Fix for Bug 3140 - It is possible to email someone else's private list

[srvgit] / opac / opac-sendshelf.pl

diff --git a/opac/opac-sendshelf.pl b/opac/opac-sendshelf.pl
index 86b494b..e3798f8 100755 (executable)
--- a/opac/opac-sendshelf.pl
+++ b/opac/opac-sendshelf.pl
@@ -13,15 +13,16 @@
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 use strict;
 use warnings;
 
 use CGI;
 use Encode qw(encode);
+use Carp;
 
 use Mail::Sendmail;
 use MIME::QuotedPrint;
@@ -50,6 +51,8 @@ my $email   = $query->param('email');
 
 my $dbh          = C4::Context->dbh;
 
+if ( ShelfPossibleAction( (defined($borrowernumber) ? $borrowernumber : -1), $shelfid, 'view' ) ) {
+
 if ( $email ) {
     my $email_from = C4::Context->preference('KohaAdminEmailAddress');
     my $comment    = $query->param('comment');
@@ -98,7 +101,7 @@ if ( $email ) {
         push( @results, $dat );
     }
 
-    my $user = GetMember($borrowernumber); 
+    my $user = GetMember(borrowernumber => $borrowernumber); 
 
     $template2->param(
         BIBLIO_RESULTS => \@results,
@@ -162,7 +165,7 @@ END_OF_BODY
     }
     else {
         # do something if it doesnt work....
-        warn "Error sending mail: $Mail::Sendmail::error \n";
+        carp "Error sending mail: $Mail::Sendmail::error \n";
         $template->param( error => 1 );
     }
 
@@ -176,3 +179,10 @@ END_OF_BODY
                     );
     output_html_with_http_headers $query, $cookie, $template->output;
 }
+
+} else {
+    $template->param( invalidlist => 1,
+                      url     => "/cgi-bin/koha/opac-sendshelf.pl",
+    );
+    output_html_with_http_headers $query, $cookie, $template->output;
+}
\ No newline at end of file