From 4bc92169dcc04cd0bd586abf01828331711980cc Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 4 Apr 2017 17:45:30 -0300
Subject: [PATCH] Bug 18403: Update permissions - borrowers => 1|* becomes
 borrowers => 'edit_borrowers'

Test plan:
Login with a patron that only have the 'edit_borrowers' permission.
You should be able to access patron's information of patrons inside of your group.

Technical note:
Before this patchset the borrowers permission module contains only 1 permission 'edit_borrowers'.
That meant
  borrowers => 1
and
  borrowers => '*'
had the same behavior.
Moreover, now that we have 2 permissions, 'CAN_user_borrowers' is set when all
permissions of 'borrowers' are set.
We need to update the different occurrences of these tests.

Signed-off-by: Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 circ/add_message.pl                              |  2 +-
 circ/del_message.pl                              |  2 +-
 edithelp.pl                                      |  2 +-
 .../prog/en/includes/adv-search.inc              |  4 ++--
 .../prog/en/includes/borrower_debarments.inc     |  6 +++---
 .../intranet-tmpl/prog/en/includes/circ-menu.inc | 16 ++++++++--------
 .../intranet-tmpl/prog/en/includes/header.inc    |  2 +-
 .../prog/en/includes/home-search.inc             |  4 ++--
 .../prog/en/includes/members-menu.inc            |  2 +-
 .../prog/en/includes/members-toolbar.inc         | 16 ++++++++--------
 .../prog/en/modules/circ/circulation.tt          |  2 +-
 .../prog/en/modules/intranet-main.tt             |  8 ++++----
 .../prog/en/modules/members/files.tt             |  4 ++--
 .../prog/en/modules/members/member.tt            |  2 +-
 .../prog/en/modules/members/memberentrygen.tt    |  6 +++---
 labels/label-item-search.pl                      |  2 +-
 members/boraccount.pl                            |  2 +-
 members/default_messageprefs.pl                  |  2 +-
 members/deletemem.pl                             |  4 ++--
 members/discharge.pl                             |  2 +-
 members/discharges.pl                            |  2 +-
 members/files.pl                                 |  2 +-
 members/guarantor_search.pl                      |  2 +-
 members/housebound.pl                            |  2 +-
 members/mancredit.pl                             |  4 ++--
 members/maninvoice.pl                            |  4 ++--
 members/member-password.pl                       |  5 +----
 members/member.pl                                |  2 +-
 members/memberentry.pl                           |  2 +-
 members/members-home.pl                          |  2 +-
 members/members-update-do.pl                     |  2 +-
 members/members-update.pl                        |  2 +-
 members/mod_debarment.pl                         |  2 +-
 members/moremember.pl                            |  4 ++--
 members/nl-search.pl                             |  2 +-
 members/notices.pl                               |  2 +-
 members/pay.pl                                   |  2 +-
 members/paycollect.pl                            |  2 +-
 members/printfeercpt.pl                          |  2 +-
 members/printinvoice.pl                          |  2 +-
 members/purchase-suggestions.pl                  |  2 +-
 members/readingrec.pl                            |  2 +-
 members/setstatus.pl                             |  2 +-
 members/statistics.pl                            |  2 +-
 members/update-child.pl                          |  2 +-
 opac/opac-overdrive-search.pl                    |  2 +-
 svc/checkouts                                    |  2 +-
 svc/members/search                               |  2 +-
 48 files changed, 76 insertions(+), 79 deletions(-)

diff --git a/circ/add_message.pl b/circ/add_message.pl
index 4233e9077e..67a6844c43 100755
--- a/circ/add_message.pl
+++ b/circ/add_message.pl
@@ -32,7 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/circ/del_message.pl b/circ/del_message.pl
index 8dfa3d4d81..8889431943 100755
--- a/circ/del_message.pl
+++ b/circ/del_message.pl
@@ -32,7 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/edithelp.pl b/edithelp.pl
index dca61b108a..a65a504194 100755
--- a/edithelp.pl
+++ b/edithelp.pl
@@ -49,7 +49,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
             catalogue        => 1,
             circulate        => 1,
             parameters       => 1,
-            borrowers        => 1,
+            borrowers        => 'edit_borrowers',
             permissions      => 1,
             reserveforothers => 1,
             reserveforself   => 1,
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/adv-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/adv-search.inc
index 4bce9c463e..cc1abab4c1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/adv-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/adv-search.inc
@@ -21,7 +21,7 @@
             </div>
         [% END %]
 
