6a98db50fc
It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
53 lines
1.6 KiB
Perl
Executable file
53 lines
1.6 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
#script to modify reserves/requests
|
|
#written 2/1/00 by chris@katipo.oc.nz
|
|
#last update 27/1/2000 by chris@katipo.co.nz
|
|
|
|
|
|
# Copyright 2000-2002 Katipo Communications
|
|
#
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it under the
|
|
# terms of the GNU General Public License as published by the Free Software
|
|
# Foundation; either version 2 of the License, or (at your option) any later
|
|
# version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
|
|
# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along
|
|
# with Koha; if not, write to the Free Software Foundation, Inc.,
|
|
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use CGI;
|
|
use C4::Output;
|
|
use C4::Reserves;
|
|
use C4::Auth;
|
|
my $query = new CGI;
|
|
|
|
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
|
|
{
|
|
template_name => "opac-account.tt",
|
|
query => $query,
|
|
type => "opac",
|
|
authnotrequired => 0,
|
|
flagsrequired => { borrow => 1 },
|
|
debug => 1,
|
|
}
|
|
);
|
|
|
|
my $reserve_id = $query->param('reserve_id');
|
|
|
|
if ($reserve_id && $borrowernumber) {
|
|
|
|
my $reserve = GetReserve($reserve_id);
|
|
CancelReserve({ reserve_id => $reserve_id }) if $borrowernumber == $reserve->{borrowernumber} ;
|
|
}
|
|
|
|
print $query->redirect("/cgi-bin/koha/opac-user.pl#opac-user-holds");
|