gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos 

Test plan:
Login with a patron that is not allowed to see patron's information for patrons
outside of his group. Try to access patron's information from scripts of the patron
module (members/*) and circ/circulation.pl.
You should be able to access patron's information of patrons outside of your group
and get "You are not allowed to see the information of this patron."
If you try and access a patron page with a borrowernumber that does not exist, you
should get "This patron does not exist"

Technical note:
A new C4::Output subroutine is created in this patch: "output_and_exit_if_error"
Executed at the beginning of the script it will permit not to copy/paste all the
different checks to know if the logged in user is authorised to see patron's information.
The design here can be discussed, but I did not find an alternative with as less changes.
On the way I refactor what we did with 'unknowuser' previously: it will now work with all
patron pages, not only the few that used it.
Note that the 'or die "Not logged in";' part should not be needed, but... who trusts
C4::Auth?
I think it could be used as a safeguard later. I am willing to sed and remove them
if required.

Changes in discharge.pl are mainly indentation changes.

With this patch we should now have a $patron variable that refer to the patron we
want to access. That will be very useful to remove plenty of code in members/* and
only pass this variable to the template (instead of 1 variable per patron's attribute).

Signed-off-by: Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2017-04-04 18:48:45 -03:00
parent 4bc92169dc
commit cee2cf9ff9
46 changed files with 187 additions and 126 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
C4/Output.pm
View File

@ -50,6 +50,7 @@ BEGIN {
);
push @EXPORT, qw(
&output_html_with_http_headers &output_ajax_with_http_headers &output_with_http_headers
&output_and_exit_if_error
);
}
@ -306,6 +307,30 @@ sub is_ajax {
return ( $x_req and $x_req =~ /XMLHttpRequest/i ) ? 1 : 0;
}
sub output_and_exit_if_error {
my ( $query, $cookie, $template, $params ) = @_;
my $error;
if ( $params and exists $params->{module} ) {
if ( $params->{module} eq 'members' ) {
my $logged_in_user = $params->{logged_in_user};
my $current_patron = $params->{current_patron};
if ( not $current_patron ) {
$error = 'unknown_patron';
}
elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
$error = 'cannot_see_patron_infos';
}
}
}
if ( $error ) {
$template->param( blocking_error => $error );
output_html_with_http_headers ( $query, $cookie, $template->output );
exit;
}
return;
}
sub parametrized_url {
my $url = shift || ''; # ie page.pl?ln={LANG}
my $vars = shift || {}; # ie { LANG => en }

1
koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<script type="text/javascript">
//<![CDATA[
function confirm_deletion() {

1
koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<script type="text/javascript">
//<![CDATA[
$(document).ready(function() {

10
koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc Normal file
View File

@ -0,0 +1,10 @@
[% IF blocking_error %]
[% SWITCH blocking_error %]
[% CASE 'unknown_patron' %]
<div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div>
[% CASE 'cannot_see_patron_infos' %]You are not allowed to see the information of this patron.
[% CASE %][% blocking_error %]
[% END %]
[% STOP %] [%# Will stop gracefully without processing any more of the template document.%]
[% END %]

1
koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
[% IF ( budget_period_id ) %]
<div class="btn-group">

1
koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
[% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ||

1
koha-tmpl/intranet-tmpl/prog/en/includes/labels-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
<div class="btn-group">
<button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button>

1
koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
[% USE Koha %]
[% USE Borrowers %]
[% USE Branches %]

1
koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
[% USE Categories %]
[% USE Koha %]
[% SET categories = Categories.all %]

1
koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
<div class="btn-group">
<button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New <span class="caret"></span></button>

1
koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
[% IF ( CAN_user_reports_create_reports ) %]
<div class="btn-group">

1
koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
<div class="btn-group">
<a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=new"><i class="fa fa-plus"></i> New collection</a>

1
koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
View File

@ -1,3 +1,4 @@
[% INCLUDE 'blocking_errors.inc' %]
[% IF subscriptionid and ( CAN_user_serials_edit_subscription || CAN_user_serials_create_subscription || CAN_user_serials_delete_subscription || CAN_user_serials_receive_serials ) %]
<div id="toolbar" class="btn-toolbar">
[% IF CAN_user_serials_create_subscription %]

2
koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
View File

@ -1,3 +1,5 @@
[% INCLUDE 'blocking_errors.inc' %]
<div id="toolbar" class="btn-toolbar">
<div class="btn-group"><a id="newshelf" class="btn btn-default btn-sm" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=add_form&amp;referer=[% op %]"><i class="fa fa-plus"></i> New list</a></div>