-        [% IF ( CAN_user_borrowers ) %]
+        [% IF CAN_user_borrowers_edit_borrowers %]
             <div id="patron_search" class="residentsearch">
                 <p class="tip">Enter patron card number or partial name:</p>
                 <form action="/cgi-bin/koha/members/member.pl" method="post">
@@ -42,7 +42,7 @@
             [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]
                 <li><a class="keep_text" href="#renew_search">Renew</a></li>
             [% END %]
-            [% IF ( CAN_user_borrowers ) %]
+            [% IF CAN_user_borrowers_edit_borrowers %]
                 <li><a class="keep_text" href="#patron_search">Search patrons</a></li>
             [% END %]
         </ul>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/borrower_debarments.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/borrower_debarments.inc
index 477fcfab18..99fba0f459 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/borrower_debarments.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/borrower_debarments.inc
@@ -37,7 +37,7 @@
                      <th>Comment</th>
                      <th>Expiration</th>
                      <th>Created</th>
-                     [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+                     [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                          <th>&nbsp;</th>
                      [% END %]
                 </tr>
@@ -66,7 +66,7 @@
 			</td>
                         <td>[% IF d.expiration %] [% d.expiration | $KohaDates %] [% ELSE %] <i>Indefinite</i> [% END %]</td>
                         <td>[% d.created | $KohaDates %]</td>
-                        [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+                        [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                             <td>
                                 <a class="remove_restriction btn btn-default btn-xs" href="/cgi-bin/koha/members/mod_debarment.pl?borrowernumber=[% borrowernumber %]&amp;borrower_debarment_id=[% d.borrower_debarment_id %]&amp;action=del">
                                     <i class="fa fa-trash"></i> Remove
@@ -78,7 +78,7 @@
             </tbody>
         </table>
     [% END %]
-    [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+    [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
         <p><a href="#" id="add_manual_restriction"><i class="fa fa-plus"></i> Add manual restriction</a></p>
         <form method="post" action="/cgi-bin/koha/members/mod_debarment.pl" class="clearfix">
             <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index 7a419bd4e6..bdcc8afb63 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -74,7 +74,7 @@
           [% IF ( batch_checkout_view ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrowernumber %]&amp;batch=1">Batch check out</a></li>
         [% END %]
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Details</a></li>
     [% END %]
     [% IF ( CAN_user_updatecharges ) %]
@@ -83,12 +83,12 @@
     [% IF ( CAN_user_circulate_circulate_remaining_permissions  )  %]
         [% IF Koha.Preference("RoutingSerials") %][% IF ( routinglistview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/routing-lists.pl?borrowernumber=[% borrowernumber %]">Routing lists</a></li>[% END %]
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( intranetreadinghistory ) %]
             [% IF ( readingrecordview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber %]">Circulation history</a></li>
         [% END %]
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( intranetreadinghistory ) %]
             [% IF ( holdshistoryview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/holdshistory.pl?borrowernumber=[% borrowernumber %]">Holds history</a></li>
         [% END %]
@@ -96,22 +96,22 @@
     [% IF ( CAN_user_parameters ) %]
         [% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=MEMBERS&amp;modules=circulation&amp;object=[% borrowernumber %]&amp;src=circ">Modification log</a></li>
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
 	[% IF ( sentnotices ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber %]">Notices</a></li>
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF (  statisticsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/statistics.pl?borrowernumber=[% borrowernumber %]">Statistics</a></li>
     [% END %]
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( EnableBorrowerFiles ) %]
             [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% borrowernumber %]">Files</a></li>
         [% END %]
     [% END %]
 
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% borrowernumber %]">Purchase suggestions</a></li>
     [% END %]
-    [% IF CAN_user_borrowers && useDischarge %]
+    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
         [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% borrowernumber %]">Discharges</a></li>
     [% END %]
     [% IF Koha.Preference('HouseboundModule') %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
index 8e11080c4b..460ea27956 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
@@ -3,7 +3,7 @@
     <div class="container-fluid">
         <ul id="toplevelmenu" class="nav navbar-nav">
             [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]<li><a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a></li>[% END %]
-            [% IF ( CAN_user_borrowers ) %]<li><a href="/cgi-bin/koha/members/members-home.pl">Patrons</a></li>[% END %]
+            [% IF CAN_user_borrowers_edit_borrowers %]<li><a href="/cgi-bin/koha/members/members-home.pl">Patrons</a></li>[% END %]
             <li class="dropdown">
                 <a href="/cgi-bin/koha/catalogue/search.pl" class="dropdown-toggle" data-toggle="dropdown">Search <b class="caret"></b></a>
                 <ul class="dropdown-menu">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/home-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/home-search.inc
index be87ac28c9..59ddcecc6c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/home-search.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/home-search.inc
@@ -21,7 +21,7 @@
     </div>
 [% END %]
 
