71504
|
71505
| 71506 |
71507
|
71508
|
71509
|
71510
|
71511
|
71512
|
71513
|
71514
|
71515
|
71516
|
71517
|
71518
|
71519
|
71520
|
71521
|
71522
|
71523
|
71524
|
71525
|
71526
|
71527
|
71528
|
71529
|
71530
|
71767