4
koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
View File

@ -2,7 +2,7 @@
[% USE AuthorisedValues %]
[% USE Branches %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Patrons &rsaquo; [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title>
<title>Koha &rsaquo; Patrons &rsaquo; [% UNLESS blocking_error %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]</title>
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="discharge" class="discharge">
@ -12,7 +12,7 @@
<div id="breadcrumbs">
<a href="/cgi-bin/koha/mainpage.pl">Home</a>
&rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
&rsaquo; [% IF (unknowuser) %]Patron does not exist[% ELSE %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
&rsaquo; [% UNLESS blocking_error %]Discharge for [% firstname %] [% surname %] ([% cardnumber %])[% END %]
</div>
<div id="doc3" class="yui-t1">

4
koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
View File

@ -30,9 +30,7 @@
<div id="yui-main">
<div class="yui-b">
[% UNLESS ( unknowuser ) %]
[% INCLUDE 'members-toolbar.inc' %]
[% END %]
<div class="yui-g">
@ -43,8 +41,6 @@
[% FOR m IN messages %]
<div class="dialog [% m.type %]">
[% SWITCH m.code %]
[% CASE 'error_on_patron_load' %]
An error occurred whilst loading the patron details.
[% CASE 'error_on_profile_store' %]
An error occurred whilst updating this housebound profile.
[% CASE 'error_on_profile_create' %]

13
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
View File

@ -5,9 +5,7 @@
[% USE ColumnsSettings %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Patrons &rsaquo;
[% IF ( unknowuser ) %]
Patron does not exist
[% ELSE %]
[% UNLESS blocking_error %]
Patron details for [% INCLUDE 'patron-title.inc' no_html = 1 %]
[% END %]
</title>
@ -144,7 +142,7 @@ function validate1(date) {
<div id="breadcrumbs">
<a href="/cgi-bin/koha/mainpage.pl">Home</a>
&rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
&rsaquo; [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %]
&rsaquo; [% UNLESS blocking_error %]Patron details for [% INCLUDE 'patron-title.inc' %][% END %]
</div>
<div id="doc3" class="yui-t2">
@ -153,9 +151,7 @@ function validate1(date) {
<div id="yui-main">
<div class="yui-b">
[% UNLESS ( unknowuser ) %]
[% INCLUDE 'members-toolbar.inc' %]
[% END %]
[% IF ( error ) %]
<div class="dialog alert">
@ -179,9 +175,6 @@ function validate1(date) {
[% END %]
<div class="yui-g">
[% IF ( unknowuser ) %]
<div class="dialog message">This patron does not exist. <a href="/cgi-bin/koha/members/members-home.pl">Find another patron?</a></div>
[% ELSE %]
[% IF ( was_renewed ) %]<div class="dialog message">Patron's account has been renewed until [% dateexpiry | $KohaDates %]</div>[% END %]
[% IF fines %]
@ -657,8 +650,6 @@ function validate1(date) {
[% END %]
</div>
[% END %] <!-- unknowuser -->
</div>
</div>

6
koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt
View File

@ -3,7 +3,9 @@
[% USE Branches %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Patrons &rsaquo;
Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %]
[% UNLESS blocking_error %]
Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %]
[% END %]
</title>
[% INCLUDE 'doc-head-close.inc' %]
<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables_[% KOHA_VERSION %].css" />
@ -26,7 +28,7 @@ Statistics for [% INCLUDE 'patron-title.inc' no_html = 1 %]
<div id="breadcrumbs">
<a href="/cgi-bin/koha/mainpage.pl">Home</a>
&rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
&rsaquo; [% IF ( unknowuser ) %]Patron does not exist[% ELSE %]Statistics for [% INCLUDE 'patron-title.inc' invert_name = 1 %][% END %]
&rsaquo; [% UNLESS blocking_error %]Statistics for [% INCLUDE 'patron-title.inc' invert_name = 1 %][% END %]
</div>
<div id="doc3" class="yui-t1">

4
members/boraccount.pl
View File

@ -51,13 +51,15 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user(
my $borrowernumber=$input->param('borrowernumber');
my $action = $input->param('action') || '';
#get patron details
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
if ( $action eq 'reverse' ) {
ReversePayment( scalar $input->param('accountlines_id') );
}

