Bug 29543: Prevent user to checkin or renew items they don't own
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 5 Jan 2022 14:25:48 +0000 (15:25 +0100)
committerKyle M Hall <kyle@bywatersolutions.com>
Fri, 14 Jan 2022 19:27:55 +0000 (14:27 -0500)
commit839b7c4a5c8bdba62776fdb74c5f2125622a9ff0
treea049a0842c906181f4be503d27b5d915d1531757
parent77e21f30062dc23edb2c79f609d854d553e67f7c
Bug 29543: Prevent user to checkin or renew items they don't own

Checkin or renew must be restricted to the items they own.

Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1

You should see an error message

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
opac/sco/sco-main.pl