Attachment #122033 for bug #26346

View | Details | Raw Unified | Return to bug 26346
Collapse All | Expand All




    return \%return;
}

=head3 can_patron_change_staff_only_lists

$patron->can_patron_change_staff_only_lists;

Return 1 if a patron has 'Superlibrarian' or 'Catalogue' permission.
Otherwise, return 0.

=cut

sub can_patron_change_staff_only_lists {
    my ( $self, $params ) = @_;
    return 1 if C4::Auth::haspermission( $self->userid, { 'catalogue' => 1 });
    return 0;
}

=head2 Internal methods

=head3 _type




  is_auto_increment: 1
  is_nullable: 0

primary key identifier

=head2 module

  data_type: 'varchar'

);


# Created by DBIx::Class::Schema::Loader v0.07046 @ 2021-04-09 22:58:34
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:2QkUwMWgZ9WfOk9Ngf7yFA

sub koha_object_class {
    'Koha::Notice::Template';

Lines 97-102 can owner change contents? Link Here

(-)a/Koha/Schema/Result/Virtualshelve.pm (-2 / +10 lines)
97		97
98	can others change contents?	98	can others change contents?
99		99
		100	=head2 allow_change_from_staff
		101
		102	data_type: 'tinyint'
		103	default_value: 0
		104	is_nullable: 1
		105
100	=cut	106	=cut
101		107
102	__PACKAGE__->add_columns(	108	__PACKAGE__->add_columns(
Lines 132-137 __PACKAGE__->add_columns( Link Here
132	{ data_type => "tinyint", default_value => 1, is_nullable => 1 },	138	{ data_type => "tinyint", default_value => 1, is_nullable => 1 },
133	"allow_change_from_others",	139	"allow_change_from_others",
134	{ data_type => "tinyint", default_value => 0, is_nullable => 1 },	140	{ data_type => "tinyint", default_value => 0, is_nullable => 1 },
		141	"allow_change_from_staff",
		142	{ data_type => "tinyint", default_value => 0, is_nullable => 1 },
135	);	143	);
136		144
137	=head1 PRIMARY KEY	145	=head1 PRIMARY KEY
Lines 199-206 __PACKAGE__->has_many( Link Here
199	);	207	);
200		208
201		209
202	# Created by DBIx::Class::Schema::Loader v0.07049 @ 2021-01-21 13:39:29	210	# Created by DBIx::Class::Schema::Loader v0.07046 @ 2021-04-09 23:02:21
203	# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:6ZQ6kL/0DzyOMymz+4+LhA	211	# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:4FyGa/O1QtVe1t5ih9PK5A
204		212
205	sub koha_object_class {	213	sub koha_object_class {
206	'Koha::Virtualshelf';	214	'Koha::Virtualshelf';

Lines 64-69 sub store { Link Here

(-)a/Koha/Virtualshelf.pm (-4 / +6 lines)
64	unless defined $self->allow_change_from_owner;	64	unless defined $self->allow_change_from_owner;
65	$self->allow_change_from_others( 0 )	65	$self->allow_change_from_others( 0 )
66	unless defined $self->allow_change_from_others;	66	unless defined $self->allow_change_from_others;
		67	$self->allow_change_from_staff( 0 )
		68	unless defined $self->allow_change_from_staff;
67		69
68	$self->created_on( dt_from_string )	70	$self->created_on( dt_from_string )
69	unless defined $self->created_on;	71	unless defined $self->created_on;
Lines 185-191 sub add_biblio { Link Here
185	return if $already_exists;	187	return if $already_exists;
186		188
187	# Check permissions	189	# Check permissions
188	return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) \|\| $self->allow_change_from_others;	190	return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) \|\| ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) \|\| $self->allow_change_from_others;
189		191
190	my $content = Koha::Virtualshelfcontent->new(	192	my $content = Koha::Virtualshelfcontent->new(
191	{	193	{
Lines 208-213 sub remove_biblios { Link Here
208		210
209	my $number_removed = 0;	211	my $number_removed = 0;
210	if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )	212	if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )
		213	\|\| ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists )
211	\|\| $self->allow_change_from_others ) {	214	\|\| $self->allow_change_from_others ) {
212	$number_removed += $self->get_contents->search({	215	$number_removed += $self->get_contents->search({
213	biblionumber => $biblionumbers,	216	biblionumber => $biblionumbers,
Lines 236-242 sub can_be_deleted { Link Here
236		239
237	my $patron = Koha::Patrons->find( $borrowernumber );	240	my $patron = Koha::Patrons->find( $borrowernumber );
238		241
239	return 1 if $self->is_public and C4::Auth::haspermission( $patron->userid, { lists => 'delete_public_lists' } );	242	return 1 if $self->is_public and haspermission( $patron->userid, { lists => 'delete_public_lists' } );
240		243
241	return 0;	244	return 0;
242	}	245	}
Lines 253-259 sub can_biblios_be_added { Link Here
253		256
254	return 1	257	return 1
255	if $borrowernumber	258	if $borrowernumber
256	and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or $self->allow_change_from_others );	259	and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );
257	return 0;	260	return 0;
258	}	261	}
259		262
Lines 267-270 sub _type { Link Here
267	return 'Virtualshelve';	270	return 'Virtualshelve';
268	}	271	}
269		272
270	1;