-[% IF ( CAN_user_borrowers ) %]
+[% IF CAN_user_borrowers_edit_borrowers %]
 <div id="patron_search" class="residentsearch">
     <p class="tip">Enter patron card number or partial name:</p>
     <form action="/cgi-bin/koha/members/member.pl" method="post">
@@ -44,7 +44,7 @@
     [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]<li><a class="keep_text" href="#circ_search">Check out</a></li>[% END %]
     [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]<li><a class="keep_text" href="#checkin_search">Check in</a></li>[% END %]
     [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]<li><a class="keep_text" href="#renew_search">Renew</a></li>[% END %]
-    [% IF ( CAN_user_borrowers ) %]<li><a class="keep_text" href="#patron_search">Search patrons</a></li>[% END %]
+    [% IF CAN_user_borrowers_edit_borrowers %]<li><a class="keep_text" href="#patron_search">Search patrons</a></li>[% END %]
     [% IF ( CAN_user_catalogue ) %]<li><a class="keep_text" href="#catalog_search">Search the catalog</a></li>[% END %]
 </ul>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-menu.inc
index 2b603d0e2f..43d0e5ad0b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-menu.inc
@@ -17,7 +17,7 @@
     [% IF EnableBorrowerFiles %]
         [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% borrowernumber %]">Files</a></li>
     [% END %]
-    [% IF CAN_user_borrowers && useDischarge %]
+    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
         [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% borrowernumber %]">Discharge</a></li>
     [% END %]
     [% IF Koha.Preference('HouseboundModule') %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 7b91418acc..00b20717a9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -6,7 +6,7 @@
 <script type="text/javascript">
 //<![CDATA[
 $(document).ready(function(){
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( NorwegianPatronDBEnable == 1 ) %]
             $("#deletepatronlocal").click(function(){
                 confirm_local_deletion();
@@ -132,7 +132,7 @@ function searchToHold(){
 </script>
 
 <div id="toolbar" class="btn-toolbar">
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( guarantor ) %]
             <a id="editpatron" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% borrowernumber %]&amp;guarantorid=[% guarantor.borrowernumber %]&amp;categorycode=[% categorycode %]">
         [% ELSE %]
@@ -141,11 +141,11 @@ function searchToHold(){
         <i class="fa fa-pencil"></i> Edit</a>
     [% END %]
 
-    [% IF ( CAN_user_borrowers ) %]
+    [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF adultborrower AND Koha.Preference("borrowerRelationship") %]
             <a id="addchild" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;guarantorid=[% borrowernumber %]"><i class="fa fa-plus"></i> Add child</a>
         [% END %]
-        [% IF ( CAN_user_borrowers ) %]
+        [% IF CAN_user_borrowers_edit_borrowers %]
             <a id="changepassword" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/member-password.pl?member=[% borrowernumber %]"><i class="fa fa-lock"></i> Change password</a>
         [% END %]
         <a id="duplicate" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=duplicate&amp;borrowernumber=[% borrowernumber %]&amp;categorycode=[% categorycode %]"><i class="fa fa-copy"></i> Duplicate</a>
@@ -154,7 +154,7 @@ function searchToHold(){
     <div class="btn-group">
         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-print"></i> Print <span class="caret"></span></button>
             <ul class="dropdown-menu">
-                [% IF ( CAN_user_borrowers ) %]<li><a id="printsummary" href="#">Print summary</a></li>[% END %]
+                [% IF CAN_user_borrowers_edit_borrowers %]<li><a id="printsummary" href="#">Print summary</a></li>[% END %]
                 <li><a id="printslip" href="#">Print slip</a></li>
                 <li><a id="printquickslip" href="#">Print quick slip</a></li>
                 [% IF Borrowers.HasOverdues( borrowernumber ) %]
@@ -172,7 +172,7 @@ function searchToHold(){
          <div class="btn-group">
         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown">More <span class="caret"></span></button>
             <ul class="dropdown-menu">
-                [% IF ( CAN_user_borrowers ) %]
+                [% IF CAN_user_borrowers_edit_borrowers %]
                     <li><a id="renewpatron" href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber %]&amp;destination=[% destination %]&amp;reregistration=y">Renew patron</a></li>
                 [% ELSE %]
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to renew patrons" id="renewpatron" href="#">Renew patron</a></li>
@@ -182,10 +182,10 @@ function searchToHold(){
                 [% ELSE %]
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
                 [% END %]
-                [% IF CAN_user_borrowers && useDischarge %]
+                [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
                     <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% borrowernumber %]">Discharge</a></li>
                 [% END %]
-                [% IF ( CAN_user_borrowers ) %]
+                [% IF CAN_user_borrowers_edit_borrowers %]
                     [% IF ( NorwegianPatronDBEnable == 1 ) %]
                         <li><a id="deletepatronlocal" href="#">Delete local</a></li>
                         <li><a id="deletepatronremote" href="#">Delete remote</a></li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
index 2e234258ca..8bad09d409 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
@@ -772,7 +772,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
                    [% IF ( has_modifications ) %]
                     <li><span class="circ-hlt">Pending modifications:</span> Patron has pending modifications.
-                            [% IF CAN_user_borrowers && ( !Koha.Preference('IndependentBranchesPatronModifications') || borrower.branch == branch ) %]
+                            [% IF CAN_user_borrowers_edit_borrowers && ( !Koha.Preference('IndependentBranchesPatronModifications') || borrower.branch == branch ) %]
                                     <a href="/cgi-bin/koha/members/members-update.pl">View all pending patron modifications</a>
                             [% END %]
                    </li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
index 534e681602..9f4759051f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
@@ -50,7 +50,7 @@
                             </li>
                             [% END %]
 
