From 29aa287c58df805e8608788e37d88f1b445a9f83 Mon Sep 17 00:00:00 2001
From: Matthias Meusburger <matthias.meusburger@biblibre.com>
Date: Tue, 9 Feb 2010 09:40:49 +0100
Subject: [PATCH] MT2582: Fix user deletion without permission

---
 koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc | 2 +-
 members/deletemem.pl                                      | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc
index 359e6978ad..71c77a3470 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc
@@ -63,7 +63,7 @@ function update_child() {
                     <!-- TMPL_UNLESS NAME="CAN_user_staffaccess" -->, disabled: true<!-- /TMPL_UNLESS-->
                     <!-- TMPL_ELSE --><!-- /TMPL_IF -->
                 <!-- TMPL_ELSE -->, disabled: true<!-- /TMPL_IF-->},
-            { text: _("Delete"), <!-- TMPL_IF NAME="StaffMember" --><!-- TMPL_UNLESS NAME="CAN_user_staffaccess" -->disabled: true, <!-- /TMPL_UNLESS --><!-- /TMPL_IF --> onclick: { fn: confirm_deletion } },
+            { text: _("Delete"), <!-- TMPL_IF NAME="StaffMember" --><!-- TMPL_UNLESS NAME="CAN_user_staffaccess" -->disabled: true, <!-- /TMPL_UNLESS --><!-- TMPL_ELSE --><!-- TMPL_UNLESS NAME="CAN_user_borrowers" -->disabled: true, <!-- /TMPL_UNLESS --><!-- /TMPL_IF --> onclick: { fn: confirm_deletion } },
 			{ text: _("Update Child to Adult Patron") , onclick: { fn: update_child }<!-- TMPL_UNLESS NAME="is_child" -->, disabled: true<!-- /TMPL_UNLESS -->}
 		];
 
diff --git a/members/deletemem.pl b/members/deletemem.pl
index eea47b0500..fa3cad3cb4 100755
--- a/members/deletemem.pl
+++ b/members/deletemem.pl
@@ -49,11 +49,19 @@ my $countissues = scalar(@$issues);
 my ($bor)=GetMemberDetails($member,'');
 my $flags=$bor->{flags};
 my $userenv = C4::Context->userenv;
+
+ 
+
 if ($bor->{category_type} eq "S") {
     unless(C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) {
         print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_STAFF");
         exit 1;
     }
+} else {
+    unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>1})) {
+	print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE");
+	exit 1;
+    }
 }
 
 if (C4::Context->preference("IndependantBranches")) {