13
members/deletemem.pl
View File

@ -38,7 +38,7 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen
my $input = new CGI;
my ($template, $borrowernumber, $cookie)
my ($template, $loggedinuser, $cookie)
= get_template_and_user({template_name => "members/deletemem.tt",
query => $input,
type => "intranet",
@ -51,11 +51,15 @@ my ($template, $borrowernumber, $cookie)
my $member = $input->param('member');
#Do not delete yourself...
if ($borrowernumber == $member ) {
if ( $loggedinuser == $member ) {
print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_YOURSELF");
exit 0; # Exit without error
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $member );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
# Handle deletion from the Norwegian national patron database, if it is enabled
# If the "deletelocal" parameter is set to "false", the regular deletion will be
# short circuited, and only a deletion from the national database can be carried
@ -73,11 +77,6 @@ if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preferen
my $issues = GetPendingIssues($member); # FIXME: wasteful call when really, we only want the count
my $countissues = scalar(@$issues);
my $patron = Koha::Patrons->find( $member );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$member");
exit;
}
my $flags = C4::Members::patronflags( $patron->unblessed );
my $userenv = C4::Context->userenv;

8
members/discharge.pl
View File

@ -58,13 +58,9 @@ unless ( C4::Context->preference('useDischarge') ) {
exit;
}
$borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $can_be_discharged = Koha::Patron::Discharge::can_be_discharged({
borrowernumber => $borrowernumber

3
members/discharges.pl
View File

@ -44,6 +44,9 @@ my $branchcode =
if( $op eq 'allow' ) {
my $borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
Koha::Patron::Discharge::discharge({
borrowernumber => $borrowernumber
}) if $borrowernumber;

12
members/files.pl
View File

@ -46,7 +46,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
$template->param( 'borrower_files' => 1 );
my $borrowernumber = $cgi->param('borrowernumber');
my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber );
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
output_and_exit_if_error( $cgi, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $bf = Koha::Patron::Files->new( borrowernumber => $borrowernumber ); # FIXME Should be $patron->get_files. Koha::Patron::Files needs to be Koha::Objects based first
my $op = $cgi->param('op') || '';
@ -62,11 +67,6 @@ if ( $op eq 'download' ) {
print $file->{'file_content'};
}
else {
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $cgi->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $patron_category = $patron->category;
$template->param(%{ $patron->unblessed});

10
members/housebound.pl
View File

@ -56,12 +56,10 @@ my $method = $input->param('method') // q{};
my $visit_id = $input->param('visit_id') // q{};
# Get patron
my $patron = eval {
my $borrowernumber = $input->param('borrowernumber') // q{};
return Koha::Patrons->find($borrowernumber);
};
push @messages, { type => 'error', code => 'error_on_patron_load' }
if ( $@ or !$patron );
my $borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
# Get supporting cast
my ( $branch, $category, $houseboundprofile, $visit, $patron_image );

5
members/mancredit.pl
View File

@ -50,6 +50,8 @@ my $add=$input->param('add');
if ($add){
if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
# Note: If the logged in user is not allowed to see this patron an invoice can be forced
# Here we are trusting librarians not to hack the system
my $barcode = $input->param('barcode');
my $itemnum;
if ($barcode) {
@ -75,7 +77,8 @@ if ($add){
debug => 1,
}
);
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
if ( $patron->category->category_type eq 'C') {
my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
$template->param( 'CATCODE_MULTI' => 1) if $patron_categories->count > 1;

9
members/maninvoice.pl
View File

@ -50,7 +50,8 @@ unless ( $patron ) {
my $add=$input->param('add');
if ($add){
if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
# print $input->header;
# Note: If the logged in user is not allowed to see this patron an invoice can be forced
# Here we are trusting librarians not to hack the system
my $barcode=$input->param('barcode');
my $itemnum;
if ($barcode) {
@ -92,7 +93,11 @@ if ($add){
updatecharges => 'remaining_permissions' },
debug => 1,
});
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
# get authorised values with type of MANUAL_INV
my @invoice_types;
my $dbh = C4::Context->dbh;

4
members/member-flags.pl
View File

@ -33,7 +33,7 @@ unless ( $patron ) {
my $category_type = $patron->category->category_type;
my $bor = $patron->unblessed;
if( $category_type eq 'S' ) {
if( $category_type eq 'S' ) { # FIXME Is this really needed?
$flagsrequired->{'staffaccess'} = 1;
}
my ($template, $loggedinuser, $cookie) = get_template_and_user({
@ -45,6 +45,8 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({
debug => 1,
});
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my %member2;
$member2{'borrowernumber'}=$member;