Lines 23-28 use Koha::Database; Link Here

(-)a/Koha/Virtualshelves.pm (-10 / +26 lines)
23		23
24	use Koha::Virtualshelf;	24	use Koha::Virtualshelf;
25		25
		26	use C4::Auth;
		27
26	use base qw(Koha::Objects);	28	use base qw(Koha::Objects);
27		29
28	=head1 NAME	30	=head1 NAME
Lines 88-103 sub get_some_shelves { Link Here
88		90
89	my @conditions;	91	my @conditions;
90	if ( $add_allowed ) {	92	if ( $add_allowed ) {
91	push @conditions, {	93	if ( Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) {
92	-or =>	94	push @conditions, {
93	[	95	-or =>
94	{	96	[
95	"me.owner" => $borrowernumber,	97	{
96	"me.allow_change_from_owner" => 1,	98	"me.owner" => $borrowernumber,
97	},	99	"me.allow_change_from_owner" => 1,
98	"me.allow_change_from_others" => 1,	100	},
99	]	101	"me.allow_change_from_others" => 1,
100	};	102	"me.allow_change_from_staff" => 1
		103	]
		104	};
		105	} else {
		106	push @conditions, {
		107	-or =>
		108	[
		109	{
		110	"me.owner" => $borrowernumber,
		111	"me.allow_change_from_owner" => 1,
		112	},
		113	"me.allow_change_from_others" => 1,
		114	]
		115	};
		116	}
101	}	117	}
102	if ( $category == 1 ) {	118	if ( $category == 1 ) {
103	push @conditions, {	119	push @conditions, {

Line 0 Link Here

(-)a/installer/data/mysql/atomicupdate/bug_26346.perl (+7 lines)
	1	$DBversion = 'XXX';
	2	if ( CheckVersion($DBversion) ) {
	3	if ( !column_exists( 'virtualshelves', 'allow_change_from_staff' ) ) {
	4	$dbh->do(q{ALTER TABLE virtualshelves ADD COLUMN `allow_change_from_staff` tinyint(1) DEFAULT '0'});
	5	}
	6	NewVersion( $DBversion, 26346, "Add allow_change_from_staff to virtualshelves table" );
	7	}

Lines 35-42 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt (-2 / +16 lines)
35		35
36	[% IF shelf.allow_change_from_others %]<option value="2" selected="selected">Anyone seeing this list</option>[% ELSE %]<option value="2">Anyone seeing this list</option>[% END %]	36	[% IF shelf.allow_change_from_others %]<option value="2" selected="selected">Anyone seeing this list</option>[% ELSE %]<option value="2">Anyone seeing this list</option>[% END %]
37		37
		38	[% IF shelf.allow_change_from_staff %]<option value="3" selected="selected">Staff only</option>[% ELSE %]<option value="3">Staff only</option>[% END %]
		39
38	</select>	40	</select>
39	&emsp; <span id="anyone_remark" style="display:none;color:red;">The Anyone permission has no actual effect while this list is strictly private.</span>	41	&emsp; <span id="anyone_remark" style="display:none;color:red;">The Anyone permission has no actual effect while this list is strictly private.</span>
		42	&emsp; <span id="staff_remark" style="display:none;color:red;">The Staff only permission has no actual effect while this list is strictly private.</span>
40	</li>	43	</li>
41	[% END %]	44	[% END %]
42	</head>	45	</head>
Lines 809-824 Link Here
809		812
810	if( perms < 2 ) {	813	if( perms < 2 ) {
811	$("#anyone_remark").hide();	814	$("#anyone_remark").hide();
		815	$("#staff_remark").hide();
812	} else if( category==1 ) {	816	} else if( category==1 ) {
813	// If we move to Private (without shares), show Anyone remark	817	// If we move to Private (without shares), show either:
		818	// Anyone remark if Anyone can change the list
		819	// Or Staff remark is Staff only can change the list
814	// Note: the number of shares is not tested real-time	820	// Note: the number of shares is not tested real-time
815	[% IF !shelf.is_shared %]	821	[% IF !shelf.is_shared %]
816	$("#anyone_remark").show();	822	if( perms== 2) {
		823	$("#anyone_remark").show();
		824	$("#staff_remark").hide();
		825	} else if ( perms==3 ) {
		826	$("#anyone_remark").hide();
		827	$("#staff_remark").show();
		828	}
817	[% ELSE %]	829	[% ELSE %]
818	$("#anyone_remark").hide();	830	$("#anyone_remark").hide();
		831	$("#staff_remark").hide();
819	[% END %]	832	[% END %]
820	} else { // category==2	833	} else { // category==2
821	$("#anyone_remark").hide();	834	$("#anyone_remark").hide();
		835	$("#staff_remark").hide();
822	}	836	}
823	}	837	}
824	[% IF op == 'view' %]	838	[% IF op == 'view' %]