-                            [% IF ( CAN_user_borrowers ) %]
+                            [% IF CAN_user_borrowers_edit_borrowers %]
                             <li>
                                 <a class="icon_general icon_patrons" href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
                             </li>
@@ -131,7 +131,7 @@
                 <div class="row">
                     <div class="col-sm-12">
                         [%# Following statement must be in one line for translatability %]
-                        [% IF ( ( CAN_user_tools_moderate_comments  && pendingcomments ) || ( CAN_user_tools_moderate_tags && pendingtags ) || ( CAN_user_borrowers && pending_borrower_modifications ) || ( CAN_user_acquisition && pendingsuggestions ) || ( CAN_user_borrowers && pending_discharge_requests ) || pending_article_requests) %]
+                        [% IF ( ( CAN_user_tools_moderate_comments  && pendingcomments ) || ( CAN_user_tools_moderate_tags && pendingtags ) || ( CAN_user_borrowers_edit_borrowers && pending_borrower_modifications ) || ( CAN_user_acquisition && pendingsuggestions ) || ( CAN_user_borrowers_edit_borrowers && pending_discharge_requests ) || pending_article_requests) %]
                             <div id="area-pending">
                                 [% IF pending_article_requests %]
                                 <div class="pending-info" id="article_requests_pending">
@@ -164,14 +164,14 @@
                                 [% END %]
 
 
-                                [% IF ( CAN_user_borrowers && pending_borrower_modifications ) %]
+                                [% IF ( CAN_user_borrowers_edit_borrowers && pending_borrower_modifications ) %]
                                 <div class="pending-info" id="patron_updates_pending">
                                     <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
                                     <span class="pending-number-link">[% pending_borrower_modifications %]</span>
                                 </div>
                                 [% END %]
 
-                                [% IF CAN_user_borrowers && pending_discharge_requests %]
+                                [% IF CAN_user_borrowers_edit_borrowers && pending_discharge_requests %]
                                 <div class="pending-info" id="patron_discharges_pending">
                                     <a href="/cgi-bin/koha/members/discharges.pl">Discharge requests pending</a>:
                                     <span class="pending-number-link">[% pending_discharge_requests %]</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
index b5cf108172..5d3c20f4d7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
@@ -46,7 +46,7 @@
                             <th>Type</th>
                             <th>Description</th>
                             <th>Uploaded</th>
-                            [% IF CAN_user_borrowers %]<th>&nbsp;</th>[% END %]
+                            [% IF CAN_user_borrowers_edit_borrowers %]<th>&nbsp;</th>[% END %]
                         </tr>
                     </thead>
 
