X-Git-Url: http://git.rot13.org/?a=blobdiff_plain;f=C4%2FAuth.pm;h=996117bfc2df9b72e563396425b5acbbdf507d3d;hb=db91682c80eb71b6165f6bbfb13879a339d37d48;hp=f823824f1c0fe211e024cb7dbd9260d9d8440cc1;hpb=96fcc7137c1c309a6ba32fbe91a0839353ae2798;p=koha.git diff --git a/C4/Auth.pm b/C4/Auth.pm index f823824f1c..996117bfc2 100755 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -33,13 +33,20 @@ use C4::Koha; use C4::Branch; # GetBranches # use utf8; -# use Net::LDAP; -# use Net::LDAP qw(:all); - -use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); - -# set the version for version checking -$VERSION = 3.00; +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap); + +BEGIN { + $VERSION = 3.01; # set version for version checking + $debug = $ENV{DEBUG} || 0 ; + @ISA = qw(Exporter); + @EXPORT = qw(&checkauth &get_template_and_user); + @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw); + $ldap = C4::Context->config('useldapserver') || 0; + if ($ldap) { + require C4::Auth_with_ldap; # no import + import C4::Auth_with_ldap qw(checkpw_ldap); + } +} =head1 NAME @@ -80,31 +87,18 @@ C4::Auth - Authenticates Koha users =over 2 -=cut - -@ISA = qw(Exporter); -@EXPORT = qw( - &checkauth - &get_template_and_user -); -@EXPORT_OK = qw( - &check_api_auth - &get_session - &check_cookie_auth -); - =item get_template_and_user - my ($template, $borrowernumber, $cookie) - = get_template_and_user( - { - template_name => "opac-main.tmpl", - query => $query, - type => "opac", - authnotrequired => 1, - flagsrequired => {borrow => 1}, - } - ); + my ($template, $borrowernumber, $cookie) + = get_template_and_user( + { + template_name => "opac-main.tmpl", + query => $query, + type => "opac", + authnotrequired => 1, + flagsrequired => {borrow => 1}, + } + ); This call passes the C, C and C to C<&checkauth> (in this module) to perform authentification. @@ -137,18 +131,18 @@ sub get_template_and_user { my $insecure = C4::Context->preference('insecure'); if ($user or $insecure) { - # load the template variables for stylesheets and JavaScript - $template->param( css_libs => $in->{'css_libs'} ); - $template->param( css_module => $in->{'css_module'} ); - $template->param( css_page => $in->{'css_page'} ); - $template->param( css_widgets => $in->{'css_widgets'} ); + # load the template variables for stylesheets and JavaScript + $template->param( css_libs => $in->{'css_libs'} ); + $template->param( css_module => $in->{'css_module'} ); + $template->param( css_page => $in->{'css_page'} ); + $template->param( css_widgets => $in->{'css_widgets'} ); $template->param( js_libs => $in->{'js_libs'} ); $template->param( js_module => $in->{'js_module'} ); $template->param( js_page => $in->{'js_page'} ); $template->param( js_widgets => $in->{'js_widgets'} ); - # user info + # user info $template->param( loggedinusername => $user ); $template->param( sessionID => $sessionID ); @@ -159,6 +153,8 @@ sub get_template_and_user { $bordat[0] = $borr; $template->param( "USER_INFO" => \@bordat ); + my @flagroots = qw(circulate catalogue parameters borrowers permissions reserveforothers borrow + editcatalogue updatecharges management tools editauthorities serials reports); # We are going to use the $flags returned by checkauth # to create the template's parameters that will indicate # which menus the user can access. @@ -171,13 +167,14 @@ sub get_template_and_user { $template->param( CAN_user_reserveforothers => 1 ); $template->param( CAN_user_borrow => 1 ); $template->param( CAN_user_editcatalogue => 1 ); - $template->param( CAN_user_updatecharge => 1 ); + $template->param( CAN_user_updatecharges => 1 ); $template->param( CAN_user_acquisition => 1 ); $template->param( CAN_user_management => 1 ); $template->param( CAN_user_tools => 1 ); $template->param( CAN_user_editauthorities => 1 ); $template->param( CAN_user_serials => 1 ); $template->param( CAN_user_reports => 1 ); + $template->param( CAN_user_staffaccess => 1 ); } if ( $flags && $flags->{circulate} == 1 ) { @@ -214,7 +211,7 @@ sub get_template_and_user { } if ( $flags && $flags->{updatecharges} == 1 ) { - $template->param( CAN_user_updatecharge => 1 ); + $template->param( CAN_user_updatecharges => 1 ); } if ( $flags && $flags->{acquisition} == 1 ) { @@ -236,6 +233,9 @@ sub get_template_and_user { if ( $flags && $flags->{reports} == 1 ) { $template->param( CAN_user_reports => 1 ); } + if ( $flags && $flags->{staffaccess} == 1 ) { + $template->param( CAN_user_staffaccess => 1 ); + } } if ( $in->{'type'} eq "intranet" ) { $template->param( @@ -259,10 +259,16 @@ sub get_template_and_user { virtualshelves => C4::Context->preference("virtualshelves"), LibraryName => C4::Context->preference("LibraryName"), KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), - IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"), + IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"), IndependantBranches => C4::Context->preference("IndependantBranches"), CircAutocompl => C4::Context->preference("CircAutocompl"), yuipath => C4::Context->preference("yuipath"), + FRBRizeEditions => C4::Context->preference("FRBRizeEditions"), + AmazonSimilarItems => C4::Context->preference("AmazonSimilarItems"), + 'item-level_itypes' => C4::Context->preference('item-level_itypes'), + canreservefromotherbranches => C4::Context->preference('canreservefromotherbranches'), + intranetreadinghistory => C4::Context->preference("intranetreadinghistory"), + noItemTypeImages => C4::Context->preference("noItemTypeImages"), ); } else { @@ -272,7 +278,7 @@ sub get_template_and_user { $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; $template->param( KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), - AnonSuggestions => "" . C4::Context->preference("AnonSuggestions"), + AnonSuggestions => "" . C4::Context->preference("AnonSuggestions"), suggestion => "" . C4::Context->preference("suggestion"), virtualshelves => "" . C4::Context->preference("virtualshelves"), OpacNav => "" . C4::Context->preference("OpacNav"), @@ -306,10 +312,11 @@ sub get_template_and_user { patronimages => C4::Context->preference("patronimages"), mylibraryfirst => C4::Context->preference("SearchMyLibraryFirst"), "BiblioDefaultView".C4::Context->preference("BiblioDefaultView") => 1, - FRBRizeEditions => C4::Context->preference("FRBRizeEditions"), + OPACFRBRizeEditions => C4::Context->preference("OPACFRBRizeEditions"), + 'item-level_itypes' => C4::Context->preference('item-level_itypes'), ); } - return ( $template, $borrowernumber, $cookie ); + return ( $template, $borrowernumber, $cookie, $flags); } =item checkauth @@ -370,27 +377,14 @@ has authenticated. =cut -sub checkauth { +sub _version_check ($$) { + my $type = shift; my $query = shift; - # warn "Checking Auth"; - # $authnotrequired will be set for scripts which will run without authentication - my $authnotrequired = shift; - my $flagsrequired = shift; - my $type = shift; - $type = 'opac' unless $type; - - my $dbh = C4::Context->dbh; - my $timeout = C4::Context->preference('timeout'); - # days - if ($timeout =~ /(\d*)[dD]/) { - $timeout = $1 * 86400; - }; - $timeout = 600 unless $timeout; - + my $version; # If Version syspref is unavailable, it means Koha is beeing installed, # and so we must redirect to OPAC maintenance page or to the WebInstaller #warn "about to check version"; - unless (C4::Context->preference('Version')) { + unless ($version = C4::Context->preference('Version')) { # assignment, not comparison if ($type ne 'opac') { warn "Install required, redirecting to Installer"; print $query->redirect("/cgi-bin/koha/installer/install.pl"); @@ -402,7 +396,53 @@ sub checkauth { exit; } + # check that database and koha version are the same + # there is no DB version, it's a fresh install, + # go to web installer + # there is a DB version, compare it to the code version + my $kohaversion=C4::Context::KOHAVERSION; + # remove the 3 last . to have a Perl number + $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; + $debug and print STDERR "kohaversion : $kohaversion\n"; + if ($version < $kohaversion){ + my $warning = "Database update needed, redirecting to %s. Database is $version and Koha is " + . C4::Context->config("kohaversion"); + if ($type ne 'opac'){ + warn sprintf($warning, 'Installer'); + print $query->redirect("/cgi-bin/koha/installer/install.pl?step=3"); + } else { + warn sprintf("OPAC: " . $warning, 'maintenance'); + print $query->redirect("/cgi-bin/koha/maintenance.pl"); + } + exit; + } +} + +sub _session_log { + (@_) or return 0; + open L, ">>/tmp/sessionlog"; + printf L join("\n",@_); + close L; +} + +sub checkauth { + my $query = shift; + # warn "Checking Auth"; + # $authnotrequired will be set for scripts which will run without authentication + my $authnotrequired = shift; + my $flagsrequired = shift; + my $type = shift; + $type = 'opac' unless $type; + my $dbh = C4::Context->dbh; + my $timeout = C4::Context->preference('timeout'); + # days + if ($timeout =~ /(\d+)[dD]/) { + $timeout = $1 * 86400; + }; + $timeout = 600 unless $timeout; + + _version_check($type,$query); # state variables my $loggedin = 0; my %info; @@ -417,7 +457,7 @@ sub checkauth { ); $loggedin = 1; } - elsif ( $sessionID = $query->cookie("CGISESSID")) { + elsif ( $sessionID = $query->cookie("CGISESSID")) { # assignment, not comparison my $session = get_session($sessionID); C4::Context->_new_userenv($sessionID); if ($session){ @@ -428,32 +468,24 @@ sub checkauth { $session->param('branchname'), $session->param('flags'), $session->param('emailaddress'), $session->param('branchprinter') ); -# warn "".