Lines 51-58 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt (-2 / +16 lines)
51		51
52	[% IF shelf.allow_change_from_others %]<option value="2" selected="selected">Anyone seeing this list</option>[% ELSE %]<option value="2">Anyone seeing this list</option>[% END %]	52	[% IF shelf.allow_change_from_others %]<option value="2" selected="selected">Anyone seeing this list</option>[% ELSE %]<option value="2">Anyone seeing this list</option>[% END %]
53		53
		54	[% IF staffuser == 1 %][% IF shelf.allow_change_from_staff %]<option value="3" selected="selected">Staff only</option>[% ELSE %]<option value="3">Staff only</option>[% END %][% END %]
		55
54	</select>	56	</select>
55	&emsp; <span id="anyone_remark" style="display:none;color:red;">The "Anyone" permission has no actual effect while this list is strictly private.</span>	57	&emsp; <span id="anyone_remark" style="display:none;color:red;">The "Anyone" permission has no actual effect while this list is strictly private.</span>
		58	&emsp; <span id="staff_remark" style="display:none;color:red;">The "Staff only" permission has no actual effect while this list is strictly private.</span>
56	</li>	59	</li>
57	[% END %]	60	[% END %]
58		61
Lines 1102-1117 function AdjustRemark() { Link Here
1102		1105
1103	if( perms < 2 ) {	1106	if( perms < 2 ) {
1104	$("#anyone_remark").hide();	1107	$("#anyone_remark").hide();
		1108	$("#staff_remark").hide();
1105	} else if( category==1 ) {	1109	} else if( category==1 ) {
1106	// If we move to Private (without shares), show Anyone remark	1110	// If we move to Private (without shares), show one of the following:
		1111	// Anyone remark, if anyone can change the list
		1112	// Staff remark, if only Staff can change the list
1107	// Note: the number of shares is not tested real-time	1113	// Note: the number of shares is not tested real-time
1108	[% IF !shelf.is_shared %]	1114	[% IF !shelf.is_shared %]
1109	$("#anyone_remark").show();	1115	if ( perms==2 ) {
		1116	$("#anyone_remark").show();
		1117	$("#staff_remark").hide();
		1118	} else if ( perms==3 ) {
		1119	$("#anyone_remark").hide();
		1120	$("#staff_remark").show();
		1121	}
1110	[% ELSE %]	1122	[% ELSE %]
1111	$("#anyone_remark").hide();	1123	$("#anyone_remark").hide();
		1124	$("#staff_remark").hide();
1112	[% END %]	1125	[% END %]
1113	} else { // category==2	1126	} else { // category==2
1114	$("#anyone_remark").hide();	1127	$("#anyone_remark").hide();
		1128	$("#staff_remark").hide();
1115	}	1129	}
1116	}	1130	}
1117	</script>	1131	</script>




            },
            { join => 'virtualshelfshares', }
        );
        my $public_shelves;
        if ( $loggedinuser ) {
            if ( Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists ) {
                $public_shelves = Koha::Virtualshelves->search(
                    {   category => 2,
                        -or      => [
                            -and => {
                                allow_change_from_owner => 1,
                                owner     => $loggedinuser,
                            },
                            allow_change_from_others => 1,
                            allow_change_from_staff  => 1
                        ],
                    },
                    { order_by => 'shelfname' }
                );
            } else {
                $public_shelves = Koha::Virtualshelves->search(
                    {   category => 2,
                        -or      => [
                            -and => {
                                allow_change_from_owner => 1,
                                owner => $loggedinuser,
                            },
                            allow_change_from_others => 1,
                        ],
                    },
                    {order_by => 'shelfname' }
                );
            }
        } else {
            $public_shelves = Koha::Virtualshelves->search(
                {   category => 2,
                    -or      => [
                        -and => {
                            allow_change_from_owner => 1,
                            owner => $loggedinuser,
                        },
                        allow_change_from_others => 1,
                    ],
                },
                {order_by => 'shelfname' }
            );
        }

        $template->param(
            private_shelves                => $private_shelves,
            private_shelves_shared_with_me => $shelves_shared_with_me,




use Koha::RecordProcessor;

use constant ANYONE => 2;
use constant STAFF => 3;

my $query = CGI->new;


                    category           => scalar $query->param('category') || 1,
                    allow_change_from_owner => $allow_changes_from > 0,
                    allow_change_from_others => $allow_changes_from == ANYONE,
                    allow_change_from_staff => $allow_changes_from == STAFF,
                    owner              => scalar $loggedinuser,
                }
            );

            my $allow_changes_from = $query->param('allow_changes_from');
            $shelf->allow_change_from_owner( $allow_changes_from > 0 );
            $shelf->allow_change_from_others( $allow_changes_from == ANYONE );
            $shelf->allow_change_from_staff( $allow_changes_from == STAFF );
            $shelf->category( scalar $query->param('category') );
            eval { $shelf->store };


        ),
    );
}
my $staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;
$template->param(
    op       => $op,
    referer  => $referer,

    category => ($category == 1 || $category == 2) ? $category : "",
    print    => scalar $query->param('print') || 0,
    listsview => 1,
    staffuser => $staffuser,
);

my $content_type = $query->param('rss')? 'rss' : 'html';





use Modern::Perl;

use Test::More tests => 9;
use Test::Exception;
use Test::Warn;



    $schema->storage->txn_rollback;
};

subtest 'can_patron_change_staff_only_lists() tests' => sub {

    plan tests => 3;

    $schema->storage->txn_begin;

    # make a user with no special permissions
    my $patron = $builder->build_object(
        {
            class => 'Koha::Patrons',
            value => {
                flags => undef
            }
        }
    );
    is( $patron->can_patron_change_staff_only_lists(), 0, 'Patron without permissions cannot change staff only lists');

    # make it a 'Catalogue' permission
    $patron->set({ flags => 4 })->store->discard_changes;
    is( $patron->can_patron_change_staff_only_lists(), 1, 'Catalogue patron can change staff only lists');


    # make it a superlibrarian
    $patron->set({ flags => 1 })->store->discard_changes;
    is( $patron->can_patron_change_staff_only_lists(), 1, 'Superlibrarian patron can change staff only lists');

