View | Details | Raw Unified | Return to bug 33363
Collapse All | Expand All

(-)a/api/v1/swagger/paths/suggestions.yaml (-5 / +14 lines)
Lines 41-47 Link Here
41
          $ref: "../swagger.yaml#/definitions/error"
41
          $ref: "../swagger.yaml#/definitions/error"
42
    x-koha-authorization:
42
    x-koha-authorization:
43
      permissions:
43
      permissions:
44
        suggestions: suggestions_manage
44
        suggestions:
45
          - suggestions_manage
46
          - suggestions_delete
47
          - suggestions_create
45
  post:
48
  post:
46
    x-mojo-to: Suggestions#add
49
    x-mojo-to: Suggestions#add
47
    operationId: addSuggestions
50
    operationId: addSuggestions
Lines 100-106 Link Here
100
          $ref: "../swagger.yaml#/definitions/error"
103
          $ref: "../swagger.yaml#/definitions/error"
101
    x-koha-authorization:
104
    x-koha-authorization:
102
      permissions:
105
      permissions:
103
        suggestions: suggestions_manage
106
        suggestions: suggestions_create
104
"/suggestions/{suggestion_id}":
107
"/suggestions/{suggestion_id}":
105
  get:
108
  get:
106
    x-mojo-to: Suggestions#get
109
    x-mojo-to: Suggestions#get
Lines 139-145 Link Here
139
          $ref: "../swagger.yaml#/definitions/error"
142
          $ref: "../swagger.yaml#/definitions/error"
140
    x-koha-authorization:
143
    x-koha-authorization:
141
      permissions:
144
      permissions:
142
        suggestions: suggestions_manage
145
        suggestions:
146
          - suggestions_manage
147
          - suggestions_delete
148
          - suggestions_create
143
  put:
149
  put:
144
    x-mojo-to: Suggestions#update
150
    x-mojo-to: Suggestions#update
145
    operationId: updateSuggestion
151
    operationId: updateSuggestion
Lines 229-235 Link Here
229
          $ref: "../swagger.yaml#/definitions/error"
235
          $ref: "../swagger.yaml#/definitions/error"
230
    x-koha-authorization:
236
    x-koha-authorization:
231
      permissions:
237
      permissions:
232
        suggestions: suggestions_manage
238
        suggestions: suggestions_delete
233
/suggestions/managers:
239
/suggestions/managers:
234
  get:
240
  get:
235
    x-mojo-to: Suggestions#list_managers
241
    x-mojo-to: Suggestions#list_managers
Lines 281-284 Link Here
281
          $ref: "../swagger.yaml#/definitions/error"
287
          $ref: "../swagger.yaml#/definitions/error"
282
    x-koha-authorization:
288
    x-koha-authorization:
283
      permissions:
289
      permissions:
284
        suggestions: suggestions_manage
290
        suggestions:
291
          - suggestions_manage
292
          - suggestions_delete
293
          - suggestions_create
(-)a/installer/data/mysql/atomicupdate/bug_33363.pl (+16 lines)
Line 0 Link Here
1
use Modern::Perl;
2
3
return {
4
    bug_number => "33363",
5
    description => "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions",
6
    up => sub {
7
        my ($args) = @_;
8
        my ($dbh, $out) = @$args{qw(dbh out)};
9
10
        $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_create', 'Create purchase suggestions')});
11
        $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_delete', 'Update purchase suggestions')});
12
13
        $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_create' FROM borrowers WHERE flags & (1 << 2)});
14
        $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_delete' FROM borrowers WHERE flags & (1 << 2)});
15
    },
16
};
(-)a/installer/data/mysql/mandatory/userpermissions.sql (+2 lines)
Lines 87-93 INSERT INTO permissions (module_bit, code, description) VALUES Link Here
87
   (11, 'delete_invoices', 'Delete invoices'),
87
   (11, 'delete_invoices', 'Delete invoices'),
88
   (11, 'merge_invoices', 'Merge invoices'),
88
   (11, 'merge_invoices', 'Merge invoices'),
89
   (11, 'delete_baskets', 'Delete baskets'),
89
   (11, 'delete_baskets', 'Delete baskets'),
90
   (12, 'suggestions_create', 'Create purchase suggestions'),
90
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
91
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
92
   (12, 'suggestions_delete', 'Delete purchase suggestions'),
91
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
93
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
92
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
94
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
93
   (13, 'edit_calendar', 'Define days when the library is closed'),
95
   (13, 'edit_calendar', 'Define days when the library is closed'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc (-1 / +1 lines)
Lines 6-12 Link Here
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
9
            [% IF ( CAN_user_suggestions_suggestions_manage ) %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
9
            [% IF ( suggestion && ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete )  )  %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc (-1 / +1 lines)
Lines 175-181 Link Here
175
        [% END %]
175
        [% END %]
176
    [% END %]
176
    [% END %]
177
177
178
    [% IF CAN_user_suggestions_suggestions_manage %]
178
    [% IF CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete %]
179
        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a></li>
179
        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a></li>
180
    [% END %]
180
    [% END %]
181
    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
181
    [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc (-1 / +1 lines)
Lines 58-64 Link Here
58