$session->param('cardnumber').", ".$session->param('firstname').", -# ".$session->param('surname').", ".$session->param('branch'); + $debug and printf STDERR "AUTH_SESSION: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; } my $ip; my $lasttime; if ($session) { - $ip = $session->param('ip'); - $lasttime = $session->param('lasttime'); - $userid = $session->param('id'); + $ip = $session->param('ip'); + $lasttime = $session->param('lasttime'); + $userid = $session->param('id'); } - if ($logout) { - # voluntary logout the user - $session->flush; - $session->delete(); + $session->delete(); C4::Context->_unset_userenv($sessionID); $sessionID = undef; $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L "%20s from %16s logged out at %30s (manually).\n", $userid, - $ip, $time; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,localtime); } if ($userid) { if ( $lasttime < time() - $timeout ) { @@ -463,27 +495,18 @@ sub checkauth { C4::Context->_unset_userenv($sessionID); $userid = undef; $sessionID = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L "%20s from %16s logged out at %30s (inactivity).\n", - $userid, $ip, $time; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,localtime); } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { # Different ip than originally logged in from $info{'oldip'} = $ip; $info{'newip'} = $ENV{'REMOTE_ADDR'}; $info{'different_ip'} = 1; - $session->delete(); + $session->delete(); C4::Context->_unset_userenv($sessionID); $sessionID = undef; $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L -"%20s from logged out at %30s (ip changed from %16s to %16s).\n", - $userid, $time, $ip, $info{'newip'}; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,localtime, $info{'newip'}); } else { $cookie = $query->cookie( CGISESSID => $session->id ); @@ -499,26 +522,21 @@ sub checkauth { } } unless ($userid) { - my $session = get_session(""); - + my $session = get_session(""); my $sessionID; - if ($session) { - $sessionID = $session->id; - } + if ($session) { + $sessionID = $session->id; + } $userid = $query->param('userid'); C4::Context->_new_userenv($sessionID); my $password = $query->param('password'); C4::Context->_new_userenv($sessionID); my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password ); if ($return) { - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L "%20s from %16s logged in at %30s.\n", $userid, - $ENV{'REMOTE_ADDR'}, $time; - close L; + _session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},localtime); $cookie = $query->cookie(CGISESSID => $sessionID); if ( $flags = haspermission( $dbh, $userid, $flagsrequired ) ) { - $loggedin = 1; + $loggedin = 1; } else { $info{'nopermission'} = 1; @@ -526,51 +544,46 @@ sub checkauth { } if ( $return == 1 ) { my ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress ); - my $sth = - $dbh->prepare( -"select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname,branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?" - ); + my $select = " + SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, + branches.branchname as branchname, + branches.branchprinter as branchprinter, + email + FROM borrowers + LEFT JOIN branches on borrowers.branchcode=branches.branchcode + "; + my $sth = $dbh->prepare("$select where userid=?"); $sth->execute($userid); - ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ($sth->rows) and ( + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress + ) = $sth->fetchrow; -# warn "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress"; + $debug and print STDERR "AUTH_1: $cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; unless ( $sth->rows ) { - my $sth = - $dbh->prepare( -"select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where cardnumber=?" - ); + my $sth = $dbh->prepare("$select where cardnumber=?"); $sth->execute($cardnumber); - ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ($sth->rows) and ( + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress + ) = $sth->fetchrow; -# warn "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress"; + $debug and print STDERR "AUTH_2: $cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; unless ( $sth->rows ) { $sth->execute($userid); - ( + ($sth->rows) and ( $borrowernumber, $firstname, $surname, $userflags, $branchcode, $branchname, $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ) = $sth->fetchrow; } } -# launch a sequence to check if we have a ip for the branch, if we have one we replace the branchcode of the userenv by the branch bound in the ip. +# launch a sequence to check if we have a ip for the branch, i +# if we have one we replace the branchcode of the userenv by the branch bound in the ip. + my $ip = $ENV{'REMOTE_ADDR'}; # if they specify at login, use that if ($query->param('branch')) { @@ -578,6 +591,15 @@ sub checkauth { $branchname = GetBranchName($branchcode); } my $branches = GetBranches(); + if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ + # we have to check they are coming from the right ip range + my $domain = $branches->{$branchcode}->{'branchip'}; + if ($ip !~ /^$domain/){ + $loggedin=0; + $info{'wrongip'} = 1; + } + } + my @branchesloop; foreach my $br ( keys %$branches ) { # now we work with the treatment of ip @@ -601,39 +623,38 @@ sub checkauth { $session->param('emailaddress',$emailaddress); $session->param('ip',$session->remote_addr()); $session->param('lasttime',time()); -# warn "".$session->param('cardnumber').", ".$session->param('firstname').", -# ".$session->param('surname').", ".$session->param('branch'); + $debug and printf STDERR "AUTH_3: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; } elsif ( $return == 2 ) { #We suppose the user is the superlibrarian - $session->param('number',0); - $session->param('id',C4::Context->config('user')); - $session->param('cardnumber',C4::Context->config('user')); - $session->param('firstname',C4::Context->config('user')); - $session->param('surname',C4::Context->config('user')); - $session->param('branch','NO_LIBRARY_SET'); - $session->param('branchname','NO_LIBRARY_SET'); - $session->param('flags',1); - $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); - $session->param('ip',$session->remote_addr()); - $session->param('lasttime',time()); - } - if ($session){ - C4::Context::set_userenv( - $session->param('number'), $session->param('id'), - $session->param('cardnumber'), $session->param('firstname'), - $session->param('surname'), $session->param('branch'), - $session->param('branchname'), $session->param('flags'), - $session->param('emailaddress'), $session->param('branchprinter') - ); - } + $session->param('number',0); + $session->param('id',C4::Context->config('user')); + $session->param('cardnumber',C4::Context->config('user')); + $session->param('firstname',C4::Context->config('user')); + $session->param('surname',C4::Context->config('user')); + $session->param('branch','NO_LIBRARY_SET'); + $session->param('branchname','NO_LIBRARY_SET'); + $session->param('flags',1); + $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); + $session->param('ip',$session->remote_addr()); + $session->param('lasttime',time()); + } + if ($session) { + C4::Context::set_userenv( + $session->param('number'), $session->param('id'), + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('branchprinter') + ); + } } - else { if ($userid) { $info{'invalid_username_or_password'} = 1; C4::Context->_unset_userenv($sessionID); } + } } my $insecure = C4::Context->boolean_preference('insecure'); @@ -643,11 +664,9 @@ sub checkauth { { # successful login unless ($cookie) { - $cookie = $query->cookie( CGISESSID => '' - ); + $cookie = $query->cookie( CGISESSID => '' ); } - return ( $userid, $cookie, $sessionID, $flags ); - + return ( $userid, $cookie, $sessionID, $flags ); } # @@ -670,31 +689,7 @@ sub checkauth { push @branch_loop, {branchcode => "$branch_hash", branchname => $branches->{$branch_hash}->{'branchname'}, }; } - # check that database and koha version are the same - # there is no DB version, it's a fresh install, - # go to web installer - # there is a DB version, compare it to the code version - my $kohaversion=C4::Context::KOHAVERSION; - # remove the 3 last . to have a Perl number - $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; -# warn "kohaversion : $kohaversion"; - if (C4::Context->preference('Version') < $kohaversion){ - if ($type ne 'opac'){ - warn "Database update needed, redirecting to Installer. Database is ".C4::Context->preference('Version')." and Koha is : ".C4::Context->config("kohaversion"); - print $query->redirect("/cgi-bin/koha/installer/install.pl?step=3"); - } else { - warn "OPAC :Database update needed, redirecting to maintenance. Database is ".C4::Context->preference('Version')." and Koha is : ".C4::Context->config("kohaversion"); - print $query->redirect("/cgi-bin/koha/maintenance.pl"); - } - exit; - } - my $template_name; - if ( $type eq 'opac' ) { - $template_name = "opac-auth.tmpl"; - } - else { - $template_name = "auth.tmpl"; - } + my $template_name = ( $type eq 'opac' ) ? 