Attachment #10227 for bug #7295

View | Details | Raw Unified | Return to bug 7295
Collapse All | Expand All

Lines 46-51 BEGIN { Link Here

(-)a/C4/Acquisition.pm (-2 / +147 lines)
46	&GetBasketsByBookseller &GetBasketsByBasketgroup	46	&GetBasketsByBookseller &GetBasketsByBasketgroup
47	&GetBasketsInfosByBookseller	47	&GetBasketsInfosByBookseller
48		48
		49	&GetBasketUsers &ModBasketUsers
		50	&CanUserManageBasket
		51
49	&ModBasketHeader	52	&ModBasketHeader
50		53
51	&ModBasketgroup &NewBasketgroup &DelBasketgroup &GetBasketgroup &CloseBasketgroup	54	&ModBasketgroup &NewBasketgroup &DelBasketgroup &GetBasketgroup &CloseBasketgroup
Lines 146-153 sub GetBasket { Link Here
146	my $dbh = C4::Context->dbh;	149	my $dbh = C4::Context->dbh;
147	my $query = "	150	my $query = "
148	SELECT aqbasket.*,	151	SELECT aqbasket.*,
149	concat( b.firstname,' ',b.surname) AS authorisedbyname,	152	concat( b.firstname,' ',b.surname) AS authorisedbyname
150	b.branchcode AS branch
151	FROM aqbasket	153	FROM aqbasket
152	LEFT JOIN borrowers b ON aqbasket.authorisedby=b.borrowernumber	154	LEFT JOIN borrowers b ON aqbasket.authorisedby=b.borrowernumber
153	WHERE basketno=?	155	WHERE basketno=?
Lines 501-506 sub GetBasketsInfosByBookseller { Link Here
501	return $sth->fetchall_arrayref({});	503	return $sth->fetchall_arrayref({});
502	}	504	}
503		505
		506	=head3 GetBasketUsers
		507
		508	$basketusers_ids = &GetBasketUsers($basketno);
		509
		510	Returns a list of all borrowernumbers that are in basket users list
		511
		512	=cut
		513
		514	sub GetBasketUsers {
		515	my $basketno = shift;
		516
		517	return unless $basketno;
		518
		519	my $query = qq{
		520	SELECT borrowernumber
		521	FROM aqbasketusers
		522	WHERE basketno = ?
		523	};
		524	my $dbh = C4::Context->dbh;
		525	my $sth = $dbh->prepare($query);
		526	$sth->execute($basketno);
		527	my $results = $sth->fetchall_arrayref( {} );
		528	$sth->finish();
		529
		530	my @borrowernumbers;
		531	foreach (@$results) {
		532	push @borrowernumbers, $_->{'borrowernumber'};
		533	}
		534
		535	return @borrowernumbers;
		536	}
		537
		538	=head3 ModBasketUsers
		539
		540	my @basketusers_ids = (1, 2, 3);
		541	&ModBasketUsers($basketno, @basketusers_ids);
		542
		543	Delete all users from basket users list, and add users in C<@basketusers_ids>
		544	to this users list.
		545
		546	=cut
		547
		548	sub ModBasketUsers {
		549	my ($basketno, @basketusers_ids) = @_;
		550
		551	return unless $basketno;
		552
		553	my $dbh = C4::Context->dbh;
		554	my $query = qq{
		555	DELETE FROM aqbasketusers
		556	WHERE basketno = ?
		557	};
		558	my $sth = $dbh->prepare($query);
		559	$sth->execute($basketno);
		560	$sth->finish();
		561
		562	$query = qq{
		563	INSERT INTO aqbasketusers (basketno, borrowernumber)
		564	VALUES (?, ?)
		565	};
		566	$sth = $dbh->prepare($query);
		567	foreach my $basketuser_id (@basketusers_ids) {
		568	$sth->execute($basketno, $basketuser_id);
		569	}
570	}
571
572	=head3 CanUserManageBasket
573
574	my $bool = CanUserManageBasket($borrower, $basket[, $userflags]);
575	my $bool = CanUserManageBasket($borrowernumber, $basketno[, $userflags]);
576
577	Check if a borrower can manage a basket, according to system preference
578	AcqViewBaskets, user permissions and basket properties (creator, users list,
579	branch).
580
581	First parameter can be either a borrowernumber or a hashref as returned by
582	C4::Members::GetMember.
583
584	Second parameter can be either a basketno or a hashref as returned by
585	C4::Acquisition::GetBasket.
586
587	The third parameter is optional. If given, it should be a hashref as returned
588	by C4::Auth::getuserflags. If not, getuserflags is called.
589
590	If user is authorised to manage basket, returns 1.
591	Otherwise returns 0.
592
593	=cut
594
595	sub CanUserManageBasket {
596	my ($borrower, $basket, $userflags) = @_;
597
598	if (!ref $borrower) {
599	$borrower = C4::Members::GetMember(borrowernumber => $borrower);
600	}
601	if (!ref $basket) {
602	$basket = GetBasket($basket);
603	}
604
605	return 0 unless ($basket and $borrower);
606
607	my $borrowernumber = $borrower->{borrowernumber};
608	my $basketno = $basket->{basketno};
609
610	my $AcqViewBaskets = C4::Context->preference('AcqViewBaskets');
611
612	if (!defined $userflags) {
613	my $dbh = C4::Context->dbh;
614	my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE borrowernumber = ?");
615	$sth->execute($borrowernumber);
616	my ($flags) = $sth->fetchrow_array;
617	$sth->finish;
618
619	$userflags = C4::Auth::getuserflags($flags, $borrower->{userid}, $dbh);
620	}
621
622	unless ($userflags->{superlibrarian}
623	\|\| (ref $userflags->{acquisition} && $userflags->{acquisition}->{order_manage_all})
624	\|\| (!ref $userflags->{acquisition} && $userflags->{acquisition}))
625	{
626	if (not exists $userflags->{acquisition}) {
627	return 0;
628	}
629
630	if ( (ref $userflags->{acquisition} && !$userflags->{acquisition}->{order_manage})
631	\|\| (!ref $userflags->{acquisition} && !$userflags->{acquisition}) ) {
632	return 0;
633	}
634
635	if ($AcqViewBaskets eq 'user'
636	&& $basket->{authorisedby} != $borrowernumber
637	&& grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
638	return 0;
639	}
640
641	if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
642	&& $basket->{branch} ne $borrower->{branchcode}) {
643	return 0;
644	}
645	}
646
647	return 1;
648	}
504		649
505	#------------------------------------------------------------#	650	#------------------------------------------------------------#
506		651




#!/usr/bin/perl

# script to find a basket user

# Copyright 2012 BibLibre SARL
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

use Modern::Perl;

use CGI;
use C4::Auth;
use C4::Output;
use C4::Members;

my $input = new CGI;

my $dbh = C4::Context->dbh;

my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user(
    {   template_name   => "acqui/aqbasketuser_search.tmpl",
        query           => $input,
        type            => "intranet",
        authnotrequired => 0,
        flagsrequired   => { acquisition => 'order_manage' },
    }
);

my $q = $input->param('q') || '';
my $op = $input->param('op') || '';

if( $op eq "do_search" ) {
    my $results = C4::Members::Search( $q, "surname");

    my @users_loop;
    my $nresults = 0;
    foreach my $res (@$results) {
        my $perms = haspermission( $res->{userid} );
        my $subperms = get_user_subpermissions( $res->{userid} );

        if( $perms->{superlibrarian} == 1
         || $perms->{acquisition} == 1
         || $subperms->{acquisition}->{'order_manage'} ) {
            my %row = (
                borrowernumber  => $res->{borrowernumber},
                cardnumber      => $res->{cardnumber},
                surname         => $res->{surname},
                firstname       => $res->{firstname},
                categorycode    => $res->{categorycode},
                branchcode      => $res->{branchcode},
            );
            push( @users_loop, \%row );
            $nresults ++;
        }
    }

    $template->param(
        q           => $q,
        nresults    => $nresults,
        users_loop  => \@users_loop,
    );
}

output_html_with_http_headers( $input, $cookie, $template->output );




use CGI;
use C4::Acquisition;
use C4::Budgets;
use C4::Branch;
use C4::Bookseller qw( GetBookSellerFromId);
use C4::Debug;
use C4::Biblio;

my $basketno     = $query->param('basketno');
my $booksellerid = $query->param('booksellerid');

my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
    {
        template_name   => "acqui/basket.tmpl",
        query           => $query,

);

my $basket = GetBasket($basketno);
$booksellerid = $basket->{booksellerid} unless $booksellerid;
my ($bookseller) = GetBookSellerFromId($booksellerid);

unless (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
    $template->param(
        cannot_manage_basket => 1,
        basketno => $basketno,
        basketname => $basket->{basketname},
        booksellerid => $booksellerid,
        name => $bookseller->{name}
    );
    output_html_with_http_headers $query, $cookie, $template->output;
    exit;
}

