(bug #4004) disallow access for non-logged in users in opac
[koha.git] / opac / sco / sco-main.pl
index 1fcd091..d212746 100755 (executable)
@@ -2,11 +2,12 @@
 # This code has been modified by Trendsetters (originally from opac-user.pl)
 # This code has been modified by rch
 # We're going to authenticate a self-check user.  we'll add a flag to borrowers 'selfcheck'
-# We're in a controlled environment; we trust the user. so the selfcheck station will accept a userid and 
+# We're in a controlled environment; we trust the user. so the selfcheck station will accept a patronid and
 # issue items to that borrower.
 #
 use strict;
-require Exporter;
+use warnings;
+
 use CGI;
 
 #use C4::Authsco;
@@ -17,7 +18,7 @@ use C4::Reserves;
 use C4::Search;
 use C4::Output;
 use C4::Members;
-use HTML::Template::Pro;
+#use HTML::Template::Pro;
 use C4::Dates;
 use C4::Biblio;
 use C4::Items;
@@ -28,25 +29,28 @@ my ($template, $loggedinuser, $cookie)
                              query => $query,
                              type => "opac",
                              authnotrequired => 0,
-                             flagsrequired => { managesco => 1},
-                             debug => 1,
+                             flagsrequired => { circulate => "circulate_remaining_permissions" },
+                             debug => 0,
                              });
 my $dbh = C4::Context->dbh;
 
 my $issuerid = $loggedinuser;
-my ($op, $userid, $barcode, $confirmed, $timedout )= ($query->param("op"), 
-                                        $query->param("userid"), 
-                                       $query->param("barcode"),
-                                       $query->param( "confirmed"),
-                                       $query->param( "timedout"), #not actually using this...
-                                        );
+my ($op, $patronid, $barcode, $confirmed, $timedout) = (
+    $query->param("op")         || '',
+    $query->param("patronid")   || '',
+    $query->param("barcode")    || '',
+    $query->param("confirmed")  || '',
+    $query->param("timedout")   || '', #not actually using this...
+);
+
 my %confirmation_strings = ( RENEW_ISSUE => "This item is already checked out to you.  Return it?", );
 my $issuenoconfirm = 1; #don't need to confirm on issue.
 my $cnt = 0;
 #warn "issuerid: " . $issuerid;
-my ($issuer, $flags) = GetMemberDetails($issuerid);
+my ($issuer) = GetMemberDetails($issuerid);
 my $item = GetItem(undef,$barcode);
-my ($borrower, $flags) = GetMemberDetails(undef,$userid);
+my $borrower;
+($borrower) = GetMemberDetails(undef,$patronid);
 
