View | Details | Raw Unified | Return to bug 33363
Collapse All | Expand All

(-)a/api/v1/swagger/paths/suggestions.yaml (-5 / +14 lines)
Lines 41-47 Link Here
41
          $ref: "../swagger.yaml#/definitions/error"
41
          $ref: "../swagger.yaml#/definitions/error"
42
    x-koha-authorization:
42
    x-koha-authorization:
43
      permissions:
43
      permissions:
44
        suggestions: suggestions_manage
44
        suggestions:
45
          - suggestions_manage
46
          - suggestions_delete
47
          - suggestions_create
45
  post:
48
  post:
46
    x-mojo-to: Suggestions#add
49
    x-mojo-to: Suggestions#add
47
    operationId: addSuggestions
50
    operationId: addSuggestions
Lines 100-106 Link Here
100
          $ref: "../swagger.yaml#/definitions/error"
103
          $ref: "../swagger.yaml#/definitions/error"
101
    x-koha-authorization:
104
    x-koha-authorization:
102
      permissions:
105
      permissions:
103
        suggestions: suggestions_manage
106
        suggestions: suggestions_create
104
"/suggestions/{suggestion_id}":
107
"/suggestions/{suggestion_id}":
105
  get:
108
  get:
106
    x-mojo-to: Suggestions#get
109
    x-mojo-to: Suggestions#get
Lines 139-145 Link Here
139
          $ref: "../swagger.yaml#/definitions/error"
142
          $ref: "../swagger.yaml#/definitions/error"
140
    x-koha-authorization:
143
    x-koha-authorization:
141
      permissions:
144
      permissions:
142
        suggestions: suggestions_manage
145
        suggestions:
146
          - suggestions_manage
147
          - suggestions_delete
148
          - suggestions_create
143
  put:
149
  put:
144
    x-mojo-to: Suggestions#update
150
    x-mojo-to: Suggestions#update
145
    operationId: updateSuggestion
151
    operationId: updateSuggestion
Lines 229-235 Link Here
229
          $ref: "../swagger.yaml#/definitions/error"
235
          $ref: "../swagger.yaml#/definitions/error"
230
    x-koha-authorization:
236
    x-koha-authorization:
231
      permissions:
237
      permissions:
232
        suggestions: suggestions_manage
238
        suggestions: suggestions_delete
233
/suggestions/managers:
239
/suggestions/managers:
234
  get:
240
  get:
235
    x-mojo-to: Suggestions#list_managers
241
    x-mojo-to: Suggestions#list_managers
Lines 281-284 Link Here
281
          $ref: "../swagger.yaml#/definitions/error"
287
          $ref: "../swagger.yaml#/definitions/error"
282
    x-koha-authorization:
288
    x-koha-authorization:
283
      permissions:
289
      permissions:
284
        suggestions: suggestions_manage
290
        suggestions:
291
          - suggestions_manage
292
          - suggestions_delete
293
          - suggestions_create
(-)a/installer/data/mysql/atomicupdate/bug_33363.pl (+25 lines)
Line 0 Link Here
1
use Modern::Perl;
2
3
return {
4
    bug_number  => "33363",
5
    description =>
6
        "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions",
7
    up => sub {
8
        my ($args) = @_;
9
        my ( $dbh, $out ) = @$args{qw(dbh out)};
10
11
        $dbh->do(
12
            q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_create', 'Create purchase suggestions')}
13
        );
14
        $dbh->do(
15
            q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_delete', 'Update purchase suggestions')}
16
        );
17
18
        $dbh->do(
19
            q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_create' FROM borrowers WHERE flags & (1 << 2)}
20
        );
21
        $dbh->do(
22
            q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_delete' FROM borrowers WHERE flags & (1 << 2)}
23
        );
24
    },
25
};
(-)a/installer/data/mysql/mandatory/userpermissions.sql (+2 lines)
Lines 86-92 INSERT INTO permissions (module_bit, code, description) VALUES Link Here
86
   (11, 'delete_invoices', 'Delete invoices'),
86
   (11, 'delete_invoices', 'Delete invoices'),
87
   (11, 'merge_invoices', 'Merge invoices'),
87
   (11, 'merge_invoices', 'Merge invoices'),
88
   (11, 'delete_baskets', 'Delete baskets'),
88
   (11, 'delete_baskets', 'Delete baskets'),
89
   (12, 'suggestions_create', 'Create purchase suggestions'),
89
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
90
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
91
   (12, 'suggestions_delete', 'Delete purchase suggestions'),
90
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
92
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
91
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
93
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
92
   (13, 'edit_calendar', 'Define days when the library is closed'),
94
   (13, 'edit_calendar', 'Define days when the library is closed'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc (-1 / +1 lines)
Lines 6-12 Link Here
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
9
            [% IF ( CAN_user_suggestions_suggestions_manage ) %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
9
            [% IF ( suggestion && ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete )  )  %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc (-1 / +1 lines)
Lines 170-176 Link Here
170
        [% END %]
170
        [% END %]
171
    [% END %]
171
    [% END %]
172
172
173
    [% IF CAN_user_suggestions_suggestions_manage %]
173
    [% IF CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete %]
174
        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a></li>
174
        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a></li>
175
    [% END %]
175
    [% END %]
176
    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
176
    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc (-1 / +1 lines)
Lines 58-64 Link Here
58
                    [% IF ( CAN_user_reports ) %]
58
                    [% IF ( CAN_user_reports ) %]
59
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
59
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