6
members/member-password.pl
View File

@ -45,11 +45,9 @@ my $newpassword2 = $input->param('newpassword2');
my @errors;
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $member );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$member");
exit;
}
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category_type = $patron->category->category_type;
my $bor = $patron->unblessed;

13
members/memberentry.pl
View File

@ -75,13 +75,16 @@ my ($template, $loggedinuser, $cookie)
debug => ($debug) ? 1 : 0,
});
my $borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
if ( C4::Context->preference('SMSSendDriver') eq 'Email' ) {
my @providers = Koha::SMS::Providers->search();
$template->param( sms_providers => \@providers );
}
my $guarantorid = $input->param('guarantorid');
my $borrowernumber = $input->param('borrowernumber');
my $actionType = $input->param('actionType') || '';
my $modify = $input->param('modify');
my $delete = $input->param('delete');
@ -151,12 +154,7 @@ $template->param( "quickadd" => 1 ) if ( $quickadd );
$template->param( "duplicate" => 1 ) if ( $op eq 'duplicate' );
$template->param( "checked" => 1 ) if ( defined($nodouble) && $nodouble eq 1 );
if ( $op eq 'modify' or $op eq 'save' or $op eq 'duplicate' ) {
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
$borrower_data = $patron->unblessed;
$borrower_data->{category_type} = $patron->category->category_type;
}
@ -315,7 +313,6 @@ if ($op eq 'save' || $op eq 'insert'){
my $dateofbirth;
if ($op eq 'save' && $step == 3) {
my $patron = Koha::Patrons->find( $borrowernumber );
$dateofbirth = $patron->dateofbirth;
}
else {

6
members/members-update-do.pl
View File

@ -27,6 +27,7 @@ use Koha::Patron::Modifications;
my $query = new CGI;
# FIXME Should be a checkauth call
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "about.tt",
@ -38,12 +39,17 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
}
);
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my @params = $query->param;
foreach my $param (@params) {
if ( $param =~ "^modify_" ) {
my (undef, $borrowernumber) = split( /_/, $param );
my $patron = Koha::Patrons->find($borrowernumber);
next unless $logged_in_user->can_see_patron_infos( $patron );
my $action = $query->param($param);
if ( $action eq 'approve' ) {

8
members/mod_debarment.pl
View File

@ -32,6 +32,14 @@ my ( $loggedinuser, $cookie, $sessionID ) = checkauth( $cgi, 0, { borrowers => '
my $borrowernumber = $cgi->param('borrowernumber');
my $action = $cgi->param('action');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
# Ideally we should display a warning on the interface if the patron is not allowed
# to modify a debarment
# But a librarian is not supposed to hack the system
$action = '' unless $logged_in_user->can_see_patron_infos( $patron );
if ( $action eq 'del' ) {
DelDebarment( scalar $cgi->param('borrower_debarment_id') );
} elsif ( $action eq 'add' ) {

9
members/moremember.pl
View File

@ -121,12 +121,9 @@ $borrowernumber = HTML::Entities::encode($borrowernumber);
my $error = $input->param('error');
$template->param( error => $error ) if ( $error );
my $patron = Koha::Patrons->find($borrowernumber);
unless ( $patron ) {
$template->param (unknowuser => 1);
output_html_with_http_headers $input, $cookie, $template->output;
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $issues = $patron->checkouts;
my $balance = $patron->account->balance;

3
members/notices.pl
View File

@ -48,6 +48,9 @@ my ($template, $loggedinuser, $cookie)
debug => 1,
});
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
$template->param( $borrower );
$template->param( picture => 1 ) if $patron->image;

9
members/pay.pl
View File

@ -66,11 +66,10 @@ if ( !$borrowernumber ) {
}
# get borrower details
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find($borrowernumber);
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
our $borrower = $patron->unblessed;
$borrower->{description} = $category->description;

7
members/paycollect.pl
View File

@ -49,11 +49,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
# get borrower details
my $borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $borrower = $patron->unblessed;
my $category = $patron->category;
$borrower->{description} = $category->description;

6
members/print_overdues.pl
View File

@ -27,6 +27,8 @@ use C4::Output;
use C4::Members qw(GetOverduesForPatron);
use C4::Overdues qw(parse_overdues_letter);
use Koha::Patrons;
my $input = new CGI;
my $flagsrequired = { circulate => "circulate_remaining_permissions" };
@ -45,6 +47,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
my $borrowernumber = $input->param('borrowernumber');
my $branchcode = C4::Context->userenv->{'branch'};
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $overdues = GetOverduesForPatron($borrowernumber);
my $letter = parse_overdues_letter(