                    [% IF ( CAN_user_reports ) %]
58
                    [% IF ( CAN_user_reports ) %]
59
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
59
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
60
                    [% END %]
60
                    [% END %]
61
                    [% IF ( CAN_user_suggestions_suggestions_manage ) %]
61
                    [% IF ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete ) %]
62
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
62
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
63
                    [% END %]
63
                    [% END %]
64
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
64
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (-1 / +1 lines)
Lines 137-143 Link Here
137
    [% END %]
137
    [% END %]
138
138
139
    [% IF filter == 'suggestions_managers' %]
139
    [% IF filter == 'suggestions_managers' %]
140
        <div class="note">Only staff with superlibrarian or suggestions_manage permissions are returned in the search results</div>
140
        <div class="note">Only staff with superlibrarian or rull suggestions permissions are returned in the search results</div>
141
    [% ELSIF filter == 'orders_managers' OR filter == 'baskets_managers' %]
141
    [% ELSIF filter == 'orders_managers' OR filter == 'baskets_managers' %]
142
        <div class="note">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
142
        <div class="note">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
143
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
143
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc (+10 lines)
Lines 422-432 Link Here
422
            Add manual credits to a patron account
422
            Add manual credits to a patron account
423
        </span>
423
        </span>
424
        <span class="permissioncode">([% name | html %])</span>
424
        <span class="permissioncode">([% name | html %])</span>
425
    [%- CASE 'suggestions_create' -%]
426
        <span class="sub_permission suggestions_create_subpermission">
427
            Create purchase suggestions
428
        </span>
429
        <span class="permissioncode">([% name | html %])</span>
425
    [%- CASE 'suggestions_manage' -%]
430
    [%- CASE 'suggestions_manage' -%]
426
        <span class="sub_permission suggestions_manage_subpermission">
431
        <span class="sub_permission suggestions_manage_subpermission">
427
            Manage purchase suggestions
432
            Manage purchase suggestions
428
        </span>
433
        </span>
429
        <span class="permissioncode">([% name | html %])</span>
434
        <span class="permissioncode">([% name | html %])</span>
435
    [%- CASE 'suggestions_delete' -%]
436
        <span class="sub_permission suggestions_delete_subpermission">
437
            Delete purchase suggestions
438
        </span>
439
        <span class="permissioncode">([% name | html %])</span>
430
    [%- CASE 'budget_add_del' -%]
440
    [%- CASE 'budget_add_del' -%]
431
        <span class="sub_permission budget_add_del_subpermission">
441
        <span class="sub_permission budget_add_del_subpermission">
432
            Add and delete funds (but can't modify funds)
442
            Add and delete funds (but can't modify funds)
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt (-1 / +3 lines)
Lines 44-50 Link Here
44
                <h1>Purchase suggestions</h1>
44
                <h1>Purchase suggestions</h1>
45
45
46
                <div id="toolbar" class="btn-toolbar">
46
                <div id="toolbar" class="btn-toolbar">
47
                    <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
47
                    [% IF CAN_user_suggestions_suggestions_create %]
48
                        <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
49
                    [% END %]
48
                </div>
50
                </div>
49
51
50
                [% IF suggestions.size %]
52
                [% IF suggestions.size %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-53 / +172 lines)
Lines 97-111 Link Here
97
                    [% INCLUDE 'messages.inc' %]
97
                    [% INCLUDE 'messages.inc' %]
98
98
99
                    <div id="toolbar" class="btn-toolbar">
99
                    <div id="toolbar" class="btn-toolbar">
100
                        <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit_form&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
100
                        [% IF CAN_user_suggestions_suggestions_manage %]
101
                        <form class="delete_form" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl">
101
                            <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit_form&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
102
                            [% INCLUDE 'csrf-token.inc' %]
102
                        [% END %]
103
                            <fieldset class="action">
103
                        [% IF CAN_user_suggestions_suggestions_delete %]
104
                                <input type="hidden" name="op" value="cud-delete" />
104
                            <form class="delete_form" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl">
105
                                <input type="hidden" name="suggestionid" value="[% suggestionid | html %]" />
105
                                [% INCLUDE 'csrf-token.inc' %]
106
                                <button type="submit" class="btn btn-primary">Delete</button>
106
                                <fieldset class="action">
107
