Koha/members/update-child.pl
Jonathan Druart cee2cf9ff9 Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos
Test plan:
Login with a patron that is not allowed to see patron's information for patrons
outside of his group. Try to access patron's information from scripts of the patron
module (members/*) and circ/circulation.pl.
You should be able to access patron's information of patrons outside of your group
and get "You are not allowed to see the information of this patron."
If you try and access a patron page with a borrowernumber that does not exist, you
should get "This patron does not exist"

Technical note:
A new C4::Output subroutine is created in this patch: "output_and_exit_if_error"
Executed at the beginning of the script it will permit not to copy/paste all the
different checks to know if the logged in user is authorised to see patron's information.
The design here can be discussed, but I did not find an alternative with as less changes.
On the way I refactor what we did with 'unknowuser' previously: it will now work with all
patron pages, not only the few that used it.
Note that the 'or die "Not logged in";' part should not be needed, but... who trusts
C4::Auth?
I think it could be used as a safeguard later. I am willing to sed and remove them
if required.

Changes in discharge.pl are mainly indentation changes.

With this patch we should now have a $patron variable that refer to the patron we
want to access. That will be very useful to remove plenty of code in members/* and
only pass this variable to the template (instead of 1 variable per patron's attribute).

Signed-off-by: Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-12 15:41:38 -03:00

98 lines
3.3 KiB
Perl
Executable file

#!/usr/bin/perl
# Copyright 2000-2002 Katipo Communications
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.
=head1 updatechild.pl
script to update a child member to (usually) an adult member category
- if called with op=multi, will return all available non child categories, for selection.
- if called with op=update, script will update member record via ModMember().
=cut
use Modern::Perl;
use CGI qw ( -utf8 );
use C4::Context;
use C4::Auth;
use C4::Output;
use C4::Members;
use Koha::Patrons;
use Koha::Patron::Categories;
# use Smart::Comments;
my $dbh = C4::Context->dbh;
my $input = new CGI;
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "members/update-child.tt",
query => $input,
type => "intranet",
authnotrequired => 0,
flagsrequired => { borrowers => 'edit_borrowers' },
debug => 1,
}
);
my $borrowernumber = $input->param('borrowernumber');
my $catcode = $input->param('catcode');
my $cattype = $input->param('cattype');
my $catcode_multi = $input->param('catcode_multi');
my $op = $input->param('op');
my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
if ( $op eq 'multi' ) {
# FIXME - what are the possible upgrade paths? C -> A , C -> S ...
# currently just allowing C -> A
my $patron_categories = Koha::Patron::Categories->search_limited({ category_type => 'A' }, {order_by => ['categorycode']});
$template->param(
MULTI => 1,
CATCODE_MULTI => 1,
borrowernumber => $borrowernumber,
patron_categories => $patron_categories,
);
output_html_with_http_headers $input, $cookie, $template->output;
}
elsif ( $op eq 'update' ) {
my $patron = Koha::Patrons->find( $borrowernumber );
output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
my $member = $patron->unblessed;
$member->{'guarantorid'} = 0;
$member->{'categorycode'} = $catcode;
my $borcat = Koha::Patron::Categories->find($catcode);
$member->{'category_type'} = $borcat->category_type;
$member->{'description'} = $borcat->description;
delete $member->{password};
ModMember(%$member);
if ( $catcode_multi ) {
$template->param(
SUCCESS => 1,
borrowernumber => $borrowernumber,
);
output_html_with_http_headers $input, $cookie, $template->output;
} else {
print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
}
}