Attachment #16345 for bug #9833

View | Details | Raw Unified | Return to bug 9833
Collapse All | Expand All

Lines 1135-1140 sub check_api_auth { Link Here

(-)a/C4/Auth.pm (+4 lines)
1135	# is deferred so as to not introduce bugs into the	1135	# is deferred so as to not introduce bugs into the
1136	# regular authentication code for Koha 3.0.	1136	# regular authentication code for Koha 3.0.
1137		1137
		1138	# FIXME: check_cookie_auth happens to disconnect the
		1139	# user when authentication fails. Imho, it should not.
		1140	# It should just deny authentication.
		1141
1138	# see if we have a valid session cookie already	1142	# see if we have a valid session cookie already
1139	# however, if a userid parameter is present (i.e., from	1143	# however, if a userid parameter is present (i.e., from
1140	# a form submission, assume that any current cookie	1144	# a form submission, assume that any current cookie

Lines 23-28 use warnings; Link Here

(-)a/C4/VirtualShelves.pm (-2 / +8 lines)
23	use Carp;	23	use Carp;
24	use C4::Context;	24	use C4::Context;
25	use C4::Debug;	25	use C4::Debug;
		26	use C4::Members;
26		27
27	use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead	28	use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead
28	use constant SHELVES_COMBO_MAX => 10; #add to combo in search	29	use constant SHELVES_COMBO_MAX => 10; #add to combo in search
Lines 431-437 ShelfPossibleAction($loggedinuser, $shelfnumber, $action); Link Here
431		432
432	C<$loggedinuser,$shelfnumber,$action>	433	C<$loggedinuser,$shelfnumber,$action>
433		434
434	$action can be "view", "add", "delete", "manage", "new_public", "new_private".	435	$action can be "view", "add", "delete", "manage", "new_public", "new_private" or "merge".
435	Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage.	436	Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage.
436	new_public and new_private refers to creating a new public or private list.	437	new_public and new_private refers to creating a new public or private list.
437	The distinction between deleting your own entries from the list or entries from	438	The distinction between deleting your own entries from the list or entries from
Lines 489-495 sub ShelfPossibleAction { Link Here
489	return 1 if $user>0 && ($shelf->{allow_delete_own}==1 \|\| $shelf->{allow_delete_other}==1);	490	return 1 if $user>0 && ($shelf->{allow_delete_own}==1 \|\| $shelf->{allow_delete_other}==1);
490	}	491	}
491	elsif($action eq 'manage') {	492	elsif($action eq 'manage') {
492	return 1 if $user && $shelf->{owner}==$user;	493	my $borrower = GetMemberDetails($user);
		494	return 1 if ($user && $shelf->{owner}==$user) \|\| C4::Auth::haspermission($borrower->{'userid'}, {'editcatalogue' => 'manage_shelves'});
		495	}
		496	elsif($action eq 'merge') {
		497	my $borrower = GetMemberDetails($user);
		498	return 1 if C4::Auth::haspermission($borrower->{'userid'}, {'editcatalogue' => 'merge_from_shelves'});
493	}	499	}
494	return 0;	500	return 0;
495	}	501	}




                $showadd = 1;
                my $i = 0;
                my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );
                my $mergefromshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'merge' );
                $template->param(
                    shelfname           => $shelfname,
                    shelfnumber         => $shelfnumber,
                    viewshelf           => $shelfnumber,
                    sortfield           => $sortfield,
                    manageshelf         => $manageshelf,
                    merge_from_shelf => $mergefromshelf,
                    allowremovingitems  => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),
                    allowaddingitem     => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),
                    "category$category" => 1,

Lines 42-48 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here

(-)a/cataloguing/merge.pl (-1 / +6 lines)
42	query => $input,	42	query => $input,
43	type => "intranet",	43	type => "intranet",
44	authnotrequired => 0,	44	authnotrequired => 0,
45	flagsrequired => { editcatalogue => 'edit_catalogue' },	45
		46	# Important: if you plan to change this permission, do not forget
		47	# to change the matching permission in merge_ajax.pl, otherwise
		48	# you'll end up disconnected without knowing why...
		49	flagsrequired => { editcatalogue => 'merge_from_shelves' }
		50
46	}	51	}
47	);	52	);
48		53