                            </fieldset>
107
                                    <input type="hidden" name="op" value="cud-delete" />
108
                        </form>
108
                                    <input type="hidden" name="suggestionid" value="[% suggestionid | html %]" />
109
                                    <button type="submit" class="btn btn-primary">Delete</button>
110
                                </fieldset>
111
                            </form>
112
                        [% END %]
109
                    </div>
113
                    </div>
110
114
111
                    <fieldset class="rows">
115
                    <fieldset class="rows">
Lines 340-345 Link Here
340
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
344
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
341
                    [%  CASE 'manager_not_enough_permissions' %]
345
                    [%  CASE 'manager_not_enough_permissions' %]
342
                        <span>The manager you selected does not have sufficient permissions.</span>
346
                        <span>The manager you selected does not have sufficient permissions.</span>
347
                    [% CASE 'no_manage_permission' %]
348
                        <span>You do not have permissions to manage suggestions</span>
349
                    [% CASE 'no_create_permission' %]
350
                        <span>You do not have permissions to create suggestions</span>
351
                    [% CASE 'no_delete_permission' %]
352
                        <span>You do not have permissions to delete suggestions</span>
343
                    [% CASE %]
353
                    [% CASE %]
344
                        <span>[% m.code | html %]</span>
354
                        <span>[% m.code | html %]</span>
345
                    [% END %]
355
                    [% END %]
Lines 560-566 Link Here
560
                            <label for="managedby_name">by:</label>
570
                            <label for="managedby_name">by:</label>
561
                            <div>
571
                            <div>
562
                                <span id="managedby_name" name="managedby_name">
572
                                <span id="managedby_name" name="managedby_name">
563
                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
573
                                    [% IF CAN_user_suggestions_suggestions_manage %]
574
                                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
575
                                    [% ELSE %]
576
                                        Nobody
577
                                    [% END %]
564
                                </span>
578
                                </span>
565
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
579
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
566
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
580
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
Lines 570-576 Link Here
570
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
584
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
571
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
585
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
572
                                [% END %]
586
                                [% END %]
573
                                <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
587
588
                                [% IF CAN_user_suggestions_suggestions_manage %]
589
                                    <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
590
                                [% END %]
574
591
575
                                <br/>
592
                                <br/>
576
                                <label for="notify">Notify manager:</label>
593
                                <label for="notify">Notify manager:</label>
Lines 665-671 Link Here
665
682
666
        [% IF op == 'else' %]
683
        [% IF op == 'else' %]
667
            <div id="toolbar" class="btn-toolbar">
684
            <div id="toolbar" class="btn-toolbar">
685
<<<<<<< HEAD
668
                <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add_form&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
686
                <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add_form&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
687
=======
688
                [% IF CAN_user_suggestions_suggestions_create %]
689
                    <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
690
                [% END %]
691
>>>>>>> 3c401bd9c7d (Bug 33363: Add separate permissions for creating and deleting suggestions)
669
            </div>
692
            </div>
670
693
671
            <h1>Suggestions management</h1>
694
            <h1>Suggestions management</h1>
Lines 860-865 Link Here
860
                                                    </td>
883
                                                    </td>
861
                                                    <td class="actions">
884
                                                    <td class="actions">
862
                                                        <div class="btn-group dropup">
885
                                                        <div class="btn-group dropup">
886
<<<<<<< HEAD
863
                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
887
                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
864
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
888