    $schema->storage->txn_rollback;
};




teardown();

subtest 'CRUD' => sub {
    plan tests => 14;
    my $patron = $builder->build({
        source => 'Borrower',
    });

    is( $number_of_shelves, 1, '1 shelf should have been inserted' );
    is( $shelf->allow_change_from_owner, 1, 'The default value for allow_change_from_owner should be 1' );
    is( $shelf->allow_change_from_others, 0, 'The default value for allow_change_from_others should be 0' );
    is ( $shelf->allow_change_from_staff, 0, 'The default value for allow_change_from_staff should be 0');
    is( t::lib::Dates::compare( $shelf->created_on, dt_from_string), 0, 'The creation time should have been set to today' );

    # Test if creation date will not be overwritten by store


subtest 'Shelf content' => sub {

    plan tests => 21;
    my $patron1 = $builder->build( { source => 'Borrower', } );
    my $patron2 = $builder->build( { source => 'Borrower', } );
    my $patron3 = $builder->build( { source => 'Borrower', value => {flags => 1} });
    my $biblio1 = $builder->build_sample_biblio;
    my $biblio2 = $builder->build_sample_biblio;
    my $biblio3 = $builder->build_sample_biblio;

    $number_of_contents = Koha::Virtualshelfcontents->search->count;
    is( $number_of_contents, 3, 'Back to three entries' );

    # allow_change_from_staff == 1 and allow_change_from_others == 0
    $shelf->allow_change_from_staff( 1 );
    $shelf->allow_change_from_others( 0 );
    $content4 = $shelf->add_biblio( $biblio3->biblionumber, $patron3->{borrowernumber} );
    $number_of_contents = Koha::Virtualshelfcontents->search->count;
    is( $number_of_contents, 4, 'The biblio should have been added to the shelf by patron 2');
    $number_of_deleted_biblios = $shelf->remove_biblios( { biblionumbers => [ $biblio3->biblionumber ], borrowernumber => $patron3->{borrowernumber} } );
    is( $number_of_deleted_biblios, 1, 'Biblio 3 deleted by patron 2' );
    $number_of_contents = Koha::Virtualshelfcontents->search->count;
    is( $number_of_contents, 3, 'Back to three entries' );

    teardown();
};

subtest 'Shelf permissions' => sub {

    plan tests => 70;
    my $patron1 = $builder->build( { source => 'Borrower', value => { flags => '2096766' } } ); # 2096766 is everything checked but not superlibrarian
    my $patron2 = $builder->build( { source => 'Borrower', value => { flags => '1048190' } } ); # 1048190 is everything checked but not superlibrarian and delete_public_lists
    my $patron3 = $builder->build( { source => 'Borrower', value => { flags => '0' } } ); # this is a patron with no special permissions
    my $biblio1 = $builder->build_sample_biblio;
    my $biblio2 = $builder->build_sample_biblio;
    my $biblio3 = $builder->build_sample_biblio;
    my $biblio4 = $builder->build_sample_biblio;
    my $biblio5 = $builder->build_sample_biblio;

    my $public_shelf = Koha::Virtualshelf->new(
        {   shelfname    => "my first shelf",

            category     => 2,
            allow_change_from_owner => 0,
            allow_change_from_others => 0,
            allow_change_from_staff => 0,
        }
    )->store;

    is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );
    is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by another staff member');
    is( $public_shelf->can_be_viewed( $patron3->{borrowernumber} ), 1, 'Public list should be viewed by someone with no special permissions' );

    is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
    is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by another staff member' );
    is( $public_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Public list should not be deleted by someone with no special permissions' );

    is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
    is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by another staff member' );
    is( $public_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Public list should not be managed by someone with no special permissions' );

    is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );
    is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by another staff member' );
    is( $public_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Public list should not be modified (add) by someone with no special permissions' );

    is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );
    is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by another staff member' );
    is ( $public_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Public list should not be modified (removed) by someone with no special permissions' );


    $public_shelf->allow_change_from_owner(1);
    $public_shelf->store;

    is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );
    is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by staff member' );
    is( $public_shelf->can_be_viewed( $patron3->{borrowernumber} ), 1, 'Public list should be viewed by someone with no special permissions' );

    is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
    is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by another staff member' );
    is( $public_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Public list should not be deleted by someone with no special permissions' );

    is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
    is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by another staff member' );
    is( $public_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Public list should not be managed by someone with no special permissions' );

    is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );
    is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by another staff member' );
    is( $public_shelf->can_biblios_be_added( $patron3->{borrowerbumber} ), 0, 'Public list should not be modified (add) by someone with no special permissions' );

    is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );
    is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by another staff member' );
    is( $public_shelf->can_biblios_be_removed( $patron3->{borroernumber} ), 0, 'Public list should not be modified (remove) by someone with no special permissions' );


    my $private_shelf = Koha::Virtualshelf->new(

            category     => 1,
            allow_change_from_owner => 0,
            allow_change_from_others => 0,
            allow_change_from_staff => 0,
        }
    )->store;

    is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );
    is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
    is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );

    is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
    is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
    is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );

    is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
    is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
    is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );

    is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );
    is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (add) by another staff member' );
    is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );

    is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );
    is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (remove) by another staff member' );
    is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );

    $private_shelf->allow_change_from_owner(1);
    $private_shelf->allow_change_from_staff(1);
    $private_shelf->allow_change_from_others(0);
    $private_shelf->store;
    is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );
    is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
    is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );

    is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
    is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
    is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );

    is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
    is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
    is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );

    is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );
    is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list could be modified (add) by another staff member # individual check done later' );
    is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list could be modified (add) by someone with no special permissions' );

    is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );
    is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list could be modified (remove) by another staff member # individual check done later' );
    is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list could be modified (remove) by someone with no special permissions' );