60
                    [% END %]
60
                    [% END %]
61
                    [% IF ( CAN_user_suggestions_suggestions_manage ) %]
61
                    [% IF ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete ) %]
62
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
62
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
63
                    [% END %]
63
                    [% END %]
64
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
64
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (-1 / +1 lines)
Lines 110-116 Link Here
110
[% BLOCK patron_search_table %]
110
[% BLOCK patron_search_table %]
111
111
112
    [% IF filter == 'suggestions_managers' %]
112
    [% IF filter == 'suggestions_managers' %]
113
        <div class="hint">Only staff with superlibrarian or suggestions_manage permissions are returned in the search results</div>
113
        <div class="hint">Only staff with superlibrarian or full suggestions permissions are returned in the search results</div>
114
    [% ELSIF filter == 'orders_managers' %]
114
    [% ELSIF filter == 'orders_managers' %]
115
        <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
115
        <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
116
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
116
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc (+10 lines)
Lines 417-427 Link Here
417
            Add manual credits to a patron account
417
            Add manual credits to a patron account
418
        </span>
418
        </span>
419
        <span class="permissioncode">([% name | html %])</span>
419
        <span class="permissioncode">([% name | html %])</span>
420
    [%- CASE 'suggestions_create' -%]
421
        <span class="sub_permission suggestions_create_subpermission">
422
            Create purchase suggestions
423
        </span>
424
        <span class="permissioncode">([% name | html %])</span>
420
    [%- CASE 'suggestions_manage' -%]
425
    [%- CASE 'suggestions_manage' -%]
421
        <span class="sub_permission suggestions_manage_subpermission">
426
        <span class="sub_permission suggestions_manage_subpermission">
422
            Manage purchase suggestions
427
            Manage purchase suggestions
423
        </span>
428
        </span>
424
        <span class="permissioncode">([% name | html %])</span>
429
        <span class="permissioncode">([% name | html %])</span>
430
    [%- CASE 'suggestions_delete' -%]
431
        <span class="sub_permission suggestions_delete_subpermission">
432
            Delete purchase suggestions
433
        </span>
434
        <span class="permissioncode">([% name | html %])</span>
425
    [%- CASE 'budget_add_del' -%]
435
    [%- CASE 'budget_add_del' -%]
426
        <span class="sub_permission budget_add_del_subpermission">
436
        <span class="sub_permission budget_add_del_subpermission">
427
            Add and delete funds (but can't modify funds)
437
            Add and delete funds (but can't modify funds)
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt (-1 / +3 lines)
Lines 43-49 Link Here
43
                <h1>Purchase suggestions</h1>
43
                <h1>Purchase suggestions</h1>
44
44
45
                <div id="toolbar" class="btn-toolbar">
45
                <div id="toolbar" class="btn-toolbar">
46
                    <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
46
                    [% IF CAN_user_suggestions_suggestions_create %]
47
                        <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
48
                    [% END %]
47
                </div>
49
                </div>
48
50
49
                [% IF suggestions.size %]
51
                [% IF suggestions.size %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-121 / +155 lines)
Lines 97-104 Link Here
97
                <div class="col-md-8 col-md-offset-2">
97
                <div class="col-md-8 col-md-offset-2">
98
98
99
                    <div id="toolbar" class="btn-toolbar">
99
                    <div id="toolbar" class="btn-toolbar">
100
                        <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
100
                        [% IF CAN_user_suggestions_suggestions_manage %]
101
                        <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-trash-can"></i> Delete</a>
101
                            <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
102
                        [% END %]
103
                        [% IF CAN_user_suggestions_suggestions_delete %]
104
                            <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-trash-can"></i> Delete</a>
105
                        [% END %]
102
                    </div>
106
                    </div>
103
107
104
                    <fieldset class="rows">
108
                    <fieldset class="rows">
Lines 331-336 Link Here
331
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
335
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
332
                    [%  CASE 'manager_not_enough_permissions' %]
336
                    [%  CASE 'manager_not_enough_permissions' %]
333
                        <span>The manager you selected does not have sufficient permissions.</span>
337
                        <span>The manager you selected does not have sufficient permissions.</span>
338
                    [% CASE 'no_manage_permission' %]
339
                        <span>You do not have permissions to manage suggestions</span>
340
                    [% CASE 'no_create_permission' %]
341
                        <span>You do not have permissions to create suggestions</span>
342
                    [% CASE 'no_delete_permission' %]
343
                        <span>You do not have permissions to delete suggestions</span>
334
                    [% CASE %]
344
                    [% CASE %]
335
                        <span>[% m.code | html %]</span>
345