# FIXME : what about the "discount" percentage?
# FIXME : the query->param('booksellerid') below is probably useless. The bookseller is always known from the basket
# if no booksellerid in parameter, get it from basket
# warn "=>".$basket->{booksellerid};
$booksellerid = $basket->{booksellerid} unless $booksellerid;
my ($bookseller) = GetBookSellerFromId($booksellerid);
my $op = $query->param('op');
if (!defined $op) {
    $op = q{};

    $basket->{closedate} = undef;
    ModBasket($basket);
    print $query->redirect('/cgi-bin/koha/acqui/basket.pl?basketno='.$basket->{'basketno'})
} elsif ( $op eq 'mod_users' ) {
    my $basketusers_ids = $query->param('basketusers_ids');
    my @basketusers = split( /:/, $basketusers_ids );
    ModBasketUsers($basketno, @basketusers);
    print $query->redirect("/cgi-bin/koha/acqui/basket.pl?basketno=$basketno");
    exit;
} elsif ( $op eq 'mod_branch' ) {
    my $branch = $query->param('branch');
    $branch = undef if(defined $branch and $branch eq '');
    ModBasket({
        basketno => $basket->{basketno},
        branch   => $branch
    });
    print $query->redirect("/cgi-bin/koha/acqui/basket.pl?basketno=$basketno");
    exit;
} else {
    # get librarian branch...
    if ( C4::Context->preference("IndependantBranches") ) {

            }
        }
    }
    # get branches
    my $branches = C4::Branch::GetBranches;
    my @branches_loop;
    foreach my $branch (sort keys %$branches) {
        push @branches_loop, {
            branchcode => $branch,
            branchname => $branches->{$branch}->{branchname},
            selected => (defined $basket->{branch} and $branch eq $basket->{branch}) ? 1 : 0
        };
    }

#if the basket is closed,and the user has the permission to edit basketgroups, display a list of basketgroups
    my $basketgroups;
    my $member = GetMember(borrowernumber => $loggedinuser);

      "loggedinuser: $loggedinuser; creationdate: %s; authorisedby: %s",
      $basket->{creationdate}, $basket->{authorisedby};

    my @basketusers_ids = GetBasketUsers($basketno);
    my @basketusers;
    foreach my $basketuser_id (@basketusers_ids) {
        my $basketuser = GetMember(borrowernumber => $basketuser_id);
        push @basketusers, $basketuser if $basketuser;
    }

	#to get active currency
	my $cur = GetCurrency();


        push @books_loop, \%line;
    }

    my $total_est_gste;
    my $total_est_gsti;
    my $gist_est;
    if ($gist){                                                    # if we have GST

       }
       $gist_est = $gist_rrp - ( $gist_rrp * $discount );
    } else {
        $total_rrp_gsti = $total_rrp;
        $total_est_gsti = $total_rrp_est;
    }

    my $contract = &GetContract($basket->{contractnumber});
    my @orders = GetOrders($basketno);

        basketbooksellernote => $basket->{booksellernote},
        basketcontractno     => $basket->{contractnumber},
        basketcontractname   => $contract->{contractname},
        branches_loop        => \@branches_loop,
        creationdate         => $basket->{creationdate},
        authorisedby         => $basket->{authorisedby},
        authorisedbyname     => $basket->{authorisedbyname},
        basketusers_ids      => join(':', @basketusers_ids),
        basketusers          => \@basketusers,
        closedate            => $basket->{closedate},
        estimateddeliverydate=> $estimateddeliverydate,
        active               => $bookseller->{'active'},




use C4::Output;
use CGI;

use C4::Acquisition qw/ GetBasketsInfosByBookseller CanUserManageBasket /;
use C4::Bookseller qw/ GetBookSellerFromId GetBookSeller /;
use C4::Members qw/GetMember/;
use C4::Context;

my $query = CGI->new;
my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
    {   template_name   => 'acqui/booksellers.tmpl',
        query           => $query,
        type            => 'intranet',

    $uid = GetMember( borrowernumber => $loggedinuser )->{userid};
}

my $userenv = C4::Context::userenv;
my $viewbaskets = C4::Context->preference('AcqViewBaskets');

my $userbranch = $userenv->{branch};

#build result page
my $loop_suppliers = [];


    my $loop_basket = [];

    for my $basket ( @{$baskets} ) {
        if (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
            my $member = GetMember( borrowernumber => $basket->{authorisedby} );
        my $member = GetMember( borrowernumber => $authorisedby );
        if ( $member ) {
           $basketbranch = $member->{branchcode};
        }

        if ($userenv->{'flags'} & 1 || #user is superlibrarian
               (haspermission( $uid, { acquisition => q{*} } ) && #user has acq permissions and
                   ($viewbaskets eq 'all' || #user is allowed to see all baskets
                   ($viewbaskets eq 'branch' && $authorisedby && $userbranch eq $basketbranch) || #basket belongs to user's branch
                   ($basket->{authorisedby} &&  $viewbaskets eq 'user' && $authorisedby == $loggedinuser) #user created this basket
                   ) 
                ) 
           ) { 
            foreach (qw(total_items total_biblios expected_items)) {
                $basket->{$_} ||= 0;
            }

Lines 13-18 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/de-DE/mandatory/userpermissions.sql (+1 lines)
13	(11, 'budget_modify', 'Konten verändern (keine neuen anlegen, aber bestehende ändern)'),	13	(11, 'budget_modify', 'Konten verändern (keine neuen anlegen, aber bestehende ändern)'),
14	(11, 'planning_manage', 'Etatplanung verwalten'),	14	(11, 'planning_manage', 'Etatplanung verwalten'),
15	(11, 'order_manage', 'Bestellungen verwalten'),	15	(11, 'order_manage', 'Bestellungen verwalten'),
		16	(11, 'order_manage_all', 'Manage all orders & baskets'),
16	(11, 'group_manage', 'Bestellgruppen vewalten'),	17	(11, 'group_manage', 'Bestellgruppen vewalten'),
17	(11, 'order_receive', 'Lieferungen verwalten'),	18	(11, 'order_receive', 'Lieferungen verwalten'),
18	(11, 'budget_add_del', 'Konten hinzufügen/ändern, aber bestehende nicht ändern'),	19	(11, 'budget_add_del', 'Konten hinzufügen/ändern, aber bestehende nicht ändern'),

Lines 13-18 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/en/mandatory/userpermissions.sql (+1 lines)
13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),	13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
14	(11, 'planning_manage', 'Manage budget plannings'),	14	(11, 'planning_manage', 'Manage budget plannings'),
15	(11, 'order_manage', 'Manage orders & basket'),	15	(11, 'order_manage', 'Manage orders & basket'),
		16	(11, 'order_manage_all', 'Manage all orders & baskets'),
16	(11, 'group_manage', 'Manage orders & basketgroups'),	17	(11, 'group_manage', 'Manage orders & basketgroups'),
17	(11, 'order_receive', 'Manage orders & basket'),	18	(11, 'order_receive', 'Manage orders & basket'),
18	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),	19	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),

Lines 13-18 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/es-ES/mandatory/userpermissions.sql (+1 lines)
13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),	13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
14	(11, 'planning_manage', 'Manage budget plannings'),	14	(11, 'planning_manage', 'Manage budget plannings'),
15	(11, 'order_manage', 'Manage orders & basket'),	15	(11, 'order_manage', 'Manage orders & basket'),
		16	(11, 'order_manage_all', 'Manage all orders & baskets'),
16	(11, 'group_manage', 'Manage orders & basketgroups'),	17	(11, 'group_manage', 'Manage orders & basketgroups'),
17	(11, 'order_receive', 'Manage orders & basket'),	18	(11, 'order_receive', 'Manage orders & basket'),
18	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),	19	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),

Lines 30-35 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/fr-FR/1-Obligatoire/userpermissions.sql (+1 lines)
30	(11, 'budget_modify', 'Modifier les budgets (impossible de créer les lignes, mais possible de modifier celles qui existent'),	30	(11, 'budget_modify', 'Modifier les budgets (impossible de créer les lignes, mais possible de modifier celles qui existent'),
31	(11, 'planning_manage', 'Gérer de la planification des budgets'),	31	(11, 'planning_manage', 'Gérer de la planification des budgets'),
32	(11, 'order_manage', 'Gérer les commandes et les paniers'),	32	(11, 'order_manage', 'Gérer les commandes et les paniers'),
		33	(11, 'order_manage_all', 'Gérer toutes les commandes et panier'),
33	(11, 'group_manage', 'Gérer les commandes et les bons de commande'),	34	(11, 'group_manage', 'Gérer les commandes et les bons de commande'),
34	(11, 'order_receive', 'Gérer les réceptions'),	35	(11, 'order_receive', 'Gérer les réceptions'),
35	(11, 'budget_add_del', 'Ajouter et supprimer les budgets (mais pas modifier)'),	36	(11, 'budget_add_del', 'Ajouter et supprimer les budgets (mais pas modifier)'),

