gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29543: Prevent user to checkin or renew items they don't own 

Checkin or renew must be restricted to the items they own.

Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1

You should see an error message

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Jonathan Druart 2022-01-05 15:25:48 +01:00 committed by Fridolin Somers
parent 78815e9777
commit b80fda78d9
2 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
View File

@ -205,6 +205,11 @@
<div class="alert alert-info">
<p>Item renewed</p>
</div>
[% ELSIF ( renewed == 0) %]
<span class="sco-alert-warning renew"></span>
<div class="alert alert-info">
<p>Item not renewed</p>
</div>
[% ELSIF ( returned == 0 ) %]
<span class="sco-alert-warning return"></span>
<div class="alert alert-info">

36
opac/sco/sco-main.pl
View File

@ -139,19 +139,28 @@ my $confirm_required = 0;
my $return_only = 0;
if ( $patron && $op eq "returnbook" && $allowselfcheckreturns ) {
my $success = 0;
my $human_required = 0;
my $success = 1;
my $item = Koha::Items->find( { barcode => $barcode } );
if ( C4::Context->preference("CircConfirmItemParts") ) {
if ( $success && C4::Context->preference("CircConfirmItemParts") ) {
if ( defined($item)
&& $item->materials )
{
$human_required = 1;
$success = 0;
}
}
($success) = AddReturn( $barcode, $branch )
unless $human_required;
if ($success) {
# Patron cannot checkin an item they don't own
$success = 0
unless $patron->checkouts->find( { itemnumber => $item->itemnumber } );
}
if ( $success ) {
($success) = AddReturn( $barcode, $branch )
}
$template->param( returned => $success );
}
elsif ( $patron && ( $op eq 'checkout' ) ) {
@ -267,11 +276,16 @@ elsif ( $patron && ( $op eq 'checkout' ) ) {
if ( $patron && ( $op eq 'renew' ) ) {
my $item = Koha::Items->find({ barcode => $barcode });
my ($status,$renewerror) = CanBookBeRenewed( $patron->borrowernumber, $item->itemnumber );
if ($status) {
AddRenewal( $patron->borrowernumber, $item->itemnumber, undef, undef, undef, undef, 1 );
push @newissueslist, $barcode;
$template->param( renewed => 1 );
if ( $patron->checkouts->find( { itemnumber => $item->itemnumber } ) ) {
my ($status,$renewerror) = CanBookBeRenewed( $patron->borrowernumber, $item->itemnumber );
if ($status) {
AddRenewal( $patron->borrowernumber, $item->itemnumber, undef, undef, undef, undef, 1 );
push @newissueslist, $barcode;
$template->param( renewed => 1 );
}
} else {
$template->param( renewed => 0 );
}
}