                        <span>[% m.code | html %]</span>
336
                    [% END %]
346
                    [% END %]
Lines 551-557 Link Here
551
                            <label for="managedby_name">by:</label>
561
                            <label for="managedby_name">by:</label>
552
                            <div>
562
                            <div>
553
                                <span id="managedby_name" name="managedby_name">
563
                                <span id="managedby_name" name="managedby_name">
554
                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
564
                                    [% IF CAN_user_suggestions_suggestions_manage %]
565
                                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
566
                                    [% ELSE %]
567
                                        Nobody
568
                                    [% END %]
555
                                </span>
569
                                </span>
556
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
570
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
557
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
571
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
Lines 561-567 Link Here
561
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
575
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
562
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
576
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
563
                                [% END %]
577
                                [% END %]
564
                                <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
578
579
                                [% IF CAN_user_suggestions_suggestions_manage %]
580
                                    <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
581
                                [% END %]
565
582
566
                                <br/>
583
                                <br/>
567
                                <label for="notify">Notify manager:</label>
584
                                <label for="notify">Notify manager:</label>
Lines 655-661 Link Here
655
672
656
        [% IF op == 'else' %]
673
        [% IF op == 'else' %]
657
            <div id="toolbar" class="btn-toolbar">
674
            <div id="toolbar" class="btn-toolbar">
658
                <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
675
                [% IF CAN_user_suggestions_suggestions_create %]
676
                    <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
677
                [% END %]
659
            </div>
678
            </div>
660
679
661
            <h1>Suggestions management</h1>
680
            <h1>Suggestions management</h1>
Lines 844-856 Link Here
844
                                                    </td>
863
                                                    </td>
845
                                                    <td class="actions">
864
                                                    <td class="actions">
846
                                                        <div class="btn-group dropup">
865
                                                        <div class="btn-group dropup">
847
                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
866
                                                            [% IF CAN_user_suggestions_suggestions_manage %]
867
                                                                <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
868
                                                            [% ELSIF CAN_user_suggestions_suggestions_delete %]
869
                                                                <a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash-can"></i> Delete</a>
870
                                                            [% END %]
848
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
871
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
849
                                                                <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash-can"></i> Delete</a></li>
872
                                                                [% IF CAN_user_suggestions_suggestions_delete %]
850
                                                                [% UNLESS s.archived %]
873
                                                                    <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash-can"></i> Delete</a></li>
851
                                                                    <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
874
                                                                [% END %]
852
                                                                [% ELSE %]
875
                                                                [% IF CAN_user_suggestions_suggestions_manage %]
853
                                                                    <li><a class="unarchivesuggestion" href="suggestion.pl?op=unarchive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Unarchive</a></li>
876
                                                                    [% UNLESS s.archived %]
877
                                                                        <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
878
                                                                    [% ELSE %]
879
                                                                        <li><a class="unarchivesuggestion" href="suggestion.pl?op=unarchive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Unarchive</a></li>
880
                                                                    [% END %]
854
                                                                [% END %]
881
                                                                [% END %]
855