Lines 15-20 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/it-IT/necessari/userpermissions.sql (+1 lines)
15	(11, 'budget_modify', 'Modifica budget (non li crea ma modifica gli esistenti)'),	15	(11, 'budget_modify', 'Modifica budget (non li crea ma modifica gli esistenti)'),
16	(11, 'planning_manage', 'Intervieni sulla pianificazione dei budgets'),	16	(11, 'planning_manage', 'Intervieni sulla pianificazione dei budgets'),
17	(11, 'order_manage', 'Gestisci ordini e raccoglitori'),	17	(11, 'order_manage', 'Gestisci ordini e raccoglitori'),
		18	(11, 'order_manage_all', 'Manage all orders & baskets'),
18	(11, 'group_manage', 'Gestisci ordini e raccoglitori raggruppati'),	19	(11, 'group_manage', 'Gestisci ordini e raccoglitori raggruppati'),
19	(11, 'order_receive', 'Gestisci arrivi'),	20	(11, 'order_receive', 'Gestisci arrivi'),
20	(11, 'budget_add_del', 'Aggiungi e cancella budgets (senza modificarli)'),	21	(11, 'budget_add_del', 'Aggiungi e cancella budgets (senza modificarli)'),




  `authorisedby` varchar(10) default NULL,
  `booksellerinvoicenumber` mediumtext,
  `basketgroupid` int(11),
  branch varchar(10) default NULL,
  PRIMARY KEY  (`basketno`),
  KEY `booksellerid` (`booksellerid`),
  KEY `basketgroupid` (`basketgroupid`),

  CONSTRAINT `aqbasket_ibfk_1` FOREIGN KEY (`booksellerid`) REFERENCES `aqbooksellers` (`id`) ON UPDATE CASCADE,
  CONSTRAINT `aqbasket_ibfk_2` FOREIGN KEY (`contractnumber`) REFERENCES `aqcontract` (`contractnumber`),
  CONSTRAINT `aqbasket_ibfk_3` FOREIGN KEY (`basketgroupid`) REFERENCES `aqbasketgroups` (`id`) ON UPDATE CASCADE
  CONSTRAINT aqbasket_ibfk_4 FOREIGN KEY (branch) REFERENCES branches (branchcode) ON UPDATE CASCADE ON DELETE SET NULL,
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table aqbasketusers
--

DROP TABLE IF EXISTS aqbasketusers;
CREATE TABLE aqbasketusers (
  basketno int(11) NOT NULL,
  borrowernumber int(11) NOT NULL,
  PRIMARY KEY (basketno,borrowernumber),
  CONSTRAINT aqbasketusers_ibfk_1 FOREIGN KEY (basketno) REFERENCES aqbasket (basketno) ON UPDATE CASCADE ON DELETE CASCADE,
  CONSTRAINT aqbasketusers_ibfk_2 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber) ON UPDATE CASCADE ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--

Lines 34-39 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/nb-NO/1-Obligatorisk/userpermissions.sql (+1 lines)
34	(11, 'budget_modify', 'Endre budsjetter (kan ikke legge til kontolinjer, men endre eksisterende)'),	34	(11, 'budget_modify', 'Endre budsjetter (kan ikke legge til kontolinjer, men endre eksisterende)'),
35	(11, 'planning_manage', 'Administrere budsjettplaner'),	35	(11, 'planning_manage', 'Administrere budsjettplaner'),
36	(11, 'order_manage', 'Administrere bestillinger og kurver'),	36	(11, 'order_manage', 'Administrere bestillinger og kurver'),
		37	(11, 'order_manage_all', 'Manage all orders & baskets'),
37	(11, 'group_manage', 'Administrere bestillinger og kurv-grupper'),	38	(11, 'group_manage', 'Administrere bestillinger og kurv-grupper'),
38	(11, 'order_receive', 'Administrere bestillinger og kurver'),	39	(11, 'order_receive', 'Administrere bestillinger og kurver'),
39	(11, 'budget_add_del', 'Legge til og slette budsjetter (men ikke endre budsjetter)'),	40	(11, 'budget_add_del', 'Legge til og slette budsjetter (men ikke endre budsjetter)'),

Lines 13-18 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/pl-PL/mandatory/userpermissions.sql (+1 lines)
13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),	13	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
14	(11, 'planning_manage', 'Manage budget plannings'),	14	(11, 'planning_manage', 'Manage budget plannings'),
15	(11, 'order_manage', 'Manage orders & basket'),	15	(11, 'order_manage', 'Manage orders & basket'),
		16	(11, 'order_manage_all', 'Manage all orders & baskets'),
16	(11, 'group_manage', 'Manage orders & basketgroups'),	17	(11, 'group_manage', 'Manage orders & basketgroups'),
17	(11, 'order_receive', 'Manage orders & basket'),	18	(11, 'order_receive', 'Manage orders & basket'),
18	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),	19	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),

Lines 37-42 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/ru-RU/mandatory/permissions_and_user_flags.sql (+1 lines)
37	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),	37	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
38	(11, 'planning_manage', 'Manage budget plannings'),	38	(11, 'planning_manage', 'Manage budget plannings'),
39	(11, 'order_manage', 'Manage orders & basket'),	39	(11, 'order_manage', 'Manage orders & basket'),
		40	(11, 'order_manage_all', 'Manage all orders & baskets'),
40	(11, 'group_manage', 'Manage orders & basketgroups'),	41	(11, 'group_manage', 'Manage orders & basketgroups'),
41	(11, 'order_receive', 'Manage orders & basket'),	42	(11, 'order_receive', 'Manage orders & basket'),
42	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),	43	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),

Lines 37-42 INSERT INTO permissions (module_bit, code, description) VALUES Link Here

(-)a/installer/data/mysql/uk-UA/mandatory/permissions_and_user_flags.sql (+1 lines)
37	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),	37	(11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
38	(11, 'planning_manage', 'Manage budget plannings'),	38	(11, 'planning_manage', 'Manage budget plannings'),
39	(11, 'order_manage', 'Manage orders & basket'),	39	(11, 'order_manage', 'Manage orders & basket'),
		40	(11, 'order_manage_all', 'Manage all orders & baskets'),
40	(11, 'group_manage', 'Manage orders & basketgroups'),	41	(11, 'group_manage', 'Manage orders & basketgroups'),
41	(11, 'order_receive', 'Manage orders & basket'),	42	(11, 'order_receive', 'Manage orders & basket'),
42	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),	43	(11, 'budget_add_del', 'Add and delete budgets (but cant modify budgets)'),




    SetVersion($DBversion);
}

$DBversion = "XXX";
if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
    $dbh->do("
        ALTER TABLE aqbasket ADD branch varchar(10) default NULL
    ");
    $dbh->do("
        ALTER TABLE aqbasket
        ADD CONSTRAINT aqbasket_ibfk_4 FOREIGN KEY (branch)
            REFERENCES branches (branchcode)
            ON UPDATE CASCADE ON DELETE SET NULL
    ");
    $dbh->do("
        DROP TABLE IF EXISTS aqbasketusers
    ");
    $dbh->do("
        CREATE TABLE aqbasketusers (
            basketno int(11) NOT NULL,
            borrowernumber int(11) NOT NULL,
            PRIMARY KEY (basketno,borrowernumber),
            CONSTRAINT aqbasketusers_ibfk_1 FOREIGN KEY (basketno) REFERENCES aqbasket (basketno) ON DELETE CASCADE ON UPDATE CASCADE,
            CONSTRAINT aqbasketusers_ibfk_2 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber) ON DELETE CASCADE ON UPDATE CASCADE
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    ");
    $dbh->do("
        INSERT INTO permissions (module_bit, code, description)
        VALUES (11, 'order_manage_all', 'Manage all orders & baskets')
    ");

    print "Upgrade to $DBversion done (Add branch and users list to baskets. "
        . "New permission order_manage_all)\n";
    SetVersion($DBversion);
}


=head1 FUNCTIONS





[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Basket User Search</title>
[% INCLUDE 'doc-head-close.inc' %]

<style type="text/css">
    #custom-doc {
        width:44.46em;
        *width:43.39em;
        min-width:578px;
        margin:auto;
        text-align:left;
    }
</style>

<script type="text/javascript">
//<![CDATA[
    // modify parent window owner element
    function add_user(borrowernumber, borrowername) {
        var p = window.opener;
        if(p.add_basket_user(borrowernumber, borrowername) < 0) {
            alert(_("Borrower '" + borrowername + "' is already in the list."));
        }
    }
//]]>
</script>

</head>
<body>
<div id="custom-doc" class="yui-t7">
  <div id="bd">
    <div class="yui-g">

      <h3>Search for Basket User</h3>
      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
        <fieldset>
          <input type="hidden" name="op" id="op" value="do_search" />
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
          <input type="submit" class="button" value="Search" />
        </fieldset>
        <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
      </form>

