Attachment #122688 for bug #26346

View | Details | Raw Unified | Return to bug 26346
Collapse All | Expand All




    return if $already_exists;

    # Check permissions
    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
    return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) || ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) || $self->allow_change_from_others;

    my $content = Koha::Virtualshelfcontent->new(
        {

    return unless @$biblionumbers;

    my $number_removed = 0;
    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
    if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )
      || ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists )
      || $self->allow_change_from_others ) {
        $number_removed += $self->get_contents->search({
            biblionumber => $biblionumbers,

sub can_biblios_be_added {
    my ( $self, $borrowernumber ) = @_;

    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
    return 1
      if $borrowernumber
      and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );
    return 0;
}


    return 'Virtualshelve';
}

1;





use Koha::Virtualshelf;

use C4::Auth;

use base qw(Koha::Objects);

=head1 NAME


    my @conditions;
    if ( $add_allowed ) {
        push @conditions, {
            -or =>
            [
                {
                    "me.owner" => $borrowernumber,
                    "me.allow_change_from_owner" => 1,
                },
                "me.allow_change_from_others" => 1,
                "me.allow_change_from_staff" => 1,
            ]
        };
            };
        } else {
            push @conditions, {
                -or =>
                [
                    {
                        "me.owner" => $borrowernumber,
                        "me.allow_change_from_owner" => 1,
                    },
                    "me.allow_change_from_others" => 1,
                ]
            };
        }
    }
    if ( $category == 1 ) {
        push @conditions, {

Lines 436-442 if ( $op eq 'list' ) { Link Here

(-)a/opac/opac-shelves.pl (-1 / +2 lines)
436	),	436	),
437	);	437	);
438	}	438	}
439	my $staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;	439	my $staffuser;
		440	$staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;
440	$template->param(	441	$template->param(
441	op => $op,	442	op => $op,
442	referer => $referer,	443	referer => $referer,




    $private_shelf->allow_change_from_staff(1);
    $private_shelf->allow_change_from_others(0);
    $private_shelf->store;
    is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view their list' );
    is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
    is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
    is( $private_shelf->can_be_viewed( $patron4->{borrowernumber} ), 0, 'Private list should not be viewed by someone with the edit_public_lists sub-permission checked' );

    is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete their list' );
    is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
    is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
    is( $private_shelf->can_be_deleted( $patron4->{borrowernumber} ), 0, 'Private list should not be deleted by someone with the edit_public_lists sub-permission checked' );

    is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage their list' );
    is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
    is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
    is( $private_shelf->can_be_managed( $patron4->{borrowernumber} ), 0, 'Private list should not be managed by someone with the edit_public_lists sub-permission checked' );

    is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to their list' );
    is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list should not modified (add) by another staff member # individual check done later' );
    is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );
    is ( $private_shelf->can_biblios_be_added( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with the edit_public_lists sub-permission checked' );

    is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to their list' );
    is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list should be modified (remove) by another staff member # individual check done later' );
    is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );
    is( $private_shelf->can_biblios_be_removed( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with the edit_public_lists sub-permission checked' );
- 

Return to bug 26346

Lines 187-193 sub add_biblio { Link Here

(-)a/Koha/Virtualshelf.pm (-3 / +7 lines)
187	return if $already_exists;	187	return if $already_exists;
188		188
189	# Check permissions	189	# Check permissions
190	return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) \|\| ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) \|\| $self->allow_change_from_others;	190	my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
		191	return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) \|\| ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) \|\| $self->allow_change_from_others;
191		192
192	my $content = Koha::Virtualshelfcontent->new(	193	my $content = Koha::Virtualshelfcontent->new(
193	{	194	{
Lines 209-216 sub remove_biblios { Link Here
209	return unless @$biblionumbers;	210	return unless @$biblionumbers;
210		211
211	my $number_removed = 0;	212	my $number_removed = 0;
		213	my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
212	if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )	214	if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )
213	\|\| ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists )	215	\|\| ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists )
214	\|\| $self->allow_change_from_others ) {	216	\|\| $self->allow_change_from_others ) {
215	$number_removed += $self->get_contents->search({	217	$number_removed += $self->get_contents->search({
216	biblionumber => $biblionumbers,	218	biblionumber => $biblionumbers,
Lines 258-266 sub can_be_managed { Link Here
258	sub can_biblios_be_added {	260	sub can_biblios_be_added {
259	my ( $self, $borrowernumber ) = @_;	261	my ( $self, $borrowernumber ) = @_;
260		262
		263	my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
261	return 1	264	return 1
262	if $borrowernumber	265	if $borrowernumber
263	and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );	266	and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );
264	return 0;	267	return 0;
265	}	268	}
266		269
Lines 274-276 sub _type { Link Here
274	return 'Virtualshelve';	277	return 'Virtualshelve';
275	}	278	}
276		279
		280	1;

