]> git.koha-community.org Git - koha.git/commit
Bug 29543: Prevent user to checkin or renew items they don't own
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 5 Jan 2022 14:25:48 +0000 (15:25 +0100)
committerVictor Grousset/tuxayo <victor@tuxayo.net>
Mon, 31 Jan 2022 18:15:44 +0000 (19:15 +0100)
commit6674a3b80fe5ce3f443dbd1e9959b0fe31e80021
treed9af9462b78fe0785c81ab5a88176f6e39f8baa7
parentef700ba5c2204a7ca476d21a8a75afc90bbda6ae
Bug 29543: Prevent user to checkin or renew items they don't own

Checkin or renew must be restricted to the items they own.

Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1

You should see an error message

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 839b7c4a5c8bdba62776fdb74c5f2125622a9ff0)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
opac/sco/sco-main.pl