[% IF (q) %]
    <p>Searched for <span class="ex">[% q %]</span>, [% nresults %] patron(s) found.</p>
[% END %]
[% IF ( users_loop ) %]
    <table>
      <thead>
        <tr>
            <th>Cardnumber</th>
            <th>Name</th>
            <th>Branch</th>
            <th>Categorycode</th>
            <th>Select?</th>
        </tr>
      </thead>
      <tbody>
        [% FOREACH user IN users_loop %]
          [% IF ( user.toggle ) %]
            <tr>
          [% ELSE %]
            <tr class="highlight">
          [% END %]
                <td>[% user.cardnumber %]</td>
                <td>[% user.surname %], [% user.firstname %]</td>
                <td>[% user.branchcode %]</td>
                <td>[% user.categorycode %]</td>
                <td>
                    <a style="cursor:pointer" onclick="add_user('[% user.borrowernumber %]', '[% user.firstname %] [% user.surname %]');">Add</a>
                </td>
            </tr>
        [% END %]
    </table>
[% END %]

<div id="closewindow"><a href="#" class="close">Close</a></div>
</div>
</div>
[% INCLUDE 'intranet-bottom.inc' %]




            "sPaginationType": "four_button"
        } ) );
    } );

    function basketUserSearchPopup(f) {
        window.open(
            "/cgi-bin/koha/acqui/aqbasketuser_search.pl",
            'BasketUserSearchPopup',
            'width=740,height=450,toolbar=no,'
         );
    }

    function add_basket_user(borrowernumber, borrowername) {
        var ids = $("#basketusers_ids").val();
        if(ids.length > 0) {
            ids = ids.split(':');
        } else {
            ids = new Array;
        }
        if (ids.indexOf(borrowernumber) < 0) {
            ids.push(borrowernumber);
            $("#basketusers_ids").val(ids.join(':'));
            var li = '<li id="user_'+borrowernumber+'">'+borrowername
                + ' [<a style="cursor:pointer" onclick="del_basket_user('+borrowernumber+');">'
                + _('Delete user') + '</a>]</li>';
            $("#basketusers_names").append(li);
            return 0;
        }
        return -1;
    }

    function del_basket_user(borrowernumber) {
      $("#user_"+borrowernumber).remove();
      var ids = $("#basketusers_ids").val().split(':');
      ids.splice(ids.indexOf(borrowernumber.toString()), 1);
      $("#basketusers_ids").val(ids.join(':'));
    }
//]]>
</script>

<style type="text/css">
.sortmsg {font-size: 80%;}
</style>


<div id="bd">
    <div id="yui-main">
    [% IF (cannot_manage_basket) %]
        <div class="yui-b">
            <p class="error">You are not authorised to manage this basket.</p>
        </div>
    [% ELSE %]
    <div class="yui-b">
        [% UNLESS ( confirm_close ) %]
        [% UNLESS ( selectbasketg ) %]

                [% IF ( basketcontractno ) %]
                    <li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno %]&amp;booksellerid=[% booksellerid %]">[% basketcontractname %]</a></li>
                [% END %]
                [% IF ( authorisedbyname ) %]<li><span class="label">Created by:</span>  [% authorisedbyname %]</li>[% END %]
                <li>
                    <form action="" method="post">
                        <span class="label">Managed by:</span>
                        <div style="float:left">
                            <ul id="basketusers_names" style="padding-left:0">
                              [% FOREACH user IN basketusers %]
                                <li id="user_[% user.borrowernumber %]">
                                    [% user.firstname %] [% user.surname %]
                                    [<a onclick="del_basket_user([% user.borrowernumber %]);" style="cursor:pointer">Delete user</a>]
                                </li>
                              [% END %]
                            </ul>
                            <input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
                            <input type="hidden" id="basketusers_ids" name="basketusers_ids" value="[% basketusers_ids %]" />
                            <input type="hidden" id="op" name="op" value="mod_users" />
                            <input type="button" id="add_user" onclick="basketUserSearchPopup();" value="Add user" />
                            <input type="submit" value="Save changes" />
                        </div>
                    </form>
                </li>
                <li>
                    <form action="" method="post">
                        <span class="label">Branch:</span>
                        <select id="branch" name="branch">
                            <option value="">No branch</option>
                            [% FOREACH branch IN branches_loop %]
                                [% IF (branch.selected) %]
                                    <option selected="selected" value="[% branch.branchcode %]"> [% branch.branchname %]</option>
                                [% ELSE %]
                                    <option value="[% branch.branchcode %]"> [% branch.branchname %]</option>
                                [% END %]
                            [% END %]
                        </select>
                        <input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
                        <input type="hidden" id="op" name="op" value="mod_branch" />
                        <input type="submit" value="Save" />
                    </form>
                </li>
                [% IF ( creationdate ) %]<li><span class="label">Opened on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
                [% IF ( closedate ) %]<li><span class="label">Closed on:</span> [% closedate | $KohaDates %]</li>[% END %]
                [% IF ( estimateddeliverydate ) %]<li><span class="label">Estimated delivery date:</span> [% estimateddeliverydate | $KohaDates  %]</li>[% END %]

        </div>
    [% END %]
</div>
[% END %][%# IF (cannot_manage_basket) %]
</div>
<div class="yui-b">
[% INCLUDE 'acquisitions-menu.inc' %]

Lines 22-28 Acquisitions: Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/acquisitions.pref (-1 / +1 lines)
22	- Show baskets	22	- Show baskets
23	- pref: AcqViewBaskets	23	- pref: AcqViewBaskets
24	choices:	24	choices:
25	user: created by staff member.	25	user: created or managed by staff member.
26	branch: from staff member's library.	26	branch: from staff member's library.
27	all: in system, regardless of owner.	27	all: in system, regardless of owner.
28	-	28	-




#!/usr/bin/perl

use Modern::Perl;
use Test::MockModule;
use Test::More tests => 42;

use C4::Acquisition;

my $C4_Acquisition_module = new Test::MockModule('C4::Acquisition');
$C4_Acquisition_module->mock('GetBasketUsers', \&Mock_GetBasketUsers);
my $C4_Context_module = new Test::MockModule('C4::Context');
$C4_Context_module->mock('preference', \&Mock_preference);

my $AcqViewBaskets;
my %basketusers = (
    1 => [],
    2 => [1, 2],
    3 => [],
    4 => [1, 2],
);

# Borrowers
my $borrower1 = {
    borrowernumber => 1,
    branchcode => 'B1',
};

my $borrower2 = {
    borrowernumber => 2,
    branchcode => 'B2',
};

# Baskets
my $basket1 = {
    basketno => 1,
    authorisedby => 1
};

my $basket2 = {
    basketno => 2,
    authorisedby => 2,
};

my $basket3 = {
    basketno => 3,
    authorisedby => 3,
    branch => 'B1'
};

my $basket4 = {
    basketno => 4,
    authorisedby => 4,
    branch => 'B1'
};


my $flags = {
    acquisition => {
        order_manage => 1
    }
};

#################
# Start testing #
#################

# ----------------------
# AcqViewBaskets = 'all'
# ----------------------

$AcqViewBaskets = 'all';

# Simple cases where user can't manage basket
ok( not CanUserManageBasket($borrower1, $basket1, {}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => 0
}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage => 0
    }
}) );

# Simple cases where user can manage basket
ok( CanUserManageBasket($borrower1, $basket1, {
    superlibrarian => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage_all => 1
    }
}) );

ok( CanUserManageBasket($borrower1, $basket1, $flags) );
ok( CanUserManageBasket($borrower1, $basket2, $flags) );
ok( CanUserManageBasket($borrower1, $basket3, $flags) );
ok( CanUserManageBasket($borrower1, $basket4, $flags) );
ok( CanUserManageBasket($borrower2, $basket1, $flags) );
ok( CanUserManageBasket($borrower2, $basket2, $flags) );
ok( CanUserManageBasket($borrower2, $basket3, $flags) );
ok( CanUserManageBasket($borrower2, $basket4, $flags) );

# -------------------------
# AcqViewBaskets = 'branch'
# -------------------------

$AcqViewBaskets = 'branch';

# Simple cases where user can't manage basket
ok( not CanUserManageBasket($borrower1, $basket1, {}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => 0
}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage => 0
    }
}) );

# Simple cases where user can manage basket
ok( CanUserManageBasket($borrower1, $basket1, {
    superlibrarian => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage_all => 1
    }
}) );

ok( CanUserManageBasket($borrower1, $basket1, $flags) );
ok( CanUserManageBasket($borrower1, $basket2, $flags) );
ok( CanUserManageBasket($borrower1, $basket3, $flags) );
ok( CanUserManageBasket($borrower1, $basket4, $flags) );
ok( CanUserManageBasket($borrower2, $basket1, $flags) );
ok( CanUserManageBasket($borrower2, $basket2, $flags) );
# borrower2 is not on the same branch as basket3 and basket4
ok( not CanUserManageBasket($borrower2, $basket3, $flags) );
ok( not CanUserManageBasket($borrower2, $basket4, $flags) );

# -----------------------
# AcqViewBaskets = 'user'
# -----------------------

$AcqViewBaskets = 'user';

# Simple cases where user can't manage basket
ok( not CanUserManageBasket($borrower1, $basket1, {}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => 0
}) );
ok( not CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage => 0
    }
}) );