                                                            </ul>
882
                                                            </ul>
856
                                                        </div>
883
                                                        </div>
Lines 865-984 Link Here
865
                                            <h2>Change selected suggestions</h2>
892
                                            <h2>Change selected suggestions</h2>
866
                                        </div>
893
                                        </div>
867
                                    </div>
894
                                    </div>
868
                                    <div class="suggestions_batch_ops row">
869
                                        <div class="col-sm-4">
870
                                            <fieldset class="brief">
871
                                                <div id="select-reason[% loop.index | html %]">
872
                                                    <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label>
873
                                                    <select name="STATUS" id="STATUSreason[% loop.index | html %]">
874
                                                        <option value=""> -- Choose a status --</option>
875
876
                                                        [% IF (statusselected_ASKED ) %]
877
                                                            <option value="ASKED" selected="selected">Pending</option>
878
                                                        [% ELSE %]
879
                                                            <option value="ASKED">Pending</option>
880
                                                        [% END %]
881
895
882
                                                        [% IF (statusselected_ACCEPTED ) %]
896
                                    <div class="suggestions_batch_ops row">
883
                                                            <option value="ACCEPTED" selected="selected">Accepted</option>
897
                                        [% IF CAN_user_suggestions_suggestions_manage %]
884
                                                        [% ELSE %]
898
                                            <div class="col-sm-4">
885
                                                            <option value="ACCEPTED">Accepted</option>
899
                                                <fieldset class="brief">
886
                                                        [% END %]
900
                                                    <div id="select-reason[% loop.index | html %]">
887
901
                                                        <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label>
888
                                                        [% IF (statusselected_CHECKED ) %]
902
                                                        <select name="STATUS" id="STATUSreason[% loop.index | html %]">
889
                                                            <option value="CHECKED" selected="selected">Checked</option>
903
                                                            <option value=""> -- Choose a status --</option>
890
                                                        [% ELSE %]
904
891
                                                            <option value="CHECKED">Checked</option>
905
                                                            [% IF (statusselected_ASKED ) %]
892
                                                        [% END %]
906
                                                                <option value="ASKED" selected="selected">Pending</option>
893
907
                                                            [% ELSE %]
894
                                                        [% IF ( statusselected_REJECTED ) %]
908
                                                                <option value="ASKED">Pending</option>
895
                                                            <option value="REJECTED" selected="selected">Rejected</option>
909
                                                            [% END %]
896
                                                        [% ELSE %]
910
897
                                                            <option value="REJECTED">Rejected</option>
911
                                                            [% IF (statusselected_ACCEPTED ) %]
898
                                                        [% END %]
912
                                                                <option value="ACCEPTED" selected="selected">Accepted</option>
899
913
                                                            [% ELSE %]
900
                                                        [% IF ( statusselected_ORDERED ) %]
914
                                                                <option value="ACCEPTED">Accepted</option>
901
                                                            <option value="ORDERED" selected="selected">Ordered</option>
915
                                                            [% END %]
902
                                                        [% ELSE %]
916
903
                                                            <option value="ORDERED">Ordered</option>
917
                                                            [% IF (statusselected_CHECKED ) %]
904
                                                        [% END %]
918
                                                                <option value="CHECKED" selected="selected">Checked</option>
905
919
                                                            [% ELSE %]
906
                                                        [% FOREACH s IN SuggestionStatuses %]
920
                                                                <option value="CHECKED">Checked</option>
907