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
865
                                                                <li>
889
                                                                <li>
Lines 873-878 Link Here
873
                                                                    <li>
897
                                                                    <li>
874
                                                                        <button class="btn btn-default trigger_action" data-op="cud-unarchive" data-suggestionid="[% s.suggestionid | html %]">Unarchive</button>
898
                                                                        <button class="btn btn-default trigger_action" data-op="cud-unarchive" data-suggestionid="[% s.suggestionid | html %]">Unarchive</button>
875
                                                                    </li>
899
                                                                    </li>
900
=======
901
                                                            [% IF CAN_user_suggestions_suggestions_manage %]
902
                                                                <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
903
                                                            [% ELSIF CAN_user_suggestions_suggestions_delete %]
904
                                                                <a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash-can"></i> Delete</a>
905
                                                            [% END %]
906
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
907
                                                                [% IF CAN_user_suggestions_suggestions_delete %]
908
                                                                    <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash-can"></i> Delete</a></li>
909
                                                                [% END %]
910
                                                                [% IF CAN_user_suggestions_suggestions_manage %]
911
                                                                    [% UNLESS s.archived %]
912
                                                                        <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
913
                                                                    [% ELSE %]
914
                                                                        <li><a class="unarchivesuggestion" href="suggestion.pl?op=unarchive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Unarchive</a></li>
915
                                                                    [% END %]
916
>>>>>>> 3c401bd9c7d (Bug 33363: Add separate permissions for creating and deleting suggestions)
876
                                                                [% END %]
917
                                                                [% END %]
877
                                                            </ul>
918
                                                            </ul>
878
                                                        </div>
919
                                                        </div>
Lines 887-935 Link Here
887
                                            <h2>Change selected suggestions</h2>
928
                                            <h2>Change selected suggestions</h2>
888
                                        </div>
929
                                        </div>
889
                                    </div>
930
                                    </div>
890
                                    <div class="suggestions_batch_ops row">
891
                                        <div class="col-sm-4">
892
                                            <fieldset class="brief">
893
                                                <div id="select-reason[% loop.index | html %]">
894
                                                    <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label>
895
                                                    <select name="STATUS" id="STATUSreason[% loop.index | html %]">
896
                                                        <option value=""> -- Choose a status --</option>
897
931
898
                                                        [% IF (statusselected_ASKED ) %]
932
                                    <div class="suggestions_batch_ops row">
899
                                                            <option value="ASKED" selected="selected">Pending</option>
933
                                        [% IF CAN_user_suggestions_suggestions_manage %]
900
                                                        [% ELSE %]
934
                                            <div class="col-sm-4">
901
                                                            <option value="ASKED">Pending</option>
935
                                                <fieldset class="brief">
902
                                                        [% END %]
936
                                                    <div id="select-reason[% loop.index | html %]">
903
937
                                                        <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label>
904
                                                        [% IF (statusselected_ACCEPTED ) %]
938
                                                        <select name="STATUS" id="STATUSreason[% loop.index | html %]">
905
                                                            <option value="ACCEPTED" selected="selected">Accepted</option>
