gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29544: Fix opac-issue-note.pl 

We must check if logged in user is trying to modify one of their
checkouts

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2021-12-02 09:04:14 +01:00 committed by Kyle Hall
parent 7f2cef2337
commit 2aafed7176
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
opac/opac-issue-note.pl
View File

@ -49,6 +49,14 @@ $template->param(
my $issue_id = $query->param('issue_id');
my $issue = Koha::Checkouts->find( $issue_id );
if ( !$issue || $issue->borrowernumber != $borrowernumber ) {
# exit early
print $query->redirect("/cgi-bin/koha/opac-user.pl");
exit;
}
my $itemnumber = $issue->itemnumber;
my $biblio = $issue->item->biblio;
$template->param(
@ -60,10 +68,11 @@ $template->param(
);
my $action = $query->param('action') || "";
if ( $action eq 'issuenote' && C4::Context->preference('AllowCheckoutNotes') ) {
if ( $action eq 'issuenote' && C4::Context->preference('AllowCheckoutNotes') && $issue ) {
my $note = $query->param('note');
my $scrubber = C4::Scrubber->new();
my $clean_note = $scrubber->scrub($note);
if ( $issue->set({ notedate => dt_from_string(), note => $clean_note, noteseen => 0 })->store ) {
if ($clean_note) { # only send email if note not empty
my $branch = Koha::Libraries->find( $issue->branchcode );