From: Nahuel ANGELINETTI <nahuel.angelinetti@biblibre.com>
Date: Thu, 24 Dec 2009 14:20:47 +0000 (+0100)
Subject: (bug #4004) disallow access for non-logged in users in opac
X-Git-Tag: v3.00.06~118
X-Git-Url: http://git.rot13.org/?a=commitdiff_plain;h=3dd5fccccc4c50778cc80052d5f750cc6a423874;p=koha.git

(bug #4004) disallow access for non-logged in users in opac

This doesn't define borrowernumber = 0 if a borrower is NOT logged.
We know borrowernumber 0 is mysqluser... So in virtualshelves, a non logged user have all permissions.
---

diff --git a/C4/Auth.pm b/C4/Auth.pm
index a4924a0093..f810fd3381 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -155,7 +155,8 @@ sub get_template_and_user {
 			$template->param(	bartotal		=> $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar (@$barshelves));
 		}
 
-        $borrowernumber = getborrowernumber($user);
+        $borrowernumber = getborrowernumber($user) if defined($user);
+
         my ( $borr ) = GetMemberDetails( $borrowernumber );
         my @bordat;
         $bordat[0] = $borr;
diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm
index b8a5a834b6..1d0e4ab14c 100644
--- a/C4/VirtualShelves.pm
+++ b/C4/VirtualShelves.pm
@@ -473,6 +473,7 @@ sub ShelfPossibleAction {
     $sth->execute($shelfnumber);
     my ( $owner, $category ) = $sth->fetchrow;
 	my $borrower = GetMemberDetails($user);
+	return 0 if not defined($user);
 	return 1 if ( $category >= 3);							# open list
     return 1 if (($category >= 2) and
 				defined($action) and $action eq 'view');	# public list, anybody can view