I'm confused about the usage of haspermission(). According to the documentation, the first parameter is the userid (named userid) and the second a hash reference of permission to check (named flagsrequired). However, haspermission() is called with totally different parameters, sometimes only one, that being a hash with a key "flagsrequired". I actually put some Data::Dumper stuff into C4::Auth::haspermission to check; the arguments are totally broken.
./acqui/basket.pl: if ($basket->{closedate} && haspermission({ flagsrequired => { acquisition => 'group_manage'} })) { Missing userid, broken flagsrequired.
./acqui/booksellers.pl: || haspermission( $uid, { flagsrequired => { acquisition => q{*} } } ) Broken flagsrequired. Plus $uid is generated rather strangely.
./admin/aqbudget_owner_search.pl: my $perms = haspermission( $res->{'userid'} ); Missing flagsrequired, maybe OK.
./members/deletemem.pl: unless(C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) { ./members/deletemem.pl: unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>1})) { ./members/memberentry.pl: if (ref($borrower_data) && ($borrower_data->{'category_type'} eq 'S') && ! (C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) ) { Looks correct.