                                                            <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
921
                                                            [% END %]
908
                                                        [% END %]
922
909
                                                    </select>
923
                                                            [% IF ( statusselected_REJECTED ) %]
924
                                                                <option value="REJECTED" selected="selected">Rejected</option>
925
                                                            [% ELSE %]
926
                                                                <option value="REJECTED">Rejected</option>
927
                                                            [% END %]
928
929
                                                            [% IF ( statusselected_ORDERED ) %]
930
                                                                <option value="ORDERED" selected="selected">Ordered</option>
931
                                                            [% ELSE %]
932
                                                                <option value="ORDERED">Ordered</option>
933
                                                            [% END %]
934
935
                                                            [% FOREACH s IN SuggestionStatuses %]
936
                                                                <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
937
                                                            [% END %]
938
                                                        </select>
939
940
                                                        <label for="choosereason[% loop.index | html %]">with this reason:</label>
941
                                                        <select name="reason" id="choosereason[% loop.index | html %]">
942
                                                            <option value=""> -- Choose a reason -- </option>
943
                                                            [% FOREACH reasonsloo IN suggestion.reasonsloop %]
944
                                                                <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option>
945
                                                            [% END %]
946
                                                            <option value="other">Others...</option>
947
                                                        </select>
948
949
                                                        <span class="other_reason">
950
                                                            <input type="text" size="31" name="other_reason" placeholder="please note your reason here..." />
951
                                                            <a href="#" class="cancel_note">Cancel</a>
952
                                                        </span>
953
                                                    </div>
954
955
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
956
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
957
                                                </fieldset>
958
                                                <fieldset class="action">
959
                                                    <button type="submit" class="btn btn-primary" value="update_status">Submit</button>
960
                                                </fieldset>
961
                                            </div> <!-- /.col-sm-4 -->
962
963
                                            <div class="col-sm-2">
964
                                                <fieldset class="brief">
965
                                                    <label id="suggestion_itemtype">
966
                                                        Update item types with:
967
                                                    </label>
968
                                                    [% PROCESS 'av-build-dropbox.inc' name="suggestion_itemtype", category="SUGGEST_FORMAT", size = 20  %]
969
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
970
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
971
                                                </fieldset>
972
                                                <fieldset class="action">
973
                                                    <button type="submit" class="btn btn-primary" value="update_itemtype">Submit</button>
974
                                                </fieldset>
975
                                            </div> <!-- /.col-sm-4 -->
976
977
                                            <div class="col-sm-2">
978
                                                <fieldset class="brief">
979
                                                    <span class="label">Update manager</span>
980
                                                    <a id="set_manager_[% loop.count | html %]" data-tab="[% loop.count | html %]" class="set_manager" href="#"><i class="fa fa-search"></i> Select manager</a>
981
                                                    <span id="managedby_name[% loop.count | html %]"></span>
982
                                                    <input type="hidden" name="suggestion_managedby" id="managedby[% loop.count | html %]" value="[% logged_in_user.borrowernumber | html %]" />
983
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
984
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
985
                                                </fieldset>
986
                                                <fieldset class="action">
987
                                                    <button type="submit" class="btn btn-primary" value="update_manager">Submit</button>
988
                                                </fieldset>
989
                                            </div> <!-- /.col-sm-2 -->