 my $branch = $issuer->{branchcode};
 my $confirm_required = 0;
@@ -54,75 +58,93 @@ my $return_only = 0;
 #warn "issuer cardnum: " . $issuer->{cardnumber};
 #warn "cardnumber= ".$borrower->{cardnumber};
 if ($op eq "logout") {
-        $query->param( userid => undef );
+        $query->param( patronid => undef );
+}
+
+
+if ( $op eq "returnbook" ) {
+    my ($doreturn) = AddReturn( $barcode, $branch );
+
+    #warn "returnbook: " . $doreturn;
+    ($borrower) = GetMemberDetails( undef, $patronid );
 }
-  if ($op eq "returnbook") {
-      my ($doreturn ) = AddReturn($barcode, $branch);
-     #warn "returnbook: " . $doreturn;
-    ($borrower, $flags) = GetMemberDetails(undef, $userid);
-  }
-  
-  if ($op eq "checkout" ) {
-       my $impossible = {};
-       my $needconfirm = {};
-      if ( !$confirmed ) {
-        ($impossible,$needconfirm) = CanBookBeIssued($borrower,$barcode);
-      }
-       $confirm_required = scalar(keys(%$needconfirm));
-       #warn "confirm_required: " . $confirm_required ;
-       if (scalar(keys(%$impossible))) {
-    #  warn "impossible: numkeys: " . scalar (keys(%$impossible));
-         my ($issue_error) = keys %$impossible ;
-         # FIXME  we assume only one error.
-        $template->param( impossible => $issue_error,
-                       title => $item->{title} ,
-                       hide_main => 1,
-                       );
-       #warn "issue_error: " . $issue_error ;
-       if ($issue_error eq "NO_MORE_RENEWALS") {
-               $return_only = 1;
-               $template->param ( returnitem => 1,
-                               barcode => $barcode ,
-                               );
-        }
-      } elsif ($needconfirm->{RENEW_ISSUE} ) {
-          if ( $confirmed ) {
-         #warn "renewing";
-            AddRenewal($borrower,$item->{itemnumber});
-          } else {
-         #warn "renew confirmation";
-           $template->param( renew => 1,
-                       barcode => $barcode,
-                       confirm => $confirmation_strings{RENEW_ISSUE},
-                       hide_main => 1,
-                       );
-          }
-      } elsif ( $confirm_required && !$confirmed ) {
-      #warn "failed confirmation";
-         my ($confirmation) = keys %$needconfirm ;
-         $template->param( impossible => $confirmation,
-                       hide_main => 1,
-                       );
-      } else {
-        if ( $confirmed || $issuenoconfirm ) {  # we'll want to call getpatroninfo again to get updated issues.
-           #warn "issuing book?";
-            AddIssue($borrower,$barcode);
-       #    ($borrower, $flags) = getpatroninformation(undef,undef, $userid);
-               
-       #    $template->param( userid => $userid,
-#                      validuser => 1,
-#                      );
-         } else {
-           $confirm_required = 1;
-          #warn "issue confirmation";
-           $template->param( confirm => "Issuing title: " . $item->{title} ,
-                       barcode => $barcode,
-                       hide_main => 1,
-                       inputfocus => 'confirm',
-                       );
-       }
-      }
-   } # op=checkout
+
+if ( $op eq "checkout" ) {
+    my $impossible  = {};
+    my $needconfirm = {};
+    if ( !$confirmed ) {
+        ( $impossible, $needconfirm ) = CanBookBeIssued( $borrower, $barcode );
+    }
+    $confirm_required = scalar( keys(%$needconfirm) );
+
+    #warn "confirm_required: " . $confirm_required ;
+    if ( scalar( keys(%$impossible) ) ) {
+
+        #  warn "impossible: numkeys: " . scalar (keys(%$impossible));
+        my ($issue_error) = keys %$impossible;
+
+        # FIXME  we assume only one error.
+        $template->param(
+            impossible => $issue_error,
+            title      => $item->{title},
+            hide_main  => 1,
+        );
+
+        #warn "issue_error: " . $issue_error ;
+        if ( $issue_error eq "NO_MORE_RENEWALS" ) {
+            $return_only = 1;
+            $template->param(
+                returnitem => 1,
+                barcode    => $barcode,
+            );
+        }
+    } elsif ( $needconfirm->{RENEW_ISSUE} ) {
+        if ($confirmed) {
+
+            #warn "renewing";
+            AddRenewal( $borrower, $item->{itemnumber} );
+        } else {
+
+            #warn "renew confirmation";
+            $template->param(
+                renew               => 1,
+                barcode             => $barcode,
+                confirm             => 1,
+                confirm_renew_issue => 1,
+                hide_main           => 1,
+            );
+        }
+    } elsif ( $confirm_required && !$confirmed ) {
+
+        #warn "failed confirmation";
+        my ($confirmation) = keys %$needconfirm;
+        $template->param(
+            impossible => $confirmation,
+            hide_main  => 1,
+        );
+    } else {
+        if ( $confirmed || $issuenoconfirm ) {    # we'll want to call getpatroninfo again to get updated issues.
+                                                  #warn "issuing book?";
+            AddIssue( $borrower, $barcode );
+
+            #    ($borrower, $flags) = getpatroninformation(undef,undef, $patronid);
+
+            #    $template->param( patronid => $patronid,
+            #                  validuser => 1,
+            #                  );
+        } else {
+            $confirm_required = 1;
+
+            #warn "issue confirmation";
+            $template->param(
+                confirm    => "Issuing title: " . $item->{title},
+                barcode    => $barcode,
+                hide_main  => 1,
+                inputfocus => 'confirm',
+            );
+        }
+    }
+}    # op=checkout
 
 if ($borrower->{cardnumber}) {
 
@@ -131,16 +153,22 @@ if ($borrower->{cardnumber}) {
        my $bornum = $borrower->{borrowernumber};
        my $borrowername = $borrower->{firstname} . " " . $borrower->{surname};
        my @issues;
-       my ($countissues,$issueslist) = GetPendingIssues($borrower->{'borrowernumber'});
-       foreach my $it ( @$issueslist ) {
-               push @issues, $it;
-               $cnt++;
-       }
-   $template->param(  validuser => 1,  
+
+    my ($issueslist) = GetPendingIssues( $borrower->{'borrowernumber'} );
+    foreach my $it (@$issueslist) {
+
+        my ( $renewokay, $renewerror ) =
+                CanBookBeIssued( $borrower, $it->{'barcode'}, '', '' );
+        $it->{'norenew'} = 1 if $renewokay->{'NO_MORE_RENEWALS'} == 1;
+        push @issues, $it;
+        $cnt++;
+    }
+
+   $template->param(  validuser => 1,
                        borrowername => $borrowername,
-                       issues_count => $cnt, 
+                       issues_count => $cnt,
                        ISSUES => \@issues,,
-                       userid => $userid ,
+                       patronid => $patronid ,
                        noitemlinks => 1 ,
                );
    $cnt = 0;
@@ -151,7 +179,7 @@ if ($borrower->{cardnumber}) {
       $inputfocus = 'confirm' ;
    } else {
       $inputfocus = 'barcode' ;
-    }
+   }
 
 $template->param( inputfocus => $inputfocus,
                nofines => 1,
@@ -159,8 +187,8 @@ $template->param( inputfocus => $inputfocus,
 
 } else {
 
- $template->param( userid => $userid,  nouser => $userid,
-                       inputfocus => 'userid', );
+ $template->param( patronid => $patronid,  nouser => $patronid,
+                       inputfocus => 'patronid', );
 }
 
 output_html_with_http_headers $query, $cookie, $template->output;