939
                                                            <option value=""> -- Choose a status --</option>
906
                                                        [% ELSE %]
940
907
                                                            <option value="ACCEPTED">Accepted</option>
941
                                                            [% IF (statusselected_ASKED ) %]
908
                                                        [% END %]
942
                                                                <option value="ASKED" selected="selected">Pending</option>
909
943
                                                            [% ELSE %]
910
                                                        [% IF (statusselected_CHECKED ) %]
944
                                                                <option value="ASKED">Pending</option>
911
                                                            <option value="CHECKED" selected="selected">Checked</option>
945
                                                            [% END %]
912
                                                        [% ELSE %]
946
913
                                                            <option value="CHECKED">Checked</option>
947
                                                            [% IF (statusselected_ACCEPTED ) %]
914
                                                        [% END %]
948
                                                                <option value="ACCEPTED" selected="selected">Accepted</option>
915
949
                                                            [% ELSE %]
916
                                                        [% IF ( statusselected_REJECTED ) %]
950
                                                                <option value="ACCEPTED">Accepted</option>
917
                                                            <option value="REJECTED" selected="selected">Rejected</option>
951
                                                            [% END %]
918
                                                        [% ELSE %]
952
919
                                                            <option value="REJECTED">Rejected</option>
953
                                                            [% IF (statusselected_CHECKED ) %]
920
                                                        [% END %]
954
                                                                <option value="CHECKED" selected="selected">Checked</option>
921
955
                                                            [% ELSE %]
922
                                                        [% IF ( statusselected_ORDERED ) %]
956
                                                                <option value="CHECKED">Checked</option>
923
                                                            <option value="ORDERED" selected="selected">Ordered</option>
957
                                                            [% END %]
924
                                                        [% ELSE %]
958
925
                                                            <option value="ORDERED">Ordered</option>
959
                                                            [% IF ( statusselected_REJECTED ) %]
926
                                                        [% END %]
960
                                                                <option value="REJECTED" selected="selected">Rejected</option>
961
                                                            [% ELSE %]
962
                                                                <option value="REJECTED">Rejected</option>
963
                                                            [% END %]
964
965
                                                            [% IF ( statusselected_ORDERED ) %]
966
                                                                <option value="ORDERED" selected="selected">Ordered</option>
967
                                                            [% ELSE %]
968
                                                                <option value="ORDERED">Ordered</option>
969
                                                            [% END %]
970
971
                                                            [% FOREACH s IN SuggestionStatuses %]
972
                                                                <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
973
                                                            [% END %]
974
                                                        </select>
975
976
                                                        <label for="choosereason[% loop.index | html %]">with this reason:</label>
977
                                                        <select name="reason" id="choosereason[% loop.index | html %]">
978
                                                            <option value=""> -- Choose a reason -- </option>
979
                                                            [% FOREACH reasonsloo IN suggestion.reasonsloop %]
980
                                                                <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option>
981
                                                            [% END %]
982
                                                            <option value="other">Others...</option>
983
                                                        </select>
984
985
                                                        <span class="other_reason">
986