990
                                        [% END %]
910
991
911
                                                    <label for="choosereason[% loop.index | html %]">with this reason:</label>
992
                                        [% IF CAN_user_suggestions_suggestions_delete %]
912
                                                    <select name="reason" id="choosereason[% loop.index | html %]">
993
                                            <div class="col-sm-2">
913
                                                        <option value=""> -- Choose a reason -- </option>
994
                                                <fieldset class="brief">
914
                                                        [% FOREACH reasonsloo IN suggestion.reasonsloop %]
995
                                                    <span class="label">Delete selected</span>
915
                                                            <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option>
996
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
916
                                                        [% END %]
997
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
917
                                                        <option value="other">Others...</option>
998
                                                </fieldset>
918
                                                    </select>
919
920
                                                    <span class="other_reason">
921
                                                        <input type="text" size="31" name="other_reason" placeholder="please note your reason here..." />
922
                                                        <a href="#" class="cancel_note">Cancel</a>
923
                                                    </span>
924
                                                </div>
925
926
                                                <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
927
                                                <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
928
                                            </fieldset>
929
                                            <fieldset class="action">
930
                                                <button type="submit" class="btn btn-primary" value="update_status">Submit</button>
931
                                            </fieldset>
932
                                        </div> <!-- /.col-sm-4 -->
933
934
                                        <div class="col-sm-2">
935
                                            <fieldset class="brief">
936
                                                <label id="suggestion_itemtype">
937
                                                    Update item types with:
938
                                                </label>
939
                                                [% PROCESS 'av-build-dropbox.inc' name="suggestion_itemtype", category="SUGGEST_FORMAT", size = 20  %]
940
                                                <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
941
                                                <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
942
                                            </fieldset>
943
                                            <fieldset class="action">
944
                                                <button type="submit" class="btn btn-primary" value="update_itemtype">Submit</button>
945
                                            </fieldset>
946
                                        </div> <!-- /.col-sm-4 -->
947
948
                                        <div class="col-sm-2">
949
                                            <fieldset class="brief">
950
                                                <span class="label">Update manager</span>
951
                                                <a id="set_manager_[% loop.count | html %]" data-tab="[% loop.count | html %]" class="set_manager" href="#"><i class="fa fa-search"></i> Select manager</a>
952
                                                <span id="managedby_name[% loop.count | html %]"></span>
953
                                                <input type="hidden" name="suggestion_managedby" id="managedby[% loop.count | html %]" value="[% logged_in_user.borrowernumber | html %]" />
954
                                                <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
955
                                                <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
956
                                            </fieldset>
957
                                            <fieldset class="action">
958
                                                <button type="submit" class="btn btn-primary" value="update_manager">Submit</button>
959
                                            </fieldset>
960
                                        </div> <!-- /.col-sm-2 -->
961
962
                                        <div class="col-sm-2">
963
                                            <fieldset class="brief">
964
                                                <span class="label">Delete selected</span>
965
                                                <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
966
                                                <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
967
                                            </fieldset>
968
                                            <fieldset class="action">
969
                                                <button type="submit" class="btn btn-primary" value="delete">Delete</button>
970
                                            </fieldset>
971
                                        </div> <!-- /.col-sm-2 -->
972
                                        <div class="col-sm-2">