Lines 23-30 use Koha::Database; Link Here

(-)a/Koha/Virtualshelves.pm (-26 / +11 lines)
23		23
24	use Koha::Virtualshelf;	24	use Koha::Virtualshelf;
25		25
26	use C4::Auth;
27
28	use base qw(Koha::Objects);	26	use base qw(Koha::Objects);
29		27
30	=head1 NAME	28	=head1 NAME
Lines 90-119 sub get_some_shelves { Link Here
90		88
91	my @conditions;	89	my @conditions;
92	if ( $add_allowed ) {	90	if ( $add_allowed ) {
93	if ( Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) {	91	push @conditions, {
94	push @conditions, {	92	-or =>
95	-or =>	93	[
96	[	94	{
97	{	95	"me.owner" => $borrowernumber,
98	"me.owner" => $borrowernumber,	96	"me.allow_change_from_owner" => 1,
99	"me.allow_change_from_owner" => 1,	97	},
100	},	98	"me.allow_change_from_others" => 1,
101	"me.allow_change_from_others" => 1,	99	"me.allow_change_from_staff" => 1,
102	"me.allow_change_from_staff" => 1	100	]
103	]	101	};
104	};
105	} else {
106	push @conditions, {
107	-or =>
108	[
109	{
110	"me.owner" => $borrowernumber,
111	"me.allow_change_from_owner" => 1,
112	},
113	"me.allow_change_from_others" => 1,
114	]
115	};
116	}
117	}	102	}
118	if ( $category == 1 ) {	103	if ( $category == 1 ) {
119	push @conditions, {	104	push @conditions, {

Lines 381-407 subtest 'Shelf permissions' => sub { Link Here

(-)a/t/db_dependent/Virtualshelves.t (-6 / +5 lines)
381	$private_shelf->allow_change_from_staff(1);	381	$private_shelf->allow_change_from_staff(1);
382	$private_shelf->allow_change_from_others(0);	382	$private_shelf->allow_change_from_others(0);
383	$private_shelf->store;	383	$private_shelf->store;
384	is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );	384	is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view their list' );
385	is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );	385	is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
386	is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );	386	is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
387	is( $private_shelf->can_be_viewed( $patron4->{borrowernumber} ), 0, 'Private list should not be viewed by someone with the edit_public_lists sub-permission checked' );	387	is( $private_shelf->can_be_viewed( $patron4->{borrowernumber} ), 0, 'Private list should not be viewed by someone with the edit_public_lists sub-permission checked' );
388		388
389	is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );	389	is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete their list' );
390	is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );	390	is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
391	is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );	391	is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
392	is( $private_shelf->can_be_deleted( $patron4->{borrowernumber} ), 0, 'Private list should not be deleted by someone with the edit_public_lists sub-permission checked' );	392	is( $private_shelf->can_be_deleted( $patron4->{borrowernumber} ), 0, 'Private list should not be deleted by someone with the edit_public_lists sub-permission checked' );
393		393
394	is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );	394	is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage their list' );
395	is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );	395	is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
396	is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );	396	is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
397	is( $private_shelf->can_be_managed( $patron4->{borrowernumber} ), 0, 'Private list should not be managed by someone with the edit_public_lists sub-permission checked' );	397	is( $private_shelf->can_be_managed( $patron4->{borrowernumber} ), 0, 'Private list should not be managed by someone with the edit_public_lists sub-permission checked' );
398		398
399	is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );	399	is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to their list' );
400	is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list should not modified (add) by another staff member # individual check done later' );	400	is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list should not modified (add) by another staff member # individual check done later' );
401	is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );	401	is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );
402	is ( $private_shelf->can_biblios_be_added( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with the edit_public_lists sub-permission checked' );	402	is ( $private_shelf->can_biblios_be_added( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with the edit_public_lists sub-permission checked' );
403		403
404	is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );	404	is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to their list' );
405	is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list should be modified (remove) by another staff member # individual check done later' );	405	is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list should be modified (remove) by another staff member # individual check done later' );
406	is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );	406	is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );
407	is( $private_shelf->can_biblios_be_removed( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with the edit_public_lists sub-permission checked' );	407	is( $private_shelf->can_biblios_be_removed( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with the edit_public_lists sub-permission checked' );
408	-