View | Details | Raw Unified | Return to bug 9833
Collapse All | Expand All

(-)a/C4/Auth.pm (+4 lines)
Lines 1135-1140 sub check_api_auth { Link Here
1135
    # is deferred so as to not introduce bugs into the
1135
    # is deferred so as to not introduce bugs into the
1136
    # regular authentication code for Koha 3.0.
1136
    # regular authentication code for Koha 3.0.
1137
1137
1138
    # FIXME: check_cookie_auth happens to disconnect the
1139
    # user when authentication fails. Imho, it should not.
1140
    # It should just deny authentication.
1141
1138
    # see if we have a valid session cookie already
1142
    # see if we have a valid session cookie already
1139
    # however, if a userid parameter is present (i.e., from
1143
    # however, if a userid parameter is present (i.e., from
1140
    # a form submission, assume that any current cookie
1144
    # a form submission, assume that any current cookie
(-)a/C4/VirtualShelves.pm (-2 / +8 lines)
Lines 23-28 use warnings; Link Here
23
use Carp;
23
use Carp;
24
use C4::Context;
24
use C4::Context;
25
use C4::Debug;
25
use C4::Debug;
26
use C4::Members;
26
27
27
use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead
28
use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead
28
use constant SHELVES_COMBO_MAX => 10; #add to combo in search
29
use constant SHELVES_COMBO_MAX => 10; #add to combo in search
Lines 431-437 ShelfPossibleAction($loggedinuser, $shelfnumber, $action); Link Here
431
432
432
C<$loggedinuser,$shelfnumber,$action>
433
C<$loggedinuser,$shelfnumber,$action>
433
434
434
$action can be "view", "add", "delete", "manage", "new_public", "new_private".
435
$action can be "view", "add", "delete", "manage", "new_public", "new_private" or "merge".
435
Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage.
436
Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage.
436
new_public and new_private refers to creating a new public or private list.
437
new_public and new_private refers to creating a new public or private list.
437
The distinction between deleting your own entries from the list or entries from
438
The distinction between deleting your own entries from the list or entries from
Lines 489-495 sub ShelfPossibleAction { Link Here
489
        return 1 if $user>0 && ($shelf->{allow_delete_own}==1 || $shelf->{allow_delete_other}==1);
490
        return 1 if $user>0 && ($shelf->{allow_delete_own}==1 || $shelf->{allow_delete_other}==1);
490
    }
491
    }
491
    elsif($action eq 'manage') {
492
    elsif($action eq 'manage') {
492
        return 1 if $user && $shelf->{owner}==$user;
493
        my $borrower = GetMemberDetails($user);
494
        return 1 if ($user && $shelf->{owner}==$user) || C4::Auth::haspermission($borrower->{'userid'},  {'editcatalogue' => 'manage_shelves'});
495
    }
496
    elsif($action eq 'merge') {
497
        my $borrower = GetMemberDetails($user);
498
        return 1 if C4::Auth::haspermission($borrower->{'userid'},  {'editcatalogue' => 'merge_from_shelves'});
493
    }
499
    }
494
    return 0;
500
    return 0;
495
}
501
}
(-)a/C4/VirtualShelves/Page.pm (+2 lines)
Lines 295-306 sub shelfpage { Link Here
295
                $showadd = 1;
295
                $showadd = 1;
296
                my $i = 0;
296
                my $i = 0;
297
                my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );
297
                my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );
298
                my $mergefromshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'merge' );
298
                $template->param(
299
                $template->param(
299
                    shelfname           => $shelfname,
300
                    shelfname           => $shelfname,
300
                    shelfnumber         => $shelfnumber,
301
                    shelfnumber         => $shelfnumber,
301
                    viewshelf           => $shelfnumber,
302
                    viewshelf           => $shelfnumber,
302
                    sortfield           => $sortfield,
303
                    sortfield           => $sortfield,
303
                    manageshelf         => $manageshelf,
304
                    manageshelf         => $manageshelf,
305
                    merge_from_shelf => $mergefromshelf,
304
                    allowremovingitems  => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),
306
                    allowremovingitems  => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),
305
                    allowaddingitem     => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),
307
                    allowaddingitem     => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),
306
                    "category$category" => 1,
308
                    "category$category" => 1,
(-)a/cataloguing/merge.pl (-1 / +6 lines)