# Simple cases where user can manage basket
ok( CanUserManageBasket($borrower1, $basket1, {
    superlibrarian => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => 1
}) );
ok( CanUserManageBasket($borrower1, $basket1, {
    acquisition => {
        order_manage_all => 1
    }
}) );

ok( CanUserManageBasket($borrower1, $basket1, $flags) );
ok( CanUserManageBasket($borrower1, $basket2, $flags) );
# basket3 is not managed or created by borrower1
ok( not CanUserManageBasket($borrower1, $basket3, $flags) );
ok( CanUserManageBasket($borrower1, $basket4, $flags) );
# basket 1 is not managed or created by borrower2
ok( not CanUserManageBasket($borrower2, $basket1, $flags) );
ok( CanUserManageBasket($borrower2, $basket2, $flags) );
# basket 3 is not managed or created by borrower2
ok( not CanUserManageBasket($borrower2, $basket3, $flags) );
ok( CanUserManageBasket($borrower2, $basket4, $flags) );


# Mocked subs

# C4::Acquisition::GetBasketUsers
sub Mock_GetBasketUsers {
    my ($basketno) = @_;

    return @{ $basketusers{$basketno} };
}

# C4::Context->preference
sub Mock_preference {
    my ($self, $variable) = @_;
    if (lc($variable) eq 'acqviewbaskets') {
        return $AcqViewBaskets;
    }
}

Return to bug 7295

Lines 2563-2568 CREATE TABLE `aqbasket` ( Link Here

(-)a/installer/data/mysql/kohastructure.sql (+15 lines)
2563	`authorisedby` varchar(10) default NULL,	2563	`authorisedby` varchar(10) default NULL,
2564	`booksellerinvoicenumber` mediumtext,	2564	`booksellerinvoicenumber` mediumtext,
2565	`basketgroupid` int(11),	2565	`basketgroupid` int(11),
		2566	branch varchar(10) default NULL,
2566	PRIMARY KEY (`basketno`),	2567	PRIMARY KEY (`basketno`),
2567	KEY `booksellerid` (`booksellerid`),	2568	KEY `booksellerid` (`booksellerid`),
2568	KEY `basketgroupid` (`basketgroupid`),	2569	KEY `basketgroupid` (`basketgroupid`),
Lines 2570-2575 CREATE TABLE `aqbasket` ( Link Here
2570	CONSTRAINT `aqbasket_ibfk_1` FOREIGN KEY (`booksellerid`) REFERENCES `aqbooksellers` (`id`) ON UPDATE CASCADE,	2571	CONSTRAINT `aqbasket_ibfk_1` FOREIGN KEY (`booksellerid`) REFERENCES `aqbooksellers` (`id`) ON UPDATE CASCADE,
2571	CONSTRAINT `aqbasket_ibfk_2` FOREIGN KEY (`contractnumber`) REFERENCES `aqcontract` (`contractnumber`),	2572	CONSTRAINT `aqbasket_ibfk_2` FOREIGN KEY (`contractnumber`) REFERENCES `aqcontract` (`contractnumber`),
2572	CONSTRAINT `aqbasket_ibfk_3` FOREIGN KEY (`basketgroupid`) REFERENCES `aqbasketgroups` (`id`) ON UPDATE CASCADE	2573	CONSTRAINT `aqbasket_ibfk_3` FOREIGN KEY (`basketgroupid`) REFERENCES `aqbasketgroups` (`id`) ON UPDATE CASCADE
		2574	CONSTRAINT aqbasket_ibfk_4 FOREIGN KEY (branch) REFERENCES branches (branchcode) ON UPDATE CASCADE ON DELETE SET NULL,
		2575	) ENGINE=InnoDB DEFAULT CHARSET=utf8;
		2576
		2577	--
		2578	-- Table structure for table aqbasketusers
		2579	--
		2580
		2581	DROP TABLE IF EXISTS aqbasketusers;
		2582	CREATE TABLE aqbasketusers (
		2583	basketno int(11) NOT NULL,
		2584	borrowernumber int(11) NOT NULL,
		2585	PRIMARY KEY (basketno,borrowernumber),
		2586	CONSTRAINT aqbasketusers_ibfk_1 FOREIGN KEY (basketno) REFERENCES aqbasket (basketno) ON UPDATE CASCADE ON DELETE CASCADE,
		2587	CONSTRAINT aqbasketusers_ibfk_2 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber) ON UPDATE CASCADE ON DELETE CASCADE
2573	) ENGINE=InnoDB DEFAULT CHARSET=utf8;	2588	) ENGINE=InnoDB DEFAULT CHARSET=utf8;
2574		2589
2575	--	2590	--

Lines 5369-5374 if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) { Link Here

(-)a/installer/data/mysql/updatedatabase.pl (+33 lines)
5369	SetVersion($DBversion);	5369	SetVersion($DBversion);
5370	}	5370	}
5371		5371
		5372	$DBversion = "XXX";
		5373	if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
		5374	$dbh->do("
		5375	ALTER TABLE aqbasket ADD branch varchar(10) default NULL
		5376	");
		5377	$dbh->do("
		5378	ALTER TABLE aqbasket
		5379	ADD CONSTRAINT aqbasket_ibfk_4 FOREIGN KEY (branch)
		5380	REFERENCES branches (branchcode)
		5381	ON UPDATE CASCADE ON DELETE SET NULL
		5382	");
		5383	$dbh->do("
		5384	DROP TABLE IF EXISTS aqbasketusers
		5385	");
		5386	$dbh->do("
		5387	CREATE TABLE aqbasketusers (
		5388	basketno int(11) NOT NULL,
		5389	borrowernumber int(11) NOT NULL,
		5390	PRIMARY KEY (basketno,borrowernumber),
		5391	CONSTRAINT aqbasketusers_ibfk_1 FOREIGN KEY (basketno) REFERENCES aqbasket (basketno) ON DELETE CASCADE ON UPDATE CASCADE,
		5392	CONSTRAINT aqbasketusers_ibfk_2 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber) ON DELETE CASCADE ON UPDATE CASCADE
		5393	) ENGINE=InnoDB DEFAULT CHARSET=utf8;
		5394	");
		5395	$dbh->do("
		5396	INSERT INTO permissions (module_bit, code, description)
		5397	VALUES (11, 'order_manage_all', 'Manage all orders & baskets')
		5398	");
		5399
		5400	print "Upgrade to $DBversion done (Add branch and users list to baskets. "
		5401	. "New permission order_manage_all)\n";
		5402	SetVersion($DBversion);
		5403	}
		5404
5372		5405
5373	=head1 FUNCTIONS	5406	=head1 FUNCTIONS
5374		5407

Line 0 Link Here

(-)a/acqui/aqbasketuser_search.pl (+77 lines)
		1	#!/usr/bin/perl
		2
		3	# script to find a basket user
		4
		5	# Copyright 2012 BibLibre SARL
		6	#
		7	# This file is part of Koha.
		8	#
		9	# Koha is free software; you can redistribute it and/or modify it under the
		10	# terms of the GNU General Public License as published by the Free Software
		11	# Foundation; either version 2 of the License, or (at your option) any later
		12	# version.
		13	#
		14	# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
		15	# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
		16	# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
		17	#
		18	# You should have received a copy of the GNU General Public License along
		19	# with Koha; if not, write to the Free Software Foundation, Inc.,
		20	# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
		21
		22	use Modern::Perl;
		23
		24	use CGI;
		25	use C4::Auth;
		26	use C4::Output;
		27	use C4::Members;
		28
		29	my $input = new CGI;
		30
		31	my $dbh = C4::Context->dbh;
		32
		33	my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user(
		34	{ template_name => "acqui/aqbasketuser_search.tmpl",
		35	query => $input,
		36	type => "intranet",
		37	authnotrequired => 0,
		38	flagsrequired => { acquisition => 'order_manage' },
		39	}
		40	);
		41
		42	my $q = $input->param('q') \|\| '';
		43	my $op = $input->param('op') \|\| '';
		44
		45	if( $op eq "do_search" ) {
		46	my $results = C4::Members::Search( $q, "surname");
		47
		48	my @users_loop;
		49	my $nresults = 0;
		50	foreach my $res (@$results) {
		51	my $perms = haspermission( $res->{userid} );
		52	my $subperms = get_user_subpermissions( $res->{userid} );
		53
		54	if( $perms->{superlibrarian} == 1
		55	\|\| $perms->{acquisition} == 1
		56	\|\| $subperms->{acquisition}->{'order_manage'} ) {
		57	my %row = (
		58	borrowernumber => $res->{borrowernumber},
		59	cardnumber => $res->{cardnumber},
		60	surname => $res->{surname},
		61	firstname => $res->{firstname},
		62	categorycode => $res->{categorycode},
		63	branchcode => $res->{branchcode},
		64	);
65	push( @users_loop, \%row );
66	$nresults ++;
67	}
68	}
69
70	$template->param(
71	q => $q,
72	nresults => $nresults,
73	users_loop => \@users_loop,
74	);
75	}
76
77	output_html_with_http_headers( $input, $cookie, $template->output );