    $private_shelf->allow_change_from_owner(1);
    $private_shelf->allow_change_from_others(1);




use Koha::Virtualshelves;

use constant ANYONE => 2;
use constant STAFF  => 3;

my $query = CGI->new;


                category           => scalar $query->param('category'),
                allow_change_from_owner => $allow_changes_from > 0,
                allow_change_from_others => $allow_changes_from == ANYONE,
                allow_change_from_staff => $allow_changes_from == STAFF,
                owner              => scalar $query->param('owner'),
            }
        );

            my $allow_changes_from = $query->param('allow_changes_from');
            $shelf->allow_change_from_owner( $allow_changes_from > 0 );
            $shelf->allow_change_from_others( $allow_changes_from == ANYONE );
            $shelf->allow_change_from_staff( $allow_changes_from == STAFF );
            $shelf->category( scalar $query->param('category') );
            eval { $shelf->store };

- 

Return to bug 26346

Lines 1918-1923 sub queue_notice { Link Here

(-)a/Koha/Patron.pm (+15 lines)
1918	return \%return;	1918	return \%return;
1919	}	1919	}
1920		1920
		1921	=head3 can_patron_change_staff_only_lists
		1922
		1923	$patron->can_patron_change_staff_only_lists;
		1924
		1925	Return 1 if a patron has 'Superlibrarian' or 'Catalogue' permission.
		1926	Otherwise, return 0.
		1927
		1928	=cut
		1929
		1930	sub can_patron_change_staff_only_lists {
		1931	my ( $self, $params ) = @_;
		1932	return 1 if C4::Auth::haspermission( $self->userid, { 'catalogue' => 1 });
		1933	return 0;
		1934	}
		1935
1921	=head2 Internal methods	1936	=head2 Internal methods
1922		1937
1923	=head3 _type	1938	=head3 _type

Lines 29-36 __PACKAGE__->table("letter"); Link Here

(-)a/Koha/Schema/Result/Letter.pm (-4 / +2 lines)
29	is_auto_increment: 1	29	is_auto_increment: 1
30	is_nullable: 0	30	is_nullable: 0
31		31
32	primary key identifier
33
34	=head2 module	32	=head2 module
35		33
36	data_type: 'varchar'	34	data_type: 'varchar'
Lines 217-224 __PACKAGE__->belongs_to( Link Here
217	);	215	);
218		216
219		217
220	# Created by DBIx::Class::Schema::Loader v0.07046 @ 2021-02-11 12:33:50	218	# Created by DBIx::Class::Schema::Loader v0.07046 @ 2021-04-09 22:58:34
221	# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:qqdTVEicMu5rHppY5qsEuA	219	# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:2QkUwMWgZ9WfOk9Ngf7yFA
222		220
223	sub koha_object_class {	221	sub koha_object_class {
224	'Koha::Notice::Template';	222	'Koha::Notice::Template';

Lines 118-135 if ($newvirtualshelf) { Link Here

(-)a/opac/opac-addbybiblionumber.pl (-11 / +44 lines)
118	},	118	},
119	{ join => 'virtualshelfshares', }	119	{ join => 'virtualshelfshares', }
120	);	120	);
121	my $public_shelves = Koha::Virtualshelves->search(	121	my $public_shelves;
122	{ category => 2,	122	if ( $loggedinuser ) {
123	-or => [	123	if ( Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists ) {
124	-and => {	124	$public_shelves = Koha::Virtualshelves->search(
125	allow_change_from_owner => 1,	125	{ category => 2,
126	owner => $loggedinuser,	126	-or => [
		127	-and => {
		128	allow_change_from_owner => 1,
		129	owner => $loggedinuser,
		130	},
		131	allow_change_from_others => 1,
		132	allow_change_from_staff => 1
		133	],
127	},	134	},
128	allow_change_from_others => 1,	135	{ order_by => 'shelfname' }
129	],	136	);
130	},	137	} else {
131	{ order_by => 'shelfname' }	138	$public_shelves = Koha::Virtualshelves->search(
132	);	139	{ category => 2,
		140	-or => [
		141	-and => {
		142	allow_change_from_owner => 1,
		143	owner => $loggedinuser,
		144	},
		145	allow_change_from_others => 1,
		146	],
		147	},
		148	{order_by => 'shelfname' }
		149	);
		150	}
		151	} else {
		152	$public_shelves = Koha::Virtualshelves->search(
		153	{ category => 2,
		154	-or => [
		155	-and => {
		156	allow_change_from_owner => 1,
		157	owner => $loggedinuser,
		158	},
		159	allow_change_from_others => 1,
		160	],
		161	},
		162	{order_by => 'shelfname' }
		163	);
		164	}
		165
133	$template->param(	166	$template->param(
134	private_shelves => $private_shelves,	167	private_shelves => $private_shelves,
135	private_shelves_shared_with_me => $shelves_shared_with_me,	168	private_shelves_shared_with_me => $shelves_shared_with_me,