973
                                            <fieldset class="brief">
974
                                                <span class="label">Archive selected</span>
975
                                                <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
976
                                                <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
977
                                                <fieldset class="action">
999
                                                <fieldset class="action">
978
                                                    <button type="submit" class="btn btn-primary" value="archive">Archive</button>
1000
                                                    <button type="submit" class="btn btn-primary" value="delete">Delete</button>
979
                                                </fieldset>
1001
                                                </fieldset>
980
                                            </fieldset>
1002
                                            </div> <!-- /.col-sm-2 -->
981
                                        </div> <!-- /.col-sm-2 -->
1003
                                        [% END %]
1004
                                        [% IF CAN_user_suggestions_suggestions_manage %]
1005
                                            <div class="col-sm-2">
1006
                                                <fieldset class="brief">
1007
                                                    <span class="label">Archive selected</span>
1008
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1009
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1010
                                                    <fieldset class="action">
1011
                                                        <button type="submit" class="btn btn-primary" value="archive">Archive</button>
1012
                                                    </fieldset>
1013
                                                </fieldset>
1014
                                            </div> <!-- /.col-sm-2 -->
1015
                                        [% END %]
982
                                    </div> <!-- /.row -->
1016
                                    </div> <!-- /.row -->
983
1017
984
                                [% ELSE %]
1018
                                [% ELSE %]
(-)a/members/purchase-suggestions.pl (-1 / +1 lines)
Lines 32-38 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
32
    {   template_name   => "members/purchase-suggestions.tt",
32
    {   template_name   => "members/purchase-suggestions.tt",
33
        query           => $input,
33
        query           => $input,
34
        type            => "intranet",
34
        type            => "intranet",
35
        flagsrequired   => { suggestions => 'suggestions_manage' },
35
        flagsrequired   => { suggestions => '*' },
36
    }
36
    }
37
);
37
);
38
38
(-)a/suggestion/suggestion.pl (-29 / +64 lines)
Lines 121-133 while ( my ( $k, $v ) = each %$suggestion_only ) { Link Here
121
}
121
}
122
122
123
my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user(
123
my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user(
124
        {
124
    {
125
            template_name   => "suggestion/suggestion.tt",
125
        template_name => "suggestion/suggestion.tt",
126
            query           => $input,
126
        query         => $input,
127
            type            => "intranet",
127
        type          => "intranet",
128
            flagsrequired   => { suggestions => 'suggestions_manage' },
128
        flagsrequired => { suggestions => '*' },
129
        }
129
    }
130
    );
130
);
131
132
my $librarian = Koha::Patrons->find($borrowernumber);
131
133
132
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
134
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
133
$template->param('borrowernumber' => $borrowernumber);
135
$template->param('borrowernumber' => $borrowernumber);
Lines 137-145 my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch Link Here
137
##  Operations
139
##  Operations
138
##
140
##
139
141
142
my @messages;
140
if ( $op =~ /save/i ) {
143
if ( $op =~ /save/i ) {
141
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
144
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
145
142
    my @messages;
146
    my @messages;
147
143
    my $biblio = MarcRecordFromNewSuggestion({
148
    my $biblio = MarcRecordFromNewSuggestion({
144
            title => $suggestion_only->{title},
149
            title => $suggestion_only->{title},
145
            author => $suggestion_only->{author},
150
            author => $suggestion_only->{author},
Lines 198-204 if ( $op =~ /save/i ) { Link Here
198
              if exists $suggestion_only->{branchcode}
203
              if exists $suggestion_only->{branchcode}
199
              && $suggestion_only->{branchcode} eq "";
204
              && $suggestion_only->{branchcode} eq "";
200
205
201
            &ModSuggestion($suggestion_only);
206
            if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
207
                &ModSuggestion($suggestion_only);
208
            } else {
209
                push @messages, { type => 'error', code => 'no_manage_permission' };
210
                $template->param( messages => \@messages, );
211
            }
202
212
203
            if ( $notify ) {
213
            if ( $notify ) {
204
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
214
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
Lines 238-244 if ( $op =~ /save/i ) { Link Here
238
            }
248
            }
239
            else {
249
            else {
240
                ## Adding some informations related to suggestion
250
                ## Adding some informations related to suggestion
241
                Koha::Suggestion->new($suggestion_only)->store();
251