Lines 28-33 use C4::Output; Link Here

(-)a/acqui/basket.pl (-7 / +56 lines)
28	use CGI;	28	use CGI;
29	use C4::Acquisition;	29	use C4::Acquisition;
30	use C4::Budgets;	30	use C4::Budgets;
		31	use C4::Branch;
31	use C4::Bookseller qw( GetBookSellerFromId);	32	use C4::Bookseller qw( GetBookSellerFromId);
32	use C4::Debug;	33	use C4::Debug;
33	use C4::Biblio;	34	use C4::Biblio;
Lines 68-74 my $query = new CGI; Link Here
68	my $basketno = $query->param('basketno');	69	my $basketno = $query->param('basketno');
69	my $booksellerid = $query->param('booksellerid');	70	my $booksellerid = $query->param('booksellerid');
70		71
71	my ( $template, $loggedinuser, $cookie ) = get_template_and_user(	72	my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
72	{	73	{
73	template_name => "acqui/basket.tmpl",	74	template_name => "acqui/basket.tmpl",
74	query => $query,	75	query => $query,
Lines 80-92 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
80	);	81	);
81		82
82	my $basket = GetBasket($basketno);	83	my $basket = GetBasket($basketno);
		84	$booksellerid = $basket->{booksellerid} unless $booksellerid;
		85	my ($bookseller) = GetBookSellerFromId($booksellerid);
		86
		87	unless (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
		88	$template->param(
		89	cannot_manage_basket => 1,
		90	basketno => $basketno,
		91	basketname => $basket->{basketname},
		92	booksellerid => $booksellerid,
		93	name => $bookseller->{name}
		94	);
		95	output_html_with_http_headers $query, $cookie, $template->output;
		96	exit;
		97	}
83		98
84	# FIXME : what about the "discount" percentage?	99	# FIXME : what about the "discount" percentage?
85	# FIXME : the query->param('booksellerid') below is probably useless. The bookseller is always known from the basket	100	# FIXME : the query->param('booksellerid') below is probably useless. The bookseller is always known from the basket
86	# if no booksellerid in parameter, get it from basket	101	# if no booksellerid in parameter, get it from basket
87	# warn "=>".$basket->{booksellerid};	102	# warn "=>".$basket->{booksellerid};
88	$booksellerid = $basket->{booksellerid} unless $booksellerid;
89	my ($bookseller) = GetBookSellerFromId($booksellerid);
90	my $op = $query->param('op');	103	my $op = $query->param('op');
91	if (!defined $op) {	104	if (!defined $op) {
92	$op = q{};	105	$op = q{};
Lines 181-186 if ( $op eq 'delete_confirm' ) { Link Here
181	$basket->{closedate} = undef;	194	$basket->{closedate} = undef;
182	ModBasket($basket);	195	ModBasket($basket);
183	print $query->redirect('/cgi-bin/koha/acqui/basket.pl?basketno='.$basket->{'basketno'})	196	print $query->redirect('/cgi-bin/koha/acqui/basket.pl?basketno='.$basket->{'basketno'})
		197	} elsif ( $op eq 'mod_users' ) {
		198	my $basketusers_ids = $query->param('basketusers_ids');
		199	my @basketusers = split( /:/, $basketusers_ids );
		200	ModBasketUsers($basketno, @basketusers);
		201	print $query->redirect("/cgi-bin/koha/acqui/basket.pl?basketno=$basketno");
		202	exit;
		203	} elsif ( $op eq 'mod_branch' ) {
		204	my $branch = $query->param('branch');
		205	$branch = undef if(defined $branch and $branch eq '');
		206	ModBasket({
		207	basketno => $basket->{basketno},
		208	branch => $branch
		209	});
		210	print $query->redirect("/cgi-bin/koha/acqui/basket.pl?basketno=$basketno");
		211	exit;
184	} else {	212	} else {
185	# get librarian branch...	213	# get librarian branch...
186	if ( C4::Context->preference("IndependantBranches") ) {	214	if ( C4::Context->preference("IndependantBranches") ) {
Lines 196-201 if ( $op eq 'delete_confirm' ) { Link Here
196	}	224	}
197	}	225	}
198	}	226	}
		227	# get branches
		228	my $branches = C4::Branch::GetBranches;
		229	my @branches_loop;
		230	foreach my $branch (sort keys %$branches) {
		231	push @branches_loop, {
		232	branchcode => $branch,
		233	branchname => $branches->{$branch}->{branchname},
		234	selected => (defined $basket->{branch} and $branch eq $basket->{branch}) ? 1 : 0
		235	};
		236	}
		237
199	#if the basket is closed,and the user has the permission to edit basketgroups, display a list of basketgroups	238	#if the basket is closed,and the user has the permission to edit basketgroups, display a list of basketgroups
200	my $basketgroups;	239	my $basketgroups;
201	my $member = GetMember(borrowernumber => $loggedinuser);	240	my $member = GetMember(borrowernumber => $loggedinuser);
Lines 231-236 if ( $op eq 'delete_confirm' ) { Link Here
231	"loggedinuser: $loggedinuser; creationdate: %s; authorisedby: %s",	270	"loggedinuser: $loggedinuser; creationdate: %s; authorisedby: %s",
232	$basket->{creationdate}, $basket->{authorisedby};	271	$basket->{creationdate}, $basket->{authorisedby};
233		272
		273	my @basketusers_ids = GetBasketUsers($basketno);
		274	my @basketusers;
		275	foreach my $basketuser_id (@basketusers_ids) {
		276	my $basketuser = GetMember(borrowernumber => $basketuser_id);
		277	push @basketusers, $basketuser if $basketuser;
		278	}
		279
234	#to get active currency	280	#to get active currency
235	my $cur = GetCurrency();	281	my $cur = GetCurrency();
236		282
Lines 324-330 if ( $op eq 'delete_confirm' ) { Link Here
324	push @books_loop, \%line;	370	push @books_loop, \%line;
325	}	371	}
326		372
327	my $total_est_gste;	373	my $total_est_gste;
328	my $total_est_gsti;	374	my $total_est_gsti;
329	my $gist_est;	375	my $gist_est;
330	if ($gist){ # if we have GST	376	if ($gist){ # if we have GST
Lines 343-351 my $total_est_gste; Link Here
343	}	389	}
344	$gist_est = $gist_rrp - ( $gist_rrp * $discount );	390	$gist_est = $gist_rrp - ( $gist_rrp * $discount );
345	} else {	391	} else {
346	$total_rrp_gsti = $total_rrp;	392	$total_rrp_gsti = $total_rrp;
347	$total_est_gsti = $total_rrp_est;	393	$total_est_gsti = $total_rrp_est;
348	}	394	}
349		395
350	my $contract = &GetContract($basket->{contractnumber});	396	my $contract = &GetContract($basket->{contractnumber});
351	my @orders = GetOrders($basketno);	397	my @orders = GetOrders($basketno);
Lines 373-381 my $total_est_gste; Link Here
373	basketbooksellernote => $basket->{booksellernote},	419	basketbooksellernote => $basket->{booksellernote},
374	basketcontractno => $basket->{contractnumber},	420	basketcontractno => $basket->{contractnumber},
375	basketcontractname => $contract->{contractname},	421	basketcontractname => $contract->{contractname},
		422	branches_loop => \@branches_loop,
376	creationdate => $basket->{creationdate},	423	creationdate => $basket->{creationdate},
377	authorisedby => $basket->{authorisedby},	424	authorisedby => $basket->{authorisedby},
378	authorisedbyname => $basket->{authorisedbyname},	425	authorisedbyname => $basket->{authorisedbyname},
		426	basketusers_ids => join(':', @basketusers_ids),
		427	basketusers => \@basketusers,
379	closedate => $basket->{closedate},	428	closedate => $basket->{closedate},
380	estimateddeliverydate=> $estimateddeliverydate,	429	estimateddeliverydate=> $estimateddeliverydate,
381	active => $bookseller->{'active'},	430	active => $bookseller->{'active'},