Lines 41-46 use Koha::Virtualshelves; Link Here

(-)a/opac/opac-shelves.pl (-1 / +5 lines)
41	use Koha::RecordProcessor;	41	use Koha::RecordProcessor;
42		42
43	use constant ANYONE => 2;	43	use constant ANYONE => 2;
		44	use constant STAFF => 3;
44		45
45	my $query = CGI->new;	46	my $query = CGI->new;
46		47
Lines 110-115 if ( $op eq 'add_form' ) { Link Here
110	category => scalar $query->param('category') \|\| 1,	111	category => scalar $query->param('category') \|\| 1,
111	allow_change_from_owner => $allow_changes_from > 0,	112	allow_change_from_owner => $allow_changes_from > 0,
112	allow_change_from_others => $allow_changes_from == ANYONE,	113	allow_change_from_others => $allow_changes_from == ANYONE,
		114	allow_change_from_staff => $allow_changes_from == STAFF,
113	owner => scalar $loggedinuser,	115	owner => scalar $loggedinuser,
114	}	116	}
115	);	117	);
Lines 141-146 if ( $op eq 'add_form' ) { Link Here
141	my $allow_changes_from = $query->param('allow_changes_from');	143	my $allow_changes_from = $query->param('allow_changes_from');
142	$shelf->allow_change_from_owner( $allow_changes_from > 0 );	144	$shelf->allow_change_from_owner( $allow_changes_from > 0 );
143	$shelf->allow_change_from_others( $allow_changes_from == ANYONE );	145	$shelf->allow_change_from_others( $allow_changes_from == ANYONE );
		146	$shelf->allow_change_from_staff( $allow_changes_from == STAFF );
144	$shelf->category( scalar $query->param('category') );	147	$shelf->category( scalar $query->param('category') );
145	eval { $shelf->store };	148	eval { $shelf->store };
146		149
Lines 428-434 if ( $op eq 'list' ) { Link Here
428	),	431	),
429	);	432	);
430	}	433	}
431		434	my $staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;
432	$template->param(	435	$template->param(
433	op => $op,	436	op => $op,
434	referer => $referer,	437	referer => $referer,
Lines 437-442 $template->param( Link Here
437	category => ($category == 1 \|\| $category == 2) ? $category : "",	440	category => ($category == 1 \|\| $category == 2) ? $category : "",
438	print => scalar $query->param('print') \|\| 0,	441	print => scalar $query->param('print') \|\| 0,
439	listsview => 1,	442	listsview => 1,
		443	staffuser => $staffuser,
440	);	444	);
441		445
442	my $content_type = $query->param('rss')? 'rss' : 'html';	446	my $content_type = $query->param('rss')? 'rss' : 'html';

Lines 19-25 Link Here

(-)a/t/db_dependent/Koha/Patron.t (-1 / +30 lines)
19		19
20	use Modern::Perl;	20	use Modern::Perl;
21		21
22	use Test::More tests => 8;	22	use Test::More tests => 9;
23	use Test::Exception;	23	use Test::Exception;
24	use Test::Warn;	24	use Test::Warn;
25		25
Lines 716-718 subtest 'can_log_into() tests' => sub { Link Here
716		716
717	$schema->storage->txn_rollback;	717	$schema->storage->txn_rollback;
718	};	718	};
		719
		720	subtest 'can_patron_change_staff_only_lists() tests' => sub {
		721
		722	plan tests => 3;
		723
		724	$schema->storage->txn_begin;
		725
		726	# make a user with no special permissions
		727	my $patron = $builder->build_object(
		728	{
		729	class => 'Koha::Patrons',
		730	value => {
		731	flags => undef
		732	}
		733	}
		734	);
		735	is( $patron->can_patron_change_staff_only_lists(), 0, 'Patron without permissions cannot change staff only lists');
		736
		737	# make it a 'Catalogue' permission
		738	$patron->set({ flags => 4 })->store->discard_changes;
		739	is( $patron->can_patron_change_staff_only_lists(), 1, 'Catalogue patron can change staff only lists');
		740
		741
		742	# make it a superlibrarian
		743	$patron->set({ flags => 1 })->store->discard_changes;
		744	is( $patron->can_patron_change_staff_only_lists(), 1, 'Superlibrarian patron can change staff only lists');
		745
		746	$schema->storage->txn_rollback;
		747	};

