(bug #4004) disallow access for non-logged in users in opac

This doesn't define borrowernumber = 0 if a borrower is NOT logged.
We know borrowernumber 0 is mysqluser... So in virtualshelves, a non logged user have all permissions.

diff --git a/C4/Auth.pm b/C4/Auth.pm
index a4924a0..f810fd3 100644 (file)
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -155,7 +155,8 @@ sub get_template_and_user {
                        $template->param(       bartotal                => $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar (@$barshelves));
                }
 
-        $borrowernumber = getborrowernumber($user);
+        $borrowernumber = getborrowernumber($user) if defined($user);
+
         my ( $borr ) = GetMemberDetails( $borrowernumber );
         my @bordat;
         $bordat[0] = $borr;

diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm
index b8a5a83..1d0e4ab 100644 (file)
--- a/C4/VirtualShelves.pm
+++ b/C4/VirtualShelves.pm
@@ -473,6 +473,7 @@ sub ShelfPossibleAction {
     $sth->execute($shelfnumber);
     my ( $owner, $category ) = $sth->fetchrow;
        my $borrower = GetMemberDetails($user);
+       return 0 if not defined($user);
        return 1 if ( $category >= 3);                                                  # open list
     return 1 if (($category >= 2) and
                                defined($action) and $action eq 'view');        # public list, anybody can view