MT2582: Fix user deletion without permission
[koha.git] / members / deletemem.pl
1 #!/usr/bin/perl
2
3 #script to delete items
4 #written 2/5/00
5 #by chris@katipo.co.nz
6
7 # Copyright 2000-2002 Katipo Communications
8 #
9 # This file is part of Koha.
10 #
11 # Koha is free software; you can redistribute it and/or modify it under the
12 # terms of the GNU General Public License as published by the Free Software
13 # Foundation; either version 2 of the License, or (at your option) any later
14 # version.
15 #
16 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
17 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
18 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
19 #
20 # You should have received a copy of the GNU General Public License along
21 # with Koha; if not, write to the Free Software Foundation, Inc.,
22 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23
24 use strict;
25 #use warnings; FIXME - Bug 2505
26
27 use CGI;
28 use C4::Context;
29 use C4::Output;
30 use C4::Auth;
31 use C4::Members;
32
33 my $input = new CGI;
34
35 my ($template, $borrowernumber, $cookie)
36                 = get_template_and_user({template_name => "members/deletemem.tmpl",
37                                         query => $input,
38                                         type => "intranet",
39                                         authnotrequired => 0,
40                                         flagsrequired => {borrowers => 1},
41                                         debug => 1,
42                                         });
43
44 #print $input->header;
45 my $member=$input->param('member');
46 my $issues = GetPendingIssues($member);     # FIXME: wasteful call when really, we only want the count
47 my $countissues = scalar(@$issues);
48
49 my ($bor)=GetMemberDetails($member,'');
50 my $flags=$bor->{flags};
51 my $userenv = C4::Context->userenv;
52
53  
54
55 if ($bor->{category_type} eq "S") {
56     unless(C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) {
57         print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_STAFF");
58         exit 1;
59     }
60 } else {
61     unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>1})) {
62         print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE");
63         exit 1;
64     }
65 }
66
67 if (C4::Context->preference("IndependantBranches")) {
68     my $userenv = C4::Context->userenv;
69     if (($userenv->{flags} % 2 != 1) && $bor->{'branchcode'}){
70         unless ($userenv->{branch} eq $bor->{'branchcode'}){
71             print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_OTHERLIBRARY");
72             exit;
73         }
74     }
75 }
76
77 my $dbh = C4::Context->dbh;
78 my $sth=$dbh->prepare("Select * from borrowers where guarantorid=?");
79 $sth->execute($member);
80 my $data=$sth->fetchrow_hashref;
81 if ($countissues > 0 or $flags->{'CHARGES'}  or $data->{'borrowernumber'}){
82     #   print $input->header;
83     $template->param(borrowernumber => $member);
84     if ($countissues >0) {
85         $template->param(ItemsOnIssues => $countissues);
86     }
87     if ($flags->{'CHARGES'} ne '') {
88         $template->param(charges => $flags->{'CHARGES'}->{'amount'});
89     }
90     if ($data) {
91         $template->param(guarantees => 1);
92     }
93 output_html_with_http_headers $input, $cookie, $template->output;
94
95 } else {
96     MoveMemberToDeleted($member);
97     DelMember($member);
98     print $input->redirect("/cgi-bin/koha/members/members-home.pl");
99 }
100
101