Koha/services/itemrecorddisplay.pl
Galen Charlton effb64f7f2 Bug 11715: require authentication for various staff scripts
To test:

[1] Verify that item record creating and editing during the
    acquisitions process continues to work.
[2] Verify that calling  services/itemrecorddisplay.pl without
    a valid user session fails.
[3] Verify that authentication is required for making a new
    order from a suggestion, transferring an order, doing a
    Z39.50 search from acquisitions, displaying the record
    card view in the staff interface, and running the till
    reconciliation report (/cgi-bin/koha/reports/stats.screen.pl)

Signed-off-by: Galen Charlton <gmc@esilibrary.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Verified all changed scripts are not accessible witout a valid
user session, but are with one.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-06-25 12:27:08 -03:00

57 lines
1.7 KiB
Perl
Executable file

#!/usr/bin/perl
# Copyright 2011 BibLibre SARL
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
=head1 NAME
itemrecorddisplay.pl
=head1 DESCRIPTION
Return a HTML form for Item record modification or creation.
It uses PrepareItemrecordDisplay
=cut
use strict;
use warnings;
use CGI;
use C4::Auth;
use C4::Output;
use C4::Items;
my $input = new CGI;
my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( {
template_name => 'services/itemrecorddisplay.tmpl',
query => $input,
type => 'intranet',
flagsrequired => {acquisition => '*'},
} );
my $biblionumber = $input->param('biblionumber') || '';
my $itemnumber = $input->param('itemnumber') || '';
my $frameworkcode = $input->param('frameworkcode') || '';
my $result = PrepareItemrecordDisplay($biblionumber, $itemnumber, undef, $frameworkcode);
unless($result) {
$result = PrepareItemrecordDisplay($biblionumber, $itemnumber, undef, '');
}
$template->param(%$result);
output_html_with_http_headers $input, $cookie, $template->output;