@@ -57,7 +57,7 @@
                                  <td>[% f.file_type %]</td>
                                  <td>[% f.file_description %]</td>
                                  <td>[% f.date_uploaded | $KohaDates %]</td>
-                                 [% IF CAN_user_borrowers %]<td><a class="btn btn-default btn-xs confirmdelete" href="?borrowernumber=[% borrowernumber %]&amp;op=delete&amp;file_id=[% f.file_id %]"><i class="fa fa-trash"></i> Delete</a></td>[% END %]
+                                 [% IF CAN_user_borrowers_edit_borrowers %]<td><a class="btn btn-default btn-xs confirmdelete" href="?borrowernumber=[% borrowernumber %]&amp;op=delete&amp;file_id=[% f.file_id %]"><i class="fa fa-trash"></i> Delete</a></td>[% END %]
                             </tr>
                         [% END %]
                     </tbody>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
index 0ea93c7bdf..babcfd7bc8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
@@ -348,7 +348,7 @@ function filterByFirstLetterSurname(letter) {
             [% END %]
           </div>
 
-          [% IF ( CAN_user_borrowers && pending_borrower_modifications ) %]
+          [% IF CAN_user_borrowers_edit_borrowers && pending_borrower_modifications %]
             <div class="pending-info" id="patron_updates_pending">
               <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
               <span class="number_box"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 314f216073..4980fbaa16 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -1041,7 +1041,7 @@ $(document).ready(function() {
                                  <th>Comment</th>
                                  <th>Expiration</th>
                                  <th>Created</th>
-                                 [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+                                 [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                                    <th>Remove?</th>
                                  [% END %]
                             </tr>
@@ -1060,7 +1060,7 @@ $(document).ready(function() {
                                     </td>
                                     <td>[% IF d.expiration %] [% d.expiration | $KohaDates %] [% ELSE %] <i>Indefinite</i> [% END %]</td>
                                     <td>[% d.created | $KohaDates %]</td>
-                                    [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+                                    [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                                       <td>
                                         <input type="checkbox" id="debarment_[% d.borrower_debarment_id %]" name="remove_debarment" value="[% d.borrower_debarment_id %]" />
                                       </td>
@@ -1073,7 +1073,7 @@ $(document).ready(function() {
                     <p>Patron is currently unrestricted.</p>
                 [% END %]
 
-                [% IF CAN_user_borrowers && CAN_user_circulate_manage_restrictions %]
+                [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                     <p><a href="#" id="add_manual_restriction">Add manual restriction</a></p>
                     <fieldset id="manual_restriction_form">
                         <input type="hidden" id="add_debarment" name="add_debarment" value="0" />
diff --git a/labels/label-item-search.pl b/labels/label-item-search.pl
index c0a7e8f98e..57f3ff3ea8 100755
--- a/labels/label-item-search.pl
+++ b/labels/label-item-search.pl
@@ -160,7 +160,7 @@ if ($show_results) {
             query           => $query,
             type            => "intranet",
             authnotrequired => 0,
-            flagsrequired   => { borrowers => 1 },
+            flagsrequired   => { borrowers => 'edit_borrowers' },
             flagsrequired   => { catalogue => 1 },
             debug           => 1,
         }
diff --git a/members/boraccount.pl b/members/boraccount.pl
index 632b5210c0..a22f335174 100755
--- a/members/boraccount.pl
+++ b/members/boraccount.pl
@@ -42,7 +42,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers     => 1,
+        flagsrequired   => { borrowers     => 'edit_borrowers',
                              updatecharges => 'remaining_permissions'},
         debug           => 1,
     }
diff --git a/members/default_messageprefs.pl b/members/default_messageprefs.pl
index 105c1ddef0..e0b4343b06 100755
--- a/members/default_messageprefs.pl
+++ b/members/default_messageprefs.pl
@@ -27,7 +27,7 @@ use C4::Form::MessagingPreferences;
 # update the prefs if operator is creating a new patron and has
 # changed the patron category from its original value.
 
-my ($query, $response) = C4::Service->init(borrowers => 1);
+my ($query, $response) = C4::Service->init(borrowers => 'edit_borrowers');
 my ($categorycode) = C4::Service->require_params('categorycode');
 C4::Form::MessagingPreferences::set_form_values({ categorycode => $categorycode }, $response);
 C4::Service->return_success( $response );
diff --git a/members/deletemem.pl b/members/deletemem.pl
index b68cb54ad3..87eb338d4e 100755
--- a/members/deletemem.pl
+++ b/members/deletemem.pl
@@ -43,7 +43,7 @@ my ($template, $borrowernumber, $cookie)
                                         query => $input,
                                         type => "intranet",
                                         authnotrequired => 0,
-                                        flagsrequired => {borrowers => 1},
+                                        flagsrequired => {borrowers => 'edit_borrowers'},
                                         debug => 1,
                                         });
 