Lines 56-68 use C4::Biblio; Link Here

(-)a/acqui/booksellers.pl (-22 / +4 lines)
56	use C4::Output;	56	use C4::Output;
57	use CGI;	57	use CGI;
58		58
59	use C4::Acquisition qw/ GetBasketsInfosByBookseller /;	59	use C4::Acquisition qw/ GetBasketsInfosByBookseller CanUserManageBasket /;
60	use C4::Bookseller qw/ GetBookSellerFromId GetBookSeller /;	60	use C4::Bookseller qw/ GetBookSellerFromId GetBookSeller /;
61	use C4::Members qw/GetMember/;	61	use C4::Members qw/GetMember/;
62	use C4::Context;	62	use C4::Context;
63		63
64	my $query = CGI->new;	64	my $query = CGI->new;
65	my ( $template, $loggedinuser, $cookie ) = get_template_and_user(	65	my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
66	{ template_name => 'acqui/booksellers.tmpl',	66	{ template_name => 'acqui/booksellers.tmpl',
67	query => $query,	67	query => $query,
68	type => 'intranet',	68	type => 'intranet',
Lines 96-106 if ($loggedinuser) { Link Here
96	$uid = GetMember( borrowernumber => $loggedinuser )->{userid};	96	$uid = GetMember( borrowernumber => $loggedinuser )->{userid};
97	}	97	}
98		98
99	my $userenv = C4::Context::userenv;
100	my $viewbaskets = C4::Context->preference('AcqViewBaskets');
101
102	my $userbranch = $userenv->{branch};
103
104	#build result page	99	#build result page
105	my $loop_suppliers = [];	100	my $loop_suppliers = [];
106		101
Lines 110-130 for my $vendor (@suppliers) { Link Here
110	my $loop_basket = [];	105	my $loop_basket = [];
111		106
112	for my $basket ( @{$baskets} ) {	107	for my $basket ( @{$baskets} ) {
113	my $authorisedby = $basket->{authorisedby};	108	if (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
114	my $basketbranch = ''; # set a blank branch to start with	109	my $member = GetMember( borrowernumber => $basket->{authorisedby} );
115	my $member = GetMember( borrowernumber => $authorisedby );
116	if ( $member ) {
117	$basketbranch = $member->{branchcode};
118	}
119
120	if ($userenv->{'flags'} & 1 \|\| #user is superlibrarian
121	(haspermission( $uid, { acquisition => q{*} } ) && #user has acq permissions and
122	($viewbaskets eq 'all' \|\| #user is allowed to see all baskets
123	($viewbaskets eq 'branch' && $authorisedby && $userbranch eq $basketbranch) \|\| #basket belongs to user's branch
124	($basket->{authorisedby} && $viewbaskets eq 'user' && $authorisedby == $loggedinuser) #user created this basket
125	)
126	)
127	) {
128	foreach (qw(total_items total_biblios expected_items)) {	110	foreach (qw(total_items total_biblios expected_items)) {
129	$basket->{$_} \|\|= 0;	111	$basket->{$_} \|\|= 0;
130	}	112	}

Line 0 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/aqbasketuser_search.tt (+79 lines)
		1	[% INCLUDE 'doc-head-open.inc' %]
		2	<title>Koha &rsaquo; Basket User Search</title>
		3	[% INCLUDE 'doc-head-close.inc' %]
		4
		5	<style type="text/css">
		6	#custom-doc {
		7	width:44.46em;
		8	*width:43.39em;
		9	min-width:578px;
		10	margin:auto;
		11	text-align:left;
		12	}
		13	</style>
		14
		15	<script type="text/javascript">
		16	//<![CDATA[
		17	// modify parent window owner element
		18	function add_user(borrowernumber, borrowername) {
		19	var p = window.opener;
		20	if(p.add_basket_user(borrowernumber, borrowername) < 0) {
		21	alert(_("Borrower '" + borrowername + "' is already in the list."));
		22	}
		23	}
		24	//]]>
		25	</script>
		26
		27	</head>
		28	<body>
		29	<div id="custom-doc" class="yui-t7">
		30	<div id="bd">
		31	<div class="yui-g">
		32
		33	<h3>Search for Basket User</h3>
		34	<form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
		35	<fieldset>
		36	<input type="hidden" name="op" id="op" value="do_search" />
		37	<input type="text" name="q" id="q" value="[% q %]" class="focus" />
		38	<input type="submit" class="button" value="Search" />
		39	</fieldset>
		40	<div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
		41	</form>
		42
		43	[% IF (q) %]
		44	<p>Searched for <span class="ex">[% q %]</span>, [% nresults %] patron(s) found.</p>
		45	[% END %]
		46	[% IF ( users_loop ) %]
		47	<table>
		48	<thead>
		49	<tr>
		50	<th>Cardnumber</th>
		51	<th>Name</th>
		52	<th>Branch</th>
		53	<th>Categorycode</th>
		54	<th>Select?</th>
		55	</tr>
		56	</thead>
		57	<tbody>
		58	[% FOREACH user IN users_loop %]
		59	[% IF ( user.toggle ) %]
		60	<tr>
		61	[% ELSE %]
		62	<tr class="highlight">
		63	[% END %]
		64	<td>[% user.cardnumber %]</td>
65	<td>[% user.surname %], [% user.firstname %]</td>
66	<td>[% user.branchcode %]</td>
67	<td>[% user.categorycode %]</td>
68	<td>
69	<a style="cursor:pointer" onclick="add_user('[% user.borrowernumber %]', '[% user.firstname %] [% user.surname %]');">Add</a>
70	</td>
71	</tr>
72	[% END %]
73	</table>
74	[% END %]
75
76	<div id="closewindow"><a href="#" class="close">Close</a></div>
77	</div>
78	</div>
79	[% INCLUDE 'intranet-bottom.inc' %]

Lines 79-87 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-2 / +79 lines)
79	"sPaginationType": "four_button"	79	"sPaginationType": "four_button"
80	} ) );	80	} ) );
81	} );	81	} );
		82
		83	function basketUserSearchPopup(f) {
		84	window.open(
		85	"/cgi-bin/koha/acqui/aqbasketuser_search.pl",
		86	'BasketUserSearchPopup',
		87	'width=740,height=450,toolbar=no,'
		88	);
		89	}
		90
		91	function add_basket_user(borrowernumber, borrowername) {
		92	var ids = $("#basketusers_ids").val();
		93	if(ids.length > 0) {
		94	ids = ids.split(':');
		95	} else {
		96	ids = new Array;
		97	}
		98	if (ids.indexOf(borrowernumber) < 0) {
		99	ids.push(borrowernumber);
		100	$("#basketusers_ids").val(ids.join(':'));
		101	var li = '<li id="user_'+borrowernumber+'">'+borrowername
		102	+ ' [<a style="cursor:pointer" onclick="del_basket_user('+borrowernumber+');">'
		103	+ _('Delete user') + '</a>]</li>';
		104	$("#basketusers_names").append(li);
		105	return 0;
		106	}
		107	return -1;
		108	}
		109
		110	function del_basket_user(borrowernumber) {
		111	$("#user_"+borrowernumber).remove();
		112	var ids = $("#basketusers_ids").val().split(':');
		113	ids.splice(ids.indexOf(borrowernumber.toString()), 1);
		114	$("#basketusers_ids").val(ids.join(':'));
		115	}
82	//]]>	116	//]]>
83	</script>	117	</script>
84
85	<style type="text/css">	118	<style type="text/css">
86	.sortmsg {font-size: 80%;}	119	.sortmsg {font-size: 80%;}
87	</style>	120	</style>
Lines 97-102 Link Here
97		130
98	<div id="bd">	131	<div id="bd">
99	<div id="yui-main">	132	<div id="yui-main">
		133	[% IF (cannot_manage_basket) %]
		134	<div class="yui-b">
		135	<p class="error">You are not authorised to manage this basket.</p>
		136	</div>
		137	[% ELSE %]
100	<div class="yui-b">	138	<div class="yui-b">
101	[% UNLESS ( confirm_close ) %]	139	[% UNLESS ( confirm_close ) %]
102	[% UNLESS ( selectbasketg ) %]	140	[% UNLESS ( selectbasketg ) %]
Lines 192-198 Link Here
192	[% IF ( basketcontractno ) %]	230	[% IF ( basketcontractno ) %]
193	<li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&contractnumber=[% basketcontractno %]&booksellerid=[% booksellerid %]">[% basketcontractname %]</a></li>	231	<li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&contractnumber=[% basketcontractno %]&booksellerid=[% booksellerid %]">[% basketcontractname %]</a></li>
194	[% END %]	232	[% END %]
195	[% IF ( authorisedbyname ) %]<li><span class="label">Managed by:</span> [% authorisedbyname %]</li>[% END %]	233	[% IF ( authorisedbyname ) %]<li><span class="label">Created by:</span> [% authorisedbyname %]</li>[% END %]
		234	<li>
		235	<form action="" method="post">
		236	<span class="label">Managed by:</span>
		237	<div style="float:left">
		238	<ul id="basketusers_names" style="padding-left:0">
		239	[% FOREACH user IN basketusers %]
		240	<li id="user_[% user.borrowernumber %]">
		241	[% user.firstname %] [% user.surname %]
		242	[<a onclick="del_basket_user([% user.borrowernumber %]);" style="cursor:pointer">Delete user</a>]
		243	</li>
		244	[% END %]
		245	</ul>
		246	<input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
		247	<input type="hidden" id="basketusers_ids" name="basketusers_ids" value="[% basketusers_ids %]" />
		248	<input type="hidden" id="op" name="op" value="mod_users" />
		249	<input type="button" id="add_user" onclick="basketUserSearchPopup();" value="Add user" />
		250	<input type="submit" value="Save changes" />
		251	</div>
		252	</form>
		253	</li>
		254	<li>
		255	<form action="" method="post">
		256	<span class="label">Branch:</span>
		257	<select id="branch" name="branch">
		258	<option value="">No branch</option>
		259	[% FOREACH branch IN branches_loop %]
		260	[% IF (branch.selected) %]
		261	<option selected="selected" value="[% branch.branchcode %]"> [% branch.branchname %]</option>
		262	[% ELSE %]
		263	<option value="[% branch.branchcode %]"> [% branch.branchname %]</option>
		264	[% END %]
		265	[% END %]
		266	</select>
		267	<input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
		268	<input type="hidden" id="op" name="op" value="mod_branch" />
		269	<input type="submit" value="Save" />
		270	</form>
		271	</li>
196	[% IF ( creationdate ) %]<li><span class="label">Opened on:</span> [% creationdate \| $KohaDates %]</li>[% END %]	272	[% IF ( creationdate ) %]<li><span class="label">Opened on:</span> [% creationdate \| $KohaDates %]</li>[% END %]
197	[% IF ( closedate ) %]<li><span class="label">Closed on:</span> [% closedate \| $KohaDates %]</li>[% END %]	273	[% IF ( closedate ) %]<li><span class="label">Closed on:</span> [% closedate \| $KohaDates %]</li>[% END %]
198	[% IF ( estimateddeliverydate ) %]<li><span class="label">Estimated delivery date:</span> [% estimateddeliverydate \| $KohaDates %]</li>[% END %]	274	[% IF ( estimateddeliverydate ) %]<li><span class="label">Estimated delivery date:</span> [% estimateddeliverydate \| $KohaDates %]</li>[% END %]
Lines 433-438 Link Here
433	</div>	509	</div>
434	[% END %]	510	[% END %]
435	</div>	511	</div>
		512	[% END %][%# IF (cannot_manage_basket) %]
436	</div>	513	</div>
437	<div class="yui-b">	514	<div class="yui-b">
438	[% INCLUDE 'acquisitions-menu.inc' %]	515	[% INCLUDE 'acquisitions-menu.inc' %]