'opac-auth.tmpl' : 'auth.tmpl'; my $template = gettemplate( $template_name, $type, $query ); $template->param(branchloop => \@branch_loop,); $template->param( @@ -720,8 +715,11 @@ sub checkauth { intranetuserjs => C4::Context->preference("intranetuserjs"), TemplateEncoding => C4::Context->preference("TemplateEncoding"), IndependantBranches => C4::Context->preference("IndependantBranches"), - AutoLocation => C4::Context->preference("AutoLocation"), + AutoLocation => C4::Context->preference("AutoLocation"), + yuipath => C4::Context->preference("yuipath"), + wrongip => $info{'wrongip'} ); + $template->param( loginprompt => 1 ) unless $info{'nopermission'}; my $self_url = $query->url( -absolute => 1 ); @@ -733,7 +731,7 @@ sub checkauth { # $cookie = $query->cookie(CGISESSID => $session->id # ); print $query->header( - -type => 'text/html', + -type => 'text/html', -charset => 'utf-8', -cookie => $cookie ), @@ -1098,14 +1096,14 @@ sub get_session { my $dbh = C4::Context->dbh; my $session; if ($storage_method eq 'mysql'){ - $session = new CGI::Session("driver:MySQL", $sessionID, {Handle=>$dbh}); + $session = new CGI::Session("driver:MySQL;serializer:yaml", $sessionID, {Handle=>$dbh}); } elsif ($storage_method eq 'Pg') { - $session = new CGI::Session("driver:PostgreSQL", $sessionID, {Handle=>$dbh}); + $session = new CGI::Session("driver:PostgreSQL;serializer:yaml", $sessionID, {Handle=>$dbh}); } else { # catch all defaults to tmp should work on all systems - $session = new CGI::Session("driver:File", $sessionID, {Directory=>'/tmp'}); + $session = new CGI::Session("driver:File;serializer:yaml", $sessionID, {Directory=>'/tmp'}); } return $session; } @@ -1113,6 +1111,11 @@ sub get_session { sub checkpw { my ( $dbh, $userid, $password ) = @_; + if ($ldap) { + $debug and print "## checkpw - checking LDAP\n"; + my ($retval,$retcard) = checkpw_ldap(@_); # EXTERNAL AUTH + ($retval) and return ($retval,$retcard); + } # INTERNAL AUTH my $sth = @@ -1167,15 +1170,22 @@ sub checkpw { return 0; } +=item getuserflags + + $authflags = getuserflags($flags,$dbh); +Translates integer flags into permissions strings hash. + +C<$flags> is the integer userflags value ( borrowers.userflags ) +C<$authflags> is a hashref of permissions + +=cut + sub getuserflags { - my $cardnumber = shift; - my $dbh = shift; + my $flags = shift; + my $dbh = shift; my $userflags; - my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE cardnumber=?"); - $sth->execute($cardnumber); - my ($flags) = $sth->fetchrow; $flags = 0 unless $flags; - $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); + my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); $sth->execute; while ( my ( $bit, $flag, $defaulton ) = $sth->fetchrow ) { @@ -1189,31 +1199,46 @@ sub getuserflags { return $userflags; } +=item haspermission + + $flags = ($dbh,$member,$flagsrequired); + +C<$member> may be either userid or overloaded with $borrower hashref from GetMemberDetails. +C<$flags> is a hashref of required flags lik C<$borrower-<{authflags}> + +Returns member's flags or 0 if a permission is not met. + +=cut + sub haspermission { my ( $dbh, $userid, $flagsrequired ) = @_; - my $sth = $dbh->prepare("SELECT cardnumber FROM borrowers WHERE userid=?"); - $sth->execute($userid); - my ($cardnumber) = $sth->fetchrow; - ($cardnumber) || ( $cardnumber = $userid ); - my $flags = getuserflags( $cardnumber, $dbh ); - my $configfile; + my ($flags,$intflags); + $dbh=C4::Context->dbh unless($dbh); + if(ref($userid)) { + $intflags = $userid->{'flags'}; + } else { + my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); + $sth->execute($userid); + my ($intflags) = $sth->fetchrow; + $flags = getuserflags( $intflags, $dbh ); + } if ( $userid eq C4::Context->config('user') ) { - # Super User Account from /etc/koha.conf $flags->{'superlibrarian'} = 1; } if ( $userid eq 'demo' && C4::Context->config('demo') ) { - # Demo user that can do "anything" (demo=1 in /etc/koha.conf) $flags->{'superlibrarian'} = 1; } return $flags if $flags->{superlibrarian}; foreach ( keys %$flagsrequired ) { - return $flags if $flags->{$_}; + return 0 unless( $flags->{$_} ); } - return 0; + return $flags; + #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered. } + sub getborrowernumber { my ($userid) = @_; my $dbh = C4::Context->dbh;