Lines 42-48 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
42
        query           => $input,
42
        query           => $input,
43
        type            => "intranet",
43
        type            => "intranet",
44
        authnotrequired => 0,
44
        authnotrequired => 0,
45
        flagsrequired   => { editcatalogue => 'edit_catalogue' },
45
46
        # Important: if you plan to change this permission, do not forget
47
        # to change the matching permission in merge_ajax.pl, otherwise
48
        # you'll end up disconnected without knowing why...
49
        flagsrequired   => { editcatalogue => 'merge_from_shelves' }
50
46
    }
51
    }
47
);
52
);
48
53
(-)a/cataloguing/merge_ajax.pl (-1 / +1 lines)
Lines 16-22 use CGI::Cookie; # need to check cookies before Link Here
16
                 # having CGI parse the POST request
16
                 # having CGI parse the POST request
17
17
18
my %cookies = fetch CGI::Cookie;
18
my %cookies = fetch CGI::Cookie;
19
my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' });
19
my ( $auth_status, $sessionID ) = check_cookie_auth( $cookies{'CGISESSID'}->value, { editcatalogue => 'merge_from_shelves' } );
20
if ($auth_status ne "ok") {
20
if ($auth_status ne "ok") {
21
    my $reply = CGI->new("");
21
    my $reply = CGI->new("");
22
    print $reply->header(-type => 'text/html');
22
    print $reply->header(-type => 'text/html');
(-)a/installer/data/mysql/updatedatabase.pl (+14 lines)
Lines 6532-6537 if (C4::Context->preference("Version") < TransformToNum($DBversion)) { Link Here
6532
    SetVersion ($DBversion);
6532
    SetVersion ($DBversion);
6533
}
6533
}
6534
6534
6535
$DBversion = '3.11.00.XXX';
6536
if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
6537
    $dbh->do(qq{
6538
        INSERT INTO `permissions` (`module_bit`, `code`, `description`) VALUES (
6539
        '9', 'manage_shelves', 'Allows to manage shelves'), (
6540
        '9', 'merge_from_shelves', 'Allows to merge records from shelves'
6541
        );
6542
    });
6543
    print "Upgrade to $DBversion done (Adds new permissions for shelves)\n";
6544
    SetVersion($DBversion);
6545
}
6546
6547
6548
6535
=head1 FUNCTIONS
6549
=head1 FUNCTIONS
6536
6550
6537
=head2 TableExists($table)
6551
=head2 TableExists($table)
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt (-2 / +1 lines)
Lines 283-289 function placeHold () { Link Here
283
        [% IF ( itemsloop ) %]
283
        [% IF ( itemsloop ) %]
284
            <input type="button" id="placehold" style="display:none" onclick="placeHold(); return false;" value="Place holds" />
284
            <input type="button" id="placehold" style="display:none" onclick="placeHold(); return false;" value="Place holds" />
285
            [% IF ( allowremovingitems ) %]<input type="submit" value="Remove selected records" onclick="return confirm(MSG_REMOVE_FROM_LIST);" />[% END %]
285
            [% IF ( allowremovingitems ) %]<input type="submit" value="Remove selected records" onclick="return confirm(MSG_REMOVE_FROM_LIST);" />[% END %]
286
            <input type="submit" value="Merge selected records" onclick="return MergeItems();" />
286
            [% IF ( merge_from_shelf ) %]<input type="submit" value="Merge selected records" onclick="return MergeItems();" />[% END %]
287
        [% END %]
287
        [% END %]
288
 </fieldset>
288
 </fieldset>
289
 </fieldset>
289
 </fieldset>
290
- 

Return to bug 9833