@@ -89,7 +89,7 @@ if ($patron->category->category_type eq "S") {
         exit 0; # Exit without error
     }
 } else {
-    unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>1})) {
+    unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>'edit_borrowers'})) {
 	print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE");
         exit 0; # Exit without error
     }
diff --git a/members/discharge.pl b/members/discharge.pl
index a0af828363..97184fd2df 100755
--- a/members/discharge.pl
+++ b/members/discharge.pl
@@ -48,7 +48,7 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user({
     query           => $input,
     type            => 'intranet',
     authnotrequired => 0,
-    flagsrequired   => { 'borrowers' => '*' },
+    flagsrequired   => { 'borrowers' => 'edit_borrowers' },
 });
 
 my $borrowernumber = $input->param('borrowernumber');
diff --git a/members/discharges.pl b/members/discharges.pl
index 4029c745e5..38a7355068 100755
--- a/members/discharges.pl
+++ b/members/discharges.pl
@@ -33,7 +33,7 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user({
     query           => $input,
     type            => "intranet",
     authnotrequired => 0,
-    flagsrequired   => { borrowers => 1 },
+    flagsrequired   => { borrowers => 'edit_borrowers' },
 });
 
 my $branchcode =
diff --git a/members/files.pl b/members/files.pl
index 628ef3196c..4569a160d0 100755
--- a/members/files.pl
+++ b/members/files.pl
@@ -39,7 +39,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $cgi,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/guarantor_search.pl b/members/guarantor_search.pl
index 352f124a62..0287047740 100755
--- a/members/guarantor_search.pl
+++ b/members/guarantor_search.pl
@@ -35,7 +35,7 @@ my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
     }
 );
 
diff --git a/members/housebound.pl b/members/housebound.pl
index b334999b9e..dba49a7f37 100755
--- a/members/housebound.pl
+++ b/members/housebound.pl
@@ -47,7 +47,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => 'intranet',
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
     }
 );
 
diff --git a/members/mancredit.pl b/members/mancredit.pl
index 5f91f707d2..85405eaf05 100755
--- a/members/mancredit.pl
+++ b/members/mancredit.pl
@@ -37,7 +37,7 @@ use Koha::Patrons;
 use Koha::Patron::Categories;
 
 my $input=new CGI;
-my $flagsrequired = { borrowers => 1, updatecharges => 1 };
+my $flagsrequired = { borrowers => 'edit_borrowers', updatecharges => 1 };
 
 my $borrowernumber=$input->param('borrowernumber');
 
@@ -70,7 +70,7 @@ if ($add){
             query           => $input,
             type            => "intranet",
             authnotrequired => 0,
-            flagsrequired   => { borrowers     => 1,
+            flagsrequired   => { borrowers     => 'edit_borrowers',
                                  updatecharges => 'remaining_permissions' },
             debug           => 1,
         }
diff --git a/members/maninvoice.pl b/members/maninvoice.pl
index c63d93321d..9478c7a61a 100755
--- a/members/maninvoice.pl
+++ b/members/maninvoice.pl
@@ -37,7 +37,7 @@ use Koha::Patrons;
 use Koha::Patron::Categories;
 
 my $input=new CGI;
-my $flagsrequired = { borrowers => 1 };
+my $flagsrequired = { borrowers => 'edit_borrowers' };
 
 my $borrowernumber=$input->param('borrowernumber');
 
@@ -88,7 +88,7 @@ if ($add){
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1,
+        flagsrequired   => { borrowers => 'edit_borrowers',
                              updatecharges => 'remaining_permissions' },
         debug           => 1,
     });
diff --git a/members/member-password.pl b/members/member-password.pl
index cba025d4e2..716d054ba7 100755
--- a/members/member-password.pl
+++ b/members/member-password.pl
@@ -32,14 +32,11 @@ my ( $template, $loggedinuser, $cookie, $staffflags ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
 
-my $flagsrequired;
-$flagsrequired->{borrowers} = 1;
-
 my $member      = $input->param('member');
 my $cardnumber  = $input->param('cardnumber');
 my $destination = $input->param('destination');
diff --git a/members/member.pl b/members/member.pl
index 02ccbd13e7..7dc0b1e3af 100755
--- a/members/member.pl
+++ b/members/member.pl
@@ -38,7 +38,7 @@ my ($template, $loggedinuser, $cookie)
                  query => $input,
                  type => "intranet",
                  authnotrequired => 0,
-                 flagsrequired => {borrowers => 1},
+                 flagsrequired => {borrowers => 'edit_borrowers'},
                  });
 
