Bug 29543: Prevent user to checkin or renew items they don't own
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 5 Jan 2022 14:25:48 +0000 (15:25 +0100)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 3 Feb 2022 07:05:29 +0000 (21:05 -1000)
commitb80fda78d9d5affe3b9beb4ede49d5ab4e73cf38
treeb4188bb2db7ef1c52f6f3f09e59b315316924c0d
parent78815e97774a101f1108950249ff10ba3a3f9898
Bug 29543: Prevent user to checkin or renew items they don't own

Checkin or renew must be restricted to the items they own.

Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1

You should see an error message

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
opac/sco/sco-main.pl