Lines 22-28 my $dbh = C4::Context->dbh; Link Here

(-)a/t/db_dependent/Virtualshelves.t (-18 / +73 lines)
22	teardown();	22	teardown();
23		23
24	subtest 'CRUD' => sub {	24	subtest 'CRUD' => sub {
25	plan tests => 13;	25	plan tests => 14;
26	my $patron = $builder->build({	26	my $patron = $builder->build({
27	source => 'Borrower',	27	source => 'Borrower',
28	});	28	});
Lines 44-49 subtest 'CRUD' => sub { Link Here
44	is( $number_of_shelves, 1, '1 shelf should have been inserted' );	44	is( $number_of_shelves, 1, '1 shelf should have been inserted' );
45	is( $shelf->allow_change_from_owner, 1, 'The default value for allow_change_from_owner should be 1' );	45	is( $shelf->allow_change_from_owner, 1, 'The default value for allow_change_from_owner should be 1' );
46	is( $shelf->allow_change_from_others, 0, 'The default value for allow_change_from_others should be 0' );	46	is( $shelf->allow_change_from_others, 0, 'The default value for allow_change_from_others should be 0' );
		47	is ( $shelf->allow_change_from_staff, 0, 'The default value for allow_change_from_staff should be 0');
47	is( t::lib::Dates::compare( $shelf->created_on, dt_from_string), 0, 'The creation time should have been set to today' );	48	is( t::lib::Dates::compare( $shelf->created_on, dt_from_string), 0, 'The creation time should have been set to today' );
48		49
49	# Test if creation date will not be overwritten by store	50	# Test if creation date will not be overwritten by store
Lines 171-179 subtest 'Sharing' => sub { Link Here
171		172
172	subtest 'Shelf content' => sub {	173	subtest 'Shelf content' => sub {
173		174
174	plan tests => 18;	175	plan tests => 21;
175	my $patron1 = $builder->build( { source => 'Borrower', } );	176	my $patron1 = $builder->build( { source => 'Borrower', } );
176	my $patron2 = $builder->build( { source => 'Borrower', } );	177	my $patron2 = $builder->build( { source => 'Borrower', } );
		178	my $patron3 = $builder->build( { source => 'Borrower', value => {flags => 1} });
177	my $biblio1 = $builder->build_sample_biblio;	179	my $biblio1 = $builder->build_sample_biblio;
178	my $biblio2 = $builder->build_sample_biblio;	180	my $biblio2 = $builder->build_sample_biblio;
179	my $biblio3 = $builder->build_sample_biblio;	181	my $biblio3 = $builder->build_sample_biblio;
Lines 247-264 subtest 'Shelf content' => sub { Link Here
247	$number_of_contents = Koha::Virtualshelfcontents->search->count;	249	$number_of_contents = Koha::Virtualshelfcontents->search->count;
248	is( $number_of_contents, 3, 'Back to three entries' );	250	is( $number_of_contents, 3, 'Back to three entries' );
249		251
		252	# allow_change_from_staff == 1 and allow_change_from_others == 0
		253	$shelf->allow_change_from_staff( 1 );
		254	$shelf->allow_change_from_others( 0 );
		255	$content4 = $shelf->add_biblio( $biblio3->biblionumber, $patron3->{borrowernumber} );
		256	$number_of_contents = Koha::Virtualshelfcontents->search->count;
		257	is( $number_of_contents, 4, 'The biblio should have been added to the shelf by patron 2');
		258	$number_of_deleted_biblios = $shelf->remove_biblios( { biblionumbers => [ $biblio3->biblionumber ], borrowernumber => $patron3->{borrowernumber} } );
		259	is( $number_of_deleted_biblios, 1, 'Biblio 3 deleted by patron 2' );
		260	$number_of_contents = Koha::Virtualshelfcontents->search->count;
		261	is( $number_of_contents, 3, 'Back to three entries' );
		262
250	teardown();	263	teardown();
251	};	264	};
252		265
253	subtest 'Shelf permissions' => sub {	266	subtest 'Shelf permissions' => sub {
254		267
255	plan tests => 40;	268	plan tests => 70;
256	my $patron1 = $builder->build( { source => 'Borrower', value => { flags => '2096766' } } ); # 2096766 is everything checked but not superlibrarian	269	my $patron1 = $builder->build( { source => 'Borrower', value => { flags => '2096766' } } ); # 2096766 is everything checked but not superlibrarian
257	my $patron2 = $builder->build( { source => 'Borrower', value => { flags => '1048190' } } ); # 1048190 is everything checked but not superlibrarian and delete_public_lists	270	my $patron2 = $builder->build( { source => 'Borrower', value => { flags => '1048190' } } ); # 1048190 is everything checked but not superlibrarian and delete_public_lists
		271	my $patron3 = $builder->build( { source => 'Borrower', value => { flags => '0' } } ); # this is a patron with no special permissions
258	my $biblio1 = $builder->build_sample_biblio;	272	my $biblio1 = $builder->build_sample_biblio;
259	my $biblio2 = $builder->build_sample_biblio;	273	my $biblio2 = $builder->build_sample_biblio;
260	my $biblio3 = $builder->build_sample_biblio;	274	my $biblio3 = $builder->build_sample_biblio;
261	my $biblio4 = $builder->build_sample_biblio;	275	my $biblio4 = $builder->build_sample_biblio;
		276	my $biblio5 = $builder->build_sample_biblio;
262		277
263	my $public_shelf = Koha::Virtualshelf->new(	278	my $public_shelf = Koha::Virtualshelf->new(
264	{ shelfname => "my first shelf",	279	{ shelfname => "my first shelf",
Lines 266-307 subtest 'Shelf permissions' => sub { Link Here
266	category => 2,	281	category => 2,
267	allow_change_from_owner => 0,	282	allow_change_from_owner => 0,
268	allow_change_from_others => 0,	283	allow_change_from_others => 0,
		284	allow_change_from_staff => 0,
269	}	285	}
270	)->store;	286	)->store;
271		287
272	is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );	288	is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );
273	is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by someone else' );	289	is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by another staff member');
		290	is( $public_shelf->can_be_viewed( $patron3->{borrowernumber} ), 1, 'Public list should be viewed by someone with no special permissions' );
274		291
275	is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );	292	is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
276	is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by someone else' );	293	is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by another staff member' );
		294	is( $public_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Public list should not be deleted by someone with no special permissions' );
277		295
278	is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );	296	is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
279	is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by someone else' );	297	is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by another staff member' );
		298	is( $public_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Public list should not be managed by someone with no special permissions' );
280		299
281	is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );	300	is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );
282	is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by someone else' );	301	is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by another staff member' );
		302	is( $public_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Public list should not be modified (add) by someone with no special permissions' );
283		303
284	is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );	304	is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );
285	is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by someone else' );	305	is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by another staff member' );
		306	is ( $public_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Public list should not be modified (removed) by someone with no special permissions' );
286		307
287		308
288	$public_shelf->allow_change_from_owner(1);	309	$public_shelf->allow_change_from_owner(1);
289	$public_shelf->store;	310	$public_shelf->store;
290		311
291	is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );	312	is( $public_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his public list' );
292	is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by someone else' );	313	is( $public_shelf->can_be_viewed( $patron2->{borrowernumber} ), 1, 'Public list should be viewed by staff member' );
		314	is( $public_shelf->can_be_viewed( $patron3->{borrowernumber} ), 1, 'Public list should be viewed by someone with no special permissions' );
293		315
294	is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );	316	is( $public_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
295	is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by someone else' );	317	is( $public_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Public list should not be deleted by another staff member' );
		318	is( $public_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Public list should not be deleted by someone with no special permissions' );
296		319
297	is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );	320	is( $public_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
298	is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by someone else' );	321	is( $public_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Public list should not be managed by another staff member' );
		322	is( $public_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Public list should not be managed by someone with no special permissions' );
299		323
300	is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );	324	is( $public_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );
301	is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by someone else' );	325	is( $public_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (add) by another staff member' );
		326	is( $public_shelf->can_biblios_be_added( $patron3->{borrowerbumber} ), 0, 'Public list should not be modified (add) by someone with no special permissions' );
302		327
303	is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );	328	is( $public_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );
304	is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by someone else' );	329	is( $public_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Public list should not be modified (remove) by another staff member' );
		330	is( $public_shelf->can_biblios_be_removed( $patron3->{borroernumber} ), 0, 'Public list should not be modified (remove) by someone with no special permissions' );
305		331
306		332
307	my $private_shelf = Koha::Virtualshelf->new(	333	my $private_shelf = Koha::Virtualshelf->new(
Lines 310-333 subtest 'Shelf permissions' => sub { Link Here
310	category => 1,	336	category => 1,
311	allow_change_from_owner => 0,	337	allow_change_from_owner => 0,
312	allow_change_from_others => 0,	338	allow_change_from_others => 0,
		339	allow_change_from_staff => 0,
313	}	340	}
314	)->store;	341	)->store;
315		342
316	is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );	343	is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );
317	is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by someone else' );	344	is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
		345	is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
318		346
319	is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );	347	is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
320	is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by someone else' );	348	is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
		349	is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
321		350
322	is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );	351	is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
323	is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by someone else' );	352	is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
		353	is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
324		354
325	is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );	355	is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 0, 'The owner should not be able to add biblios to their list' );
326	is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone else' );	356	is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (add) by another staff member' );
		357	is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );
327		358
328	is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );	359	is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 0, 'The owner should not be able to remove biblios to their list' );
329	is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone else' );	360	is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 0, 'Private list should not be modified (remove) by another staff member' );
		361	is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );
		362
		363	$private_shelf->allow_change_from_owner(1);
		364	$private_shelf->allow_change_from_staff(1);
		365	$private_shelf->allow_change_from_others(0);
		366	$private_shelf->store;
		367	is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );
		368	is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
		369	is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
		370
		371	is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
		372	is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
		373	is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
330		374
		375	is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
		376	is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
		377	is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
		378
		379	is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );
		380	is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list could be modified (add) by another staff member # individual check done later' );
		381	is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list could be modified (add) by someone with no special permissions' );
		382
		383	is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );
		384	is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list could be modified (remove) by another staff member # individual check done later' );
		385	is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list could be modified (remove) by someone with no special permissions' );
331		386
332	$private_shelf->allow_change_from_owner(1);	387	$private_shelf->allow_change_from_owner(1);
333	$private_shelf->allow_change_from_others(1);	388	$private_shelf->allow_change_from_others(1);