 my $theme = $input->param('theme') || "default";
diff --git a/members/memberentry.pl b/members/memberentry.pl
index 38ffa6c952..365db68cec 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -71,7 +71,7 @@ my ($template, $loggedinuser, $cookie)
            query => $input,
            type => "intranet",
            authnotrequired => 0,
-           flagsrequired => {borrowers => 1},
+           flagsrequired => {borrowers => 'edit_borrowers'},
            debug => ($debug) ? 1 : 0,
        });
 
diff --git a/members/members-home.pl b/members/members-home.pl
index 68c330cdd7..659ce8e0f0 100755
--- a/members/members-home.pl
+++ b/members/members-home.pl
@@ -35,7 +35,7 @@ my ($template, $loggedinuser, $cookie, $flags)
                  query => $query,
                  type => "intranet",
                  authnotrequired => 0,
-                 flagsrequired => {borrowers => 1},
+                 flagsrequired => {borrowers => 'edit_borrowers'},
                  debug => 1,
                  });
 
diff --git a/members/members-update-do.pl b/members/members-update-do.pl
index 613090bf53..1ac1de0eb9 100755
--- a/members/members-update-do.pl
+++ b/members/members-update-do.pl
@@ -33,7 +33,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $query,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/members-update.pl b/members/members-update.pl
index 23d14c7c01..84019f4e20 100755
--- a/members/members-update.pl
+++ b/members/members-update.pl
@@ -38,7 +38,7 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
         query           => $query,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/mod_debarment.pl b/members/mod_debarment.pl
index 9feaf1a13c..2bf637b7ff 100755
--- a/members/mod_debarment.pl
+++ b/members/mod_debarment.pl
@@ -27,7 +27,7 @@ use Koha::Patron::Debarments;
 
 my $cgi = new CGI;
 
-my ( $loggedinuser, $cookie, $sessionID ) = checkauth( $cgi, 0, { borrowers => 1 }, 'intranet' );
+my ( $loggedinuser, $cookie, $sessionID ) = checkauth( $cgi, 0, { borrowers => 'edit_borrowers' }, 'intranet' );
 
 my $borrowernumber = $cgi->param('borrowernumber');
 my $action         = $cgi->param('action');
diff --git a/members/moremember.pl b/members/moremember.pl
index 1bf4d2288f..1219b9dfd1 100755
--- a/members/moremember.pl
+++ b/members/moremember.pl
@@ -100,10 +100,10 @@ if (defined $print and $print eq "page") {
     $flagsrequired =  { circulate => "circulate_remaining_permissions" };
 } elsif (defined $print and $print eq "brief") {
     $template_name = "members/moremember-brief.tt";
-    $flagsrequired = { borrowers => 1 };
+    $flagsrequired = { borrowers => 'edit_borrowers' };
 } else {
     $template_name = "members/moremember.tt";
-    $flagsrequired = { borrowers => 1 };
+    $flagsrequired = { borrowers => 'edit_borrowers' };
 }
 
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
diff --git a/members/nl-search.pl b/members/nl-search.pl
index 29ec13e6cf..2ff2177f86 100755
--- a/members/nl-search.pl
+++ b/members/nl-search.pl
@@ -57,7 +57,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $cgi,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/notices.pl b/members/notices.pl
index af66679e31..cdc5f9f250 100755
--- a/members/notices.pl
+++ b/members/notices.pl
@@ -44,7 +44,7 @@ my ($template, $loggedinuser, $cookie)
 				query => $input,
 				type => "intranet",
 				authnotrequired => 0,
-				flagsrequired => {borrowers => 1},
+                flagsrequired => {borrowers => 'edit_borrowers'},
 				debug => 1,
 				});
 
diff --git a/members/pay.pl b/members/pay.pl
index 03f3594d4d..bb1f8218a8 100755
--- a/members/pay.pl
+++ b/members/pay.pl
@@ -53,7 +53,7 @@ our ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => 'intranet',
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1, updatecharges => $updatecharges_permissions },
+        flagsrequired   => { borrowers => 'edit_borrowers', updatecharges => $updatecharges_permissions },
         debug           => 1,
     }
 );
diff --git a/members/paycollect.pl b/members/paycollect.pl
index 9bfa502537..091f1d57c9 100755
--- a/members/paycollect.pl
+++ b/members/paycollect.pl
@@ -42,7 +42,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => 'intranet',
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1, updatecharges => $updatecharges_permissions },
+        flagsrequired   => { borrowers => 'edit_borrowers', updatecharges => $updatecharges_permissions },
         debug           => 1,
     }
 );
diff --git a/members/printfeercpt.pl b/members/printfeercpt.pl
index ff31c6ceed..d5af0e92c4 100755
--- a/members/printfeercpt.pl
+++ b/members/printfeercpt.pl
@@ -41,7 +41,7 @@ my ($template, $loggedinuser, $cookie)
                             query => $input,
                             type => "intranet",
                             authnotrequired => 0,
-                            flagsrequired => {borrowers => 1, updatecharges => 'remaining_permissions'},
+                            flagsrequired => {borrowers => 'edit_borrowers', updatecharges => 'remaining_permissions'},
                             debug => 1,
                             });
 