                                                            <input type="text" size="31" name="other_reason" placeholder="please note your reason here..." />
987
                                                            <a href="#" class="cancel_note">Cancel</a>
988
                                                        </span>
989
                                                    </div>
927
990
928
                                                        [% FOREACH s IN SuggestionStatuses %]
991
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
929
                                                            <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
992
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
930
                                                        [% END %]
993
                                                </fieldset>
931
                                                    </select>
994
                                                <fieldset class="action">
995
                                                    <button type="submit" class="btn btn-primary" value="update_status">Submit</button>
996
                                                </fieldset>
997
                                            </div> <!-- /.col-sm-4 -->
998
999
                                            <div class="col-sm-2">
1000
                                                <fieldset class="brief">
1001
                                                    <label id="suggestion_itemtype">
1002
                                                        Update item types with:
1003
                                                    </label>
1004
                                                    [% PROCESS 'av-build-dropbox.inc' name="suggestion_itemtype", category="SUGGEST_FORMAT", size = 20  %]
1005
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1006
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1007
                                                </fieldset>
1008
                                                <fieldset class="action">
1009
                                                    <button type="submit" class="btn btn-primary" value="update_itemtype">Submit</button>
1010
                                                </fieldset>
1011
                                            </div> <!-- /.col-sm-4 -->
1012
1013
                                            <div class="col-sm-2">
1014
                                                <fieldset class="brief">
1015
                                                    <span class="label">Update manager</span>
1016
                                                    <a id="set_manager_[% loop.count | html %]" data-tab="[% loop.count | html %]" class="set_manager" href="#"><i class="fa fa-search"></i> Select manager</a>
1017
                                                    <span id="managedby_name[% loop.count | html %]"></span>
1018
                                                    <input type="hidden" name="suggestion_managedby" id="managedby[% loop.count | html %]" value="[% logged_in_user.borrowernumber | html %]" />
1019
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1020
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1021
                                                </fieldset>
1022
                                                <fieldset class="action">
1023
                                                    <button type="submit" class="btn btn-primary" value="update_manager">Submit</button>
1024
                                                </fieldset>
1025
                                            </div> <!-- /.col-sm-2 -->
1026
                                        [% END %]
932
1027
1028
<<<<<<< HEAD
933
                                                    <label for="choosereason[% loop.index | html %]">with this reason:</label>
1029
                                                    <label for="choosereason[% loop.index | html %]">with this reason:</label>
934
                                                    <select name="reason" id="choosereason[% loop.index | html %]">
1030
                                                    <select name="reason" id="choosereason[% loop.index | html %]">
935
                                                        <option value=""> -- Choose a reason -- </option>
1031
                                                        <option value=""> -- Choose a reason -- </option>
Lines 998-1006 Link Here
998
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1094
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
999
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1095
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1000
                                                    <button type="submit" data-op="cud-archive" class="btn btn-primary">Archive</button>
1096
                                                    <button type="submit" data-op="cud-archive" class="btn btn-primary">Archive</button>
1097
=======
1098
                                        [% IF CAN_user_suggestions_suggestions_delete %]
1099
                                            <div class="col-sm-2">
1100
                                                <fieldset class="brief">
1101
                                                    <span class="label">Delete selected</span>
1102
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1103
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1001
                                                </fieldset>
1104