                if ( $librarian->has_permission( { 'suggestions' => 'suggestions_create' } ) ) {
252
                    Koha::Suggestion->new($suggestion_only)->store();
253
                } else {
254
                    push @messages, { type => 'error', code => 'no_delete_permission' };
255
                    $template->param( messages => \@messages );
256
                }
242
            }
257
            }
243
            # empty fields, to avoid filter in "SearchSuggestion"
258
            # empty fields, to avoid filter in "SearchSuggestion"
244
        }
259
        }
Lines 302-319 elsif ($op eq "update_status" ) { Link Here
302
        $suggestion->{reason} = $reason;
317
        $suggestion->{reason} = $reason;
303
    }
318
    }
304
319
305
    foreach my $suggestionid (@editsuggestions) {
320
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
306
        next unless $suggestionid;
321
        foreach my $suggestionid (@editsuggestions) {
307
        $suggestion->{suggestionid} = $suggestionid;
322
            next unless $suggestionid;
308
        &ModSuggestion($suggestion);
323
            $suggestion->{suggestionid} = $suggestionid;
324
            &ModSuggestion($suggestion);
325
        }
326
        redirect_with_params($input);
327
    } else {
328
        push @messages, { type => 'error', code => 'no_manage_permission' };
329
        $template->param( messages => \@messages, );
309
    }
330
    }
310
    redirect_with_params($input);
331
} elsif ($op eq "delete" ) {
311
}elsif ($op eq "delete" ) {
332
    output_and_exit_if_error( $input, $cookie, $template, { check => 'csrf_token' } );
312
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
333
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_delete' } ) ) {
313
    foreach my $delete_field (@editsuggestions) {
334
        foreach my $delete_field (@editsuggestions) {
314
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
335
            &DelSuggestion( $borrowernumber, $delete_field, 'intranet' );
336
        }
337
        redirect_with_params($input);
338
    } else {
339
        push @messages, { type => 'error', code => 'no_delete_permission' };
340
        $template->param( messages => \@messages, );
315
    }
341
    }
316
    redirect_with_params($input);
317
}
342
}
318
elsif ($op eq "archive" ) {
343
elsif ($op eq "archive" ) {
319
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
344
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
Lines 326-345 elsif ($op eq "unarchive" ) { Link Here
326
    redirect_with_params($input);
351
    redirect_with_params($input);
327
}
352
}
328
elsif ( $op eq 'update_itemtype' ) {
353
elsif ( $op eq 'update_itemtype' ) {
329
    my $new_itemtype = $input->param('suggestion_itemtype');
354
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
330
    foreach my $suggestionid (@editsuggestions) {
355
        my $new_itemtype = $input->param('suggestion_itemtype');
331
        next unless $suggestionid;
356
        foreach my $suggestionid (@editsuggestions) {
332
        &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype });
357
            next unless $suggestionid;
358
            &ModSuggestion( { suggestionid => $suggestionid, itemtype => $new_itemtype } );
359
        }
360
        redirect_with_params($input);
361
    } else {
362
        push @messages, { type => 'error', code => 'no_manage_permission' };
363
        $template->param( messages => \@messages, );
333
    }
364
    }
334
    redirect_with_params($input);
335
}
365
}
336
elsif ( $op eq 'update_manager' ) {
366
elsif ( $op eq 'update_manager' ) {
337
    my $managedby = $input->param('suggestion_managedby');
367
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
338
    foreach my $suggestionid (@editsuggestions) {
368
        my $managedby = $input->param('suggestion_managedby');
339
        next unless $suggestionid;
369
        foreach my $suggestionid (@editsuggestions) {
340
        &ModSuggestion({ suggestionid => $suggestionid, managedby => $managedby });
370
            next unless $suggestionid;
371
            &ModSuggestion( { suggestionid => $suggestionid, managedby => $managedby } );
372
        }
373
        redirect_with_params($input);
374
    } else {
375
        push @messages, { type => 'error', code => 'no_manage_permission' };
376
        $template->param( messages => \@messages, );
341
    }
377
    }
342
    redirect_with_params($input);
343
}
378
}
344
elsif ( $op eq 'show' ) {
379
elsif ( $op eq 'show' ) {
345
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
380
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
(-)a/t/Koha/Auth/Permissions.t (-1 / +2 lines)
Lines 238-244 subtest 'superlibrarian tests' => sub { Link Here
238
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
238
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
239
        'CAN_user_stockrotation_manage_rotas'                       => 1,
239
        'CAN_user_stockrotation_manage_rotas'                       => 1,
240
        'CAN_user_stockrotation'                                    => 1,
240
        'CAN_user_stockrotation'                                    => 1,
241
        'CAN_user_suggestions_suggestions_create'                   => 1,
241
        'CAN_user_suggestions_suggestions_manage'                   => 1,
242
        'CAN_user_suggestions_suggestions_manage'                   => 1,
243
        'CAN_user_suggestions_suggestions_delete'                   => 1,
242
        'CAN_user_suggestions'                                      => 1,
244
        'CAN_user_suggestions'                                      => 1,
243
        'CAN_user_superlibrarian'                                   => 1,
245
        'CAN_user_superlibrarian'                                   => 1,
244
        'CAN_user_tools_access_files'                               => 1,
246
        'CAN_user_tools_access_files'                               => 1,
245
- 

Return to bug 33363