9
members/printfeercpt.pl
View File

@ -49,11 +49,10 @@ my $borrowernumber=$input->param('borrowernumber');
my $action = $input->param('action') || '';
my $accountlines_id = $input->param('accountlines_id');
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $data = $patron->unblessed;
$data->{description} = $category->description;

9
members/printinvoice.pl
View File

@ -48,11 +48,10 @@ my $borrowernumber = $input->param('borrowernumber');
my $action = $input->param('action') || '';
my $accountlines_id = $input->param('accountlines_id');
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $data = $patron->unblessed;
$data->{description} = $category->description;

5
members/printslip.pl
View File

@ -73,6 +73,11 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
);
my $borrowernumber = $input->param('borrowernumber');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $branch=C4::Context->userenv->{'branch'};
my ($slip, $is_html);
if (my $letter = IssueSlip ($session->param('branch') || $branch, $borrowernumber, $print eq "qslip")) {

9
members/purchase-suggestions.pl
View File

@ -42,11 +42,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
my $borrowernumber = $input->param('borrowernumber');
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $data = $patron->unblessed;
$data->{description} = $category->description;

8
members/readingrec.pl
View File

@ -60,10 +60,9 @@ if ($input->param('borrowernumber')) {
$patron = Koha::Patrons->find( $borrowernumber );
}
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
$data = $patron->unblessed;
$borrowernumber = $patron->borrowernumber;
@ -81,6 +80,7 @@ if ( $borrowernumber eq C4::Context->preference('AnonymousPatron') ){
# barcode export
if ( $op eq 'export_barcodes' ) {
# FIXME This should be moved out of this script
if ( $data->{'privacy'} < 2) {
my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 });
my @barcodes =

9
members/routing-lists.pl
View File

@ -47,12 +47,9 @@ my $borrowernumber = $query->param('borrowernumber');
my $branch = C4::Context->userenv->{'branch'};
my $patron;
$patron = Koha::Patrons->find( $borrowernumber ) if $borrowernumber;
unless ( $patron ) {
print $query->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $query, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $patron_info = $patron->unblessed;

26
members/setstatus.pl
View File

@ -34,7 +34,7 @@ use Koha::Patrons;
my $input = new CGI;
checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
my ( $loggedinuser ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
my $destination = $input->param("destination") || '';
my $borrowernumber=$input->param('borrowernumber');
@ -44,14 +44,22 @@ my $reregistration = $input->param('reregistration') || '';
my $dbh = C4::Context->dbh;
my $dateexpiry;
if ( $reregistration eq 'y' ) {
# re-reregistration function to automatic calcul of date expiry
$dateexpiry = Koha::Patrons->find( $borrowernumber )->renew_account;
} else {
my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
$sth->execute( $status, $borrowernumber );
$sth->finish;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
# Ideally we should display a warning on the interface if the logged in user is
# not allowed to modify this patron.
# But a librarian is not supposed to hack the system
unless ( $logged_in_user->can_see_patron_infos($patron) ) {
if ( $reregistration eq 'y' ) {
# re-reregistration function to automatic calcul of date expiry
$dateexpiry = $patron->renew_account;
} else {
my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
$sth->execute( $status, $borrowernumber );
$sth->finish;
}
}
if($destination eq "circ"){
if($dateexpiry){

9
members/statistics.pl
View File

@ -47,12 +47,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
my $borrowernumber = $input->param('borrowernumber');
# Set informations for the patron
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $borrower= $patron->unblessed;

9
members/summary-print.pl
View File

@ -43,11 +43,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
}
);
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $category = $patron->category;
my $data = $patron->unblessed;
$data->{description} = $category->description;

10
members/update-child.pl
View File

@ -57,6 +57,8 @@ my $cattype = $input->param('cattype');
my $catcode_multi = $input->param('catcode_multi');
my $op = $input->param('op');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
if ( $op eq 'multi' ) {
# FIXME - what are the possible upgrade paths? C -> A , C -> S ...
# currently just allowing C -> A
@ -71,11 +73,9 @@ if ( $op eq 'multi' ) {
}
elsif ( $op eq 'update' ) {
my $patron = Koha::Patrons->find( $borrowernumber );
unless ( $patron ) {
print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber");
exit;
}
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $member = $patron->unblessed;
$member->{'guarantorid'} = 0;
$member->{'categorycode'} = $catcode;