Line 0 Link Here

(-)a/t/Acquisition/CanUserManageBasket.t (-1 / +204 lines)
0	-	1	#!/usr/bin/perl
		2
		3	use Modern::Perl;
		4	use Test::MockModule;
		5	use Test::More tests => 42;
		6
		7	use C4::Acquisition;
		8
		9	my $C4_Acquisition_module = new Test::MockModule('C4::Acquisition');
		10	$C4_Acquisition_module->mock('GetBasketUsers', \&Mock_GetBasketUsers);
		11	my $C4_Context_module = new Test::MockModule('C4::Context');
		12	$C4_Context_module->mock('preference', \&Mock_preference);
		13
		14	my $AcqViewBaskets;
		15	my %basketusers = (
		16	1 => [],
		17	2 => [1, 2],
		18	3 => [],
		19	4 => [1, 2],
		20	);
		21
		22	# Borrowers
		23	my $borrower1 = {
		24	borrowernumber => 1,
		25	branchcode => 'B1',
		26	};
		27
		28	my $borrower2 = {
		29	borrowernumber => 2,
		30	branchcode => 'B2',
		31	};
		32
		33	# Baskets
		34	my $basket1 = {
		35	basketno => 1,
		36	authorisedby => 1
		37	};
		38
		39	my $basket2 = {
		40	basketno => 2,
		41	authorisedby => 2,
		42	};
		43
		44	my $basket3 = {
		45	basketno => 3,
		46	authorisedby => 3,
		47	branch => 'B1'
		48	};
		49
		50	my $basket4 = {
		51	basketno => 4,
		52	authorisedby => 4,
		53	branch => 'B1'
		54	};
		55
		56
		57	my $flags = {
		58	acquisition => {
		59	order_manage => 1
		60	}
		61	};
		62
		63	#################
		64	# Start testing #
		65	#################
66
67	# ----------------------
68	# AcqViewBaskets = 'all'
69	# ----------------------
70
71	$AcqViewBaskets = 'all';
72
73	# Simple cases where user can't manage basket
74	ok( not CanUserManageBasket($borrower1, $basket1, {}) );
75	ok( not CanUserManageBasket($borrower1, $basket1, {
76	acquisition => 0
77	}) );
78	ok( not CanUserManageBasket($borrower1, $basket1, {
79	acquisition => {
80	order_manage => 0
81	}
82	}) );
83
84	# Simple cases where user can manage basket
85	ok( CanUserManageBasket($borrower1, $basket1, {
86	superlibrarian => 1
87	}) );
88	ok( CanUserManageBasket($borrower1, $basket1, {
89	acquisition => 1
90	}) );
91	ok( CanUserManageBasket($borrower1, $basket1, {
92	acquisition => {
93	order_manage_all => 1
94	}
95	}) );
96
97	ok( CanUserManageBasket($borrower1, $basket1, $flags) );
98	ok( CanUserManageBasket($borrower1, $basket2, $flags) );
99	ok( CanUserManageBasket($borrower1, $basket3, $flags) );
100	ok( CanUserManageBasket($borrower1, $basket4, $flags) );
101	ok( CanUserManageBasket($borrower2, $basket1, $flags) );
102	ok( CanUserManageBasket($borrower2, $basket2, $flags) );
103	ok( CanUserManageBasket($borrower2, $basket3, $flags) );
104	ok( CanUserManageBasket($borrower2, $basket4, $flags) );
105
106	# -------------------------
107	# AcqViewBaskets = 'branch'
108	# -------------------------
109
110	$AcqViewBaskets = 'branch';
111
112	# Simple cases where user can't manage basket
113	ok( not CanUserManageBasket($borrower1, $basket1, {}) );
114	ok( not CanUserManageBasket($borrower1, $basket1, {
115	acquisition => 0
116	}) );
117	ok( not CanUserManageBasket($borrower1, $basket1, {
118	acquisition => {
119	order_manage => 0
120	}
121	}) );
122
123	# Simple cases where user can manage basket
124	ok( CanUserManageBasket($borrower1, $basket1, {
125	superlibrarian => 1
126	}) );
127	ok( CanUserManageBasket($borrower1, $basket1, {
128	acquisition => 1
129	}) );
130	ok( CanUserManageBasket($borrower1, $basket1, {
131	acquisition => {
132	order_manage_all => 1
133	}
134	}) );
135
136	ok( CanUserManageBasket($borrower1, $basket1, $flags) );
137	ok( CanUserManageBasket($borrower1, $basket2, $flags) );
138	ok( CanUserManageBasket($borrower1, $basket3, $flags) );
139	ok( CanUserManageBasket($borrower1, $basket4, $flags) );
140	ok( CanUserManageBasket($borrower2, $basket1, $flags) );
141	ok( CanUserManageBasket($borrower2, $basket2, $flags) );
142	# borrower2 is not on the same branch as basket3 and basket4
143	ok( not CanUserManageBasket($borrower2, $basket3, $flags) );
144	ok( not CanUserManageBasket($borrower2, $basket4, $flags) );
145
146	# -----------------------
147	# AcqViewBaskets = 'user'
148	# -----------------------
149
150	$AcqViewBaskets = 'user';
151
152	# Simple cases where user can't manage basket
153	ok( not CanUserManageBasket($borrower1, $basket1, {}) );
154	ok( not CanUserManageBasket($borrower1, $basket1, {
155	acquisition => 0
156	}) );
157	ok( not CanUserManageBasket($borrower1, $basket1, {
158	acquisition => {
159	order_manage => 0
160	}
161	}) );
162
163	# Simple cases where user can manage basket
164	ok( CanUserManageBasket($borrower1, $basket1, {
165	superlibrarian => 1
166	}) );
167	ok( CanUserManageBasket($borrower1, $basket1, {
168	acquisition => 1
169	}) );
170	ok( CanUserManageBasket($borrower1, $basket1, {
171	acquisition => {
172	order_manage_all => 1
173	}
174	}) );
175
176	ok( CanUserManageBasket($borrower1, $basket1, $flags) );
177	ok( CanUserManageBasket($borrower1, $basket2, $flags) );
178	# basket3 is not managed or created by borrower1
179	ok( not CanUserManageBasket($borrower1, $basket3, $flags) );
180	ok( CanUserManageBasket($borrower1, $basket4, $flags) );
181	# basket 1 is not managed or created by borrower2
182	ok( not CanUserManageBasket($borrower2, $basket1, $flags) );
183	ok( CanUserManageBasket($borrower2, $basket2, $flags) );
184	# basket 3 is not managed or created by borrower2
185	ok( not CanUserManageBasket($borrower2, $basket3, $flags) );
186	ok( CanUserManageBasket($borrower2, $basket4, $flags) );
187
188
189	# Mocked subs
190
191	# C4::Acquisition::GetBasketUsers
192	sub Mock_GetBasketUsers {
193	my ($basketno) = @_;
194
195	return @{ $basketusers{$basketno} };
196	}
197
198	# C4::Context->preference
199	sub Mock_preference {
200	my ($self, $variable) = @_;
201	if (lc($variable) eq 'acqviewbaskets') {
202	return $AcqViewBaskets;
203	}
204	}