                                                </fieldset>
1002
                                            </fieldset>
1105
                                                <fieldset class="action">
1003
                                        </div> <!-- /.col-sm-2 -->
1106
                                                    <button type="submit" class="btn btn-primary" value="delete">Delete</button>
1107
>>>>>>> 3c401bd9c7d (Bug 33363: Add separate permissions for creating and deleting suggestions)
1108
                                                </fieldset>
1109
                                            </div> <!-- /.col-sm-2 -->
1110
                                        [% END %]
1111
                                        [% IF CAN_user_suggestions_suggestions_manage %]
1112
                                            <div class="col-sm-2">
1113
                                                <fieldset class="brief">
1114
                                                    <span class="label">Archive selected</span>
1115
                                                    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
1116
                                                    <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" />
1117
                                                    <fieldset class="action">
1118
                                                        <button type="submit" class="btn btn-primary" value="archive">Archive</button>
1119
                                                    </fieldset>
1120
                                                </fieldset>
1121
                                            </div> <!-- /.col-sm-2 -->
1122
                                        [% END %]
1004
                                    </div> <!-- /.row -->
1123
                                    </div> <!-- /.row -->
1005
1124
1006
                                [% ELSE %]
1125
                                [% ELSE %]
(-)a/members/purchase-suggestions.pl (-1 / +1 lines)
Lines 32-38 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
32
    {   template_name   => "members/purchase-suggestions.tt",
32
    {   template_name   => "members/purchase-suggestions.tt",
33
        query           => $input,
33
        query           => $input,
34
        type            => "intranet",
34
        type            => "intranet",
35
        flagsrequired   => { suggestions => 'suggestions_manage' },
35
        flagsrequired   => { suggestions => '*' },
36
    }
36
    }
37
);
37
);
38
38
(-)a/suggestion/suggestion.pl (-20 / +61 lines)
Lines 126-135 my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user( Link Here
126
            template_name   => "suggestion/suggestion.tt",
126
            template_name   => "suggestion/suggestion.tt",
127
            query           => $input,
127
            query           => $input,
128
            type            => "intranet",
128
            type            => "intranet",
129
            flagsrequired   => { suggestions => 'suggestions_manage' },
129
            flagsrequired   => { suggestions => '*' },
130
        }
130
        }
131
    );
131
    );
132
132
133
my $librarian = Koha::Patrons->find($borrowernumber);
134
133
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
135
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
134
$template->param('borrowernumber' => $borrowernumber);
136
$template->param('borrowernumber' => $borrowernumber);
135
my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch'};
137
my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch'};
Lines 138-145 my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch Link Here
138
##  Operations
140
##  Operations
139
##
141
##
140
142
143
my @messages;
141
if ( $op =~ /cud-save/ ) {
144
if ( $op =~ /cud-save/ ) {
142
    my @messages;
145
    my @messages;
146
143
    my $biblio = MarcRecordFromNewSuggestion({
147
    my $biblio = MarcRecordFromNewSuggestion({
144
            title => $suggestion_only->{title},
148
            title => $suggestion_only->{title},
145
            author => $suggestion_only->{author},
149
            author => $suggestion_only->{author},
Lines 198-204 if ( $op =~ /cud-save/ ) { Link Here
198
              if exists $suggestion_only->{branchcode}
202
              if exists $suggestion_only->{branchcode}
199
              && $suggestion_only->{branchcode} eq "";
203
              && $suggestion_only->{branchcode} eq "";
200
204
201
            &ModSuggestion($suggestion_only);
205
            if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
206
                &ModSuggestion($suggestion_only);
207
            }
208
            else {
209
                push @messages, { type => 'error', code => 'no_manage_permission' };
210
                $template->param( messages => \@messages, );
211
            }
202
212
203
            if ( $notify ) {
213
            if ( $notify ) {
204
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
214
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
Lines 238-244 if ( $op =~ /cud-save/ ) { Link Here
238
            }
248
            }
239
            else {
249
            else {
240
                ## Adding some informations related to suggestion
250
                ## Adding some informations related to suggestion
241
                Koha::Suggestion->new($suggestion_only)->store();
251
                if ( $librarian->has_permission({ 'suggestions' => 'suggestions_create' }) ) {
252
                    Koha::Suggestion->new($suggestion_only)->store();
253
                }