diff --git a/members/printinvoice.pl b/members/printinvoice.pl
index 76d473d23b..a8ea225d40 100755
--- a/members/printinvoice.pl
+++ b/members/printinvoice.pl
@@ -39,7 +39,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired => { borrowers => 1, updatecharges => 'remaining_permissions' },
+        flagsrequired => { borrowers => 'edit_borrowers', updatecharges => 'remaining_permissions' },
         debug           => 1,
     }
 );
diff --git a/members/purchase-suggestions.pl b/members/purchase-suggestions.pl
index f6df07d598..c2dc15616d 100755
--- a/members/purchase-suggestions.pl
+++ b/members/purchase-suggestions.pl
@@ -35,7 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/readingrec.pl b/members/readingrec.pl
index ee835ba6f6..ca3b04de0a 100755
--- a/members/readingrec.pl
+++ b/members/readingrec.pl
@@ -45,7 +45,7 @@ my ($template, $loggedinuser, $cookie)= get_template_and_user({template_name =>
 				query => $input,
 				type => "intranet",
 				authnotrequired => 0,
-				flagsrequired => {borrowers => 1},
+                flagsrequired => {borrowers => 'edit_borrowers'},
 				debug => 1,
 				});
 
diff --git a/members/setstatus.pl b/members/setstatus.pl
index 16ce2676c8..c598433147 100755
--- a/members/setstatus.pl
+++ b/members/setstatus.pl
@@ -34,7 +34,7 @@ use Koha::Patrons;
 
 my $input = new CGI;
 
-checkauth($input, 0, { borrowers => 1 }, 'intranet');
+checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
 
 my $destination = $input->param("destination") || '';
 my $borrowernumber=$input->param('borrowernumber');
diff --git a/members/statistics.pl b/members/statistics.pl
index ffed67209e..bcefd9f659 100755
--- a/members/statistics.pl
+++ b/members/statistics.pl
@@ -40,7 +40,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/members/update-child.pl b/members/update-child.pl
index c7e87b1163..d879ac87b8 100755
--- a/members/update-child.pl
+++ b/members/update-child.pl
@@ -46,7 +46,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
diff --git a/opac/opac-overdrive-search.pl b/opac/opac-overdrive-search.pl
index 3c10fde4fa..38d30b9dca 100755
--- a/opac/opac-overdrive-search.pl
+++ b/opac/opac-overdrive-search.pl
@@ -33,7 +33,7 @@ my ($template, $loggedinuser, $cookie)
                                 query => $cgi,
                                 type => "opac",
                                 authnotrequired => 1,
-                                flagsrequired => {borrowers => 1},
+                                flagsrequired => {borrowers => 'edit_borrowers'},
                                 debug => 1,
                                 });
 
diff --git a/svc/checkouts b/svc/checkouts
index 2879356933..fefadeeeea 100755
--- a/svc/checkouts
+++ b/svc/checkouts
@@ -41,7 +41,7 @@ my $session   = get_session($sessionID);
 my $userid   = $session->param('id');
 
 unless (haspermission($userid, { circulate => 'circulate_remaining_permissions' })
-    || haspermission($userid, { borrowers => '*' })) {
+    || haspermission($userid, { borrowers => 'edit_borrowers' })) {
     exit 0;
 }
 
diff --git a/svc/members/search b/svc/members/search
index 3276cf8825..86c7473c52 100755
--- a/svc/members/search
+++ b/svc/members/search
@@ -36,7 +36,7 @@ my ($template, $user, $cookie) = get_template_and_user({
     query           => $input,
     type            => "intranet",
     authnotrequired => 0,
-    flagsrequired   => { borrowers => 1 }
+    flagsrequired   => { borrowers => 'edit_borrowers' }
 });
 
 my $searchmember = $input->param('searchmember');
-- 
2.39.5