From a89ef9b9c1089c80faf5d3fc1e0a3d7b8f437846 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Mon, 16 Dec 2019 17:41:42 +0000
Subject: [PATCH] Bug 24249: OPAC lists page should require login for
 login-dependent operations

This patch modifies opac-shelves.pl so that login is required if the
requested operation is anything but "view" and "list."

To test, apply the patch and go to the lists page in the OPAC while not
logged in.

 - Click the "Log in to create a new list" link.
 - Log in.
 - You should be taken to the "Create a new list" form.
---
 .../opac-tmpl/bootstrap/en/modules/opac-shelves.tt |  4 ++--
 opac/opac-shelves.pl                               | 27 +++++++++++++++-------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index d96c4a36849..f72c3cf625b 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -671,7 +671,7 @@
                                 <div id="toolbar" class="toolbar"><a class="btn btn-link newshelf" href="/cgi-bin/koha/opac-shelves.pl?op=add_form"><i class="fa fa-plus"></i> New list</a></div>
                             [% ELSE %]
                                 [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
-                                    <div class="alert alert-info"><a href="/cgi-bin/koha/opac-user.pl">Log in</a> to create new lists.</div>
+                                    <div class="alert alert-info"><a href="/cgi-bin/koha/opac-shelves.pl?op=add_form">Log in to create a new list</a></div>
                                 [% END %]
                             [% END %]
 
@@ -746,7 +746,7 @@
                             </div> [%# <div class="toptabs ui-tabs ui-widget ui-widget-content ui-corner-all"> %]
                         [% ELSIF NOT loggedinusernumber %]
                             [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
-                                <div class="alert alert-info"><a href="/cgi-bin/koha/opac-user.pl">Log in</a> to create new lists.</div>
+                                <div class="alert alert-info"><a href="/cgi-bin/koha/opac-shelves.pl?op=add_form">Log in to create a new list</a></div>
                             [% END %]
                         [% END  # IF loggedinusername %]
                 </div> <!-- / #usershelves -->
diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl
index 802366d9940..1e13fa7c898 100755
--- a/opac/opac-shelves.pl
+++ b/opac/opac-shelves.pl
@@ -50,14 +50,25 @@ if ( ! C4::Context->preference('virtualshelves') ) {
     exit;
 }
 
-my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
-        template_name   => $template_name,
-        query           => $query,
-        type            => "opac",
-        authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
-    });
-
-my $op       = $query->param('op')       || 'list';
+my $op = $query->param('op') || 'list';
+my ( $template, $loggedinuser, $cookie );
+
+if( $op eq 'view' || $op eq 'list' ){
+    ( $template, $loggedinuser, $cookie ) = get_template_and_user({
+            template_name   => $template_name,
+            query           => $query,
+            type            => "opac",
+            authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
+        });
+} else {
+    ( $template, $loggedinuser, $cookie ) = get_template_and_user({
+            template_name   => $template_name,
+            query           => $query,
+            type            => "opac",
+            authnotrequired => 0,
+        });
+}
+
 my $referer  = $query->param('referer')  || $op;
 my $category = $query->param('category') || 1;
 my ( $shelf, $shelfnumber, @messages );
-- 
2.11.0