254
                else {
255
                    push @messages, { type => 'error', code => 'no_delete_permission' };
256
                    $template->param( messages => \@messages );
257
                }
242
            }
258
            }
243
            # empty fields, to avoid filter in "SearchSuggestion"
259
            # empty fields, to avoid filter in "SearchSuggestion"
244
        }
260
        }
Lines 300-316 elsif ($op eq "cud-update_status" ) { Link Here
300
        $suggestion->{reason} = $reason;
316
        $suggestion->{reason} = $reason;
301
    }
317
    }
302
318
303
    foreach my $suggestionid (@editsuggestions) {
319
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
304
        next unless $suggestionid;
320
        foreach my $suggestionid (@editsuggestions) {
305
        $suggestion->{suggestionid} = $suggestionid;
321
            next unless $suggestionid;
306
        &ModSuggestion($suggestion);
322
            $suggestion->{suggestionid} = $suggestionid;
323
            &ModSuggestion($suggestion);
324
        }
325
        redirect_with_params($input);
307
    }
326
    }
308
    redirect_with_params($input);
327
    else {
309
}elsif ($op eq "cud-delete" ) {
328
        push @messages, { type => 'error', code => 'no_manage_permission' };
310
    foreach my $delete_field (@editsuggestions) {
329
        $template->param( messages => \@messages, );
311
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
330
    }
331
} elsif ($op eq "cud-delete" ) {
332
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_delete' } ) ) {
333
        foreach my $delete_field (@editsuggestions) {
334
            &DelSuggestion( $borrowernumber, $delete_field, 'intranet' );
335
        }
336
        redirect_with_params($input);
337
    } else {
338
        push @messages, { type => 'error', code => 'no_delete_permission' };
339
        $template->param( messages => \@messages, );
312
    }
340
    }
313
    redirect_with_params($input);
314
}
341
}
315
elsif ($op eq "cud-archive" ) {
342
elsif ($op eq "cud-archive" ) {
316
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
343
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
Lines 321-338 elsif ($op eq "cud-unarchive" ) { Link Here
321
    redirect_with_params($input);
348
    redirect_with_params($input);
322
}
349
}
323
elsif ( $op eq 'cud-update_itemtype' ) {
350
elsif ( $op eq 'cud-update_itemtype' ) {
324
    foreach my $suggestionid (@editsuggestions) {
351
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
325
        next unless $suggestionid;
352
        my $new_itemtype = $input->param('suggestion_itemtype');
326
        &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype });
353
        foreach my $suggestionid (@editsuggestions) {
354
            next unless $suggestionid;
355
            &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype });
356
        }
357
        redirect_with_params($input);
358
    }
359
    else {
360
        push @messages, { type => 'error', code => 'no_manage_permission' };
361
        $template->param( messages => \@messages, );
327
    }
362
    }
328
    redirect_with_params($input);
329
}
363
}
330
elsif ( $op eq 'cud-update_manager' ) {
364
elsif ( $op eq 'cud-update_manager' ) {
331
    foreach my $suggestionid (@editsuggestions) {
365
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
332
        next unless $suggestionid;
366
        my $managedby = $input->param('suggestion_managedby');
333
        &ModSuggestion({ suggestionid => $suggestionid, managedby => $sugg_managedby });
367
        foreach my $suggestionid (@editsuggestions) {
368
            next unless $suggestionid;
369
            &ModSuggestion({ suggestionid => $suggestionid, managedby => $managedby });
370
        }
371
        redirect_with_params($input);
372
    }
373
    else {
374
        push @messages, { type => 'error', code => 'no_manage_permission' };
375
        $template->param( messages => \@messages, );
334
    }
376
    }
335
    redirect_with_params($input);
336
}
377
}
337
elsif ( $op eq 'show' ) {
378
elsif ( $op eq 'show' ) {
338
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
379
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
(-)a/t/Koha/Auth/Permissions.t (-1 / +2 lines)
Lines 239-245 subtest 'superlibrarian tests' => sub { Link Here
239
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
239
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
240
        'CAN_user_stockrotation_manage_rotas'                       => 1,
240
        'CAN_user_stockrotation_manage_rotas'                       => 1,
241
        'CAN_user_stockrotation'                                    => 1,
241
        'CAN_user_stockrotation'                                    => 1,
242
        'CAN_user_suggestions_suggestions_create'                   => 1,
242
        'CAN_user_suggestions_suggestions_manage'                   => 1,
243
        'CAN_user_suggestions_suggestions_manage'                   => 1,
244
        'CAN_user_suggestions_suggestions_delete'                   => 1,
243
        'CAN_user_suggestions'                                      => 1,
245
        'CAN_user_suggestions'                                      => 1,
244
        'CAN_user_superlibrarian'                                   => 1,
246
        'CAN_user_superlibrarian'                                   => 1,
245
        'CAN_user_tools_access_files'                               => 1,
247
        'CAN_user_tools_access_files'                               => 1,
246
- 

Return to bug 33363