Lines 36-41 use Koha::Patrons; Link Here

(-)a/virtualshelves/shelves.pl (-1 / +3 lines)
36	use Koha::Virtualshelves;	36	use Koha::Virtualshelves;
37		37
38	use constant ANYONE => 2;	38	use constant ANYONE => 2;
		39	use constant STAFF => 3;
39		40
40	my $query = CGI->new;	41	my $query = CGI->new;
41		42
Lines 79-84 if ( $op eq 'add_form' ) { Link Here
79	category => scalar $query->param('category'),	80	category => scalar $query->param('category'),
80	allow_change_from_owner => $allow_changes_from > 0,	81	allow_change_from_owner => $allow_changes_from > 0,
81	allow_change_from_others => $allow_changes_from == ANYONE,	82	allow_change_from_others => $allow_changes_from == ANYONE,
		83	allow_change_from_staff => $allow_changes_from == STAFF,
82	owner => scalar $query->param('owner'),	84	owner => scalar $query->param('owner'),
83	}	85	}
84	);	86	);
Lines 108-113 if ( $op eq 'add_form' ) { Link Here
108	my $allow_changes_from = $query->param('allow_changes_from');	110	my $allow_changes_from = $query->param('allow_changes_from');
109	$shelf->allow_change_from_owner( $allow_changes_from > 0 );	111	$shelf->allow_change_from_owner( $allow_changes_from > 0 );
110	$shelf->allow_change_from_others( $allow_changes_from == ANYONE );	112	$shelf->allow_change_from_others( $allow_changes_from == ANYONE );
		113	$shelf->allow_change_from_staff( $allow_changes_from == STAFF );
111	$shelf->category( scalar $query->param('category') );	114	$shelf->category( scalar $query->param('category') );
112	eval { $shelf->store };	115	eval { $shelf->store };
113		116
114	-