Bug 20701: Add csrf protection to mancredit.pl

[koha.git] / members / members-update-do.pl

diff --git a/members/members-update-do.pl b/members/members-update-do.pl
index 6a6e826..2f64096 100755 (executable)
--- a/members/members-update-do.pl
+++ b/members/members-update-do.pl
@@ -16,8 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
-use strict;
-use warnings;
+use Modern::Perl;
 
 use CGI qw ( -utf8 );
 use C4::Auth;
@@ -28,27 +27,42 @@ use Koha::Patron::Modifications;
 
 my $query = new CGI;
 
+# FIXME Should be a checkauth call
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
         template_name   => "about.tt",
         query           => $query,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { borrowers => 1 },
+        flagsrequired   => { borrowers => 'edit_borrowers' },
         debug           => 1,
     }
 );
 
+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in";
+
 my @params = $query->param;
 
 foreach my $param (@params) {
     if ( $param =~ "^modify_" ) {
         my (undef, $borrowernumber) = split( /_/, $param );
 
+        my $patron = Koha::Patrons->find($borrowernumber);
+        next unless $logged_in_user->can_see_patron_infos( $patron );
+
         my $action = $query->param($param);
 
         if ( $action eq 'approve' ) {
             my $m = Koha::Patron::Modifications->find( { borrowernumber => $borrowernumber } );
+
+            if ($query->param("unset_gna_$borrowernumber")) {
+                # Unset gone no address
+                ModMember(
+                    borrowernumber => $borrowernumber,
+                    gonenoaddress  => undef
+                );
+            }
+
             $m->approve() if $m;
         }
         elsif ( $action eq 'deny' ) {