Lines 16-22 use CGI::Cookie; # need to check cookies before Link Here

(-)a/cataloguing/merge_ajax.pl (-1 / +1 lines)
16	# having CGI parse the POST request	16	# having CGI parse the POST request
17		17
18	my %cookies = fetch CGI::Cookie;	18	my %cookies = fetch CGI::Cookie;
19	my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' });	19	my ( $auth_status, $sessionID ) = check_cookie_auth( $cookies{'CGISESSID'}->value, { editcatalogue => 'merge_from_shelves' } );
20	if ($auth_status ne "ok") {	20	if ($auth_status ne "ok") {
21	my $reply = CGI->new("");	21	my $reply = CGI->new("");
22	print $reply->header(-type => 'text/html');	22	print $reply->header(-type => 'text/html');




    SetVersion ($DBversion);
}

$DBversion = '3.11.00.XXX';
if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
    $dbh->do(qq{
        INSERT INTO `permissions` (`module_bit`, `code`, `description`) VALUES (
        '9', 'manage_shelves', 'Allows to manage shelves'), (
        '9', 'merge_from_shelves', 'Allows to merge records from shelves'
        );
    });
    print "Upgrade to $DBversion done (Adds new permissions for shelves)\n";
    SetVersion($DBversion);
}



=head1 FUNCTIONS

=head2 TableExists($table)

Lines 283-289 function placeHold () { Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt (-2 / +1 lines)
283	[% IF ( itemsloop ) %]	283	[% IF ( itemsloop ) %]
284	<input type="button" id="placehold" style="display:none" onclick="placeHold(); return false;" value="Place holds" />	284	<input type="button" id="placehold" style="display:none" onclick="placeHold(); return false;" value="Place holds" />
285	[% IF ( allowremovingitems ) %]<input type="submit" value="Remove selected records" onclick="return confirm(MSG_REMOVE_FROM_LIST);" />[% END %]	285	[% IF ( allowremovingitems ) %]<input type="submit" value="Remove selected records" onclick="return confirm(MSG_REMOVE_FROM_LIST);" />[% END %]
286	<input type="submit" value="Merge selected records" onclick="return MergeItems();" />	286	[% IF ( merge_from_shelf ) %]<input type="submit" value="Merge selected records" onclick="return MergeItems();" />[% END %]
287	[% END %]	287	[% END %]
288	</fieldset>	288	</fieldset>
289	</fieldset>	289	</fieldset>
290	-

Return to bug 9833

Lines 295-306 sub shelfpage { Link Here

(-)a/C4/VirtualShelves/Page.pm (+2 lines)
295	$showadd = 1;	295	$showadd = 1;
296	my $i = 0;	296	my $i = 0;
297	my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );	297	my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );
		298	my $mergefromshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'merge' );
298	$template->param(	299	$template->param(
299	shelfname => $shelfname,	300	shelfname => $shelfname,
300	shelfnumber => $shelfnumber,	301	shelfnumber => $shelfnumber,
301	viewshelf => $shelfnumber,	302	viewshelf => $shelfnumber,
302	sortfield => $sortfield,	303	sortfield => $sortfield,
303	manageshelf => $manageshelf,	304	manageshelf => $manageshelf,
		305	merge_from_shelf => $mergefromshelf,
304	allowremovingitems => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),	306	allowremovingitems => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),
305	allowaddingitem => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),	307	allowaddingitem => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),
306	"category$category" => 1,	308	"category$category" => 1,

Lines 6532-6537 if (C4::Context->preference("Version") < TransformToNum($DBversion)) { Link Here

(-)a/installer/data/mysql/updatedatabase.pl (+14 lines)
6532	SetVersion ($DBversion);	6532	SetVersion ($DBversion);
6533	}	6533	}
6534		6534
		6535	$DBversion = '3.11.00.XXX';
		6536	if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
		6537	$dbh->do(qq{
		6538	INSERT INTO `permissions` (`module_bit`, `code`, `description`) VALUES (
		6539	'9', 'manage_shelves', 'Allows to manage shelves'), (
		6540	'9', 'merge_from_shelves', 'Allows to merge records from shelves'
		6541	);
		6542	});
		6543	print "Upgrade to $DBversion done (Adds new permissions for shelves)\n";
		6544	SetVersion($DBversion);
		6545	}
		6546
		6547
		6548
6535	=head1 FUNCTIONS	6549	=head1 FUNCTIONS
6536		6550
6537	=head2 TableExists($table)	6551	=head2 TableExists($table)