View | Details | Raw Unified | Return to bug 33363
Collapse All | Expand All

(-)a/api/v1/swagger/paths/suggestions.yaml (-5 / +14 lines)
Lines 41-47 Link Here
41
          $ref: "../swagger.yaml#/definitions/error"
41
          $ref: "../swagger.yaml#/definitions/error"
42
    x-koha-authorization:
42
    x-koha-authorization:
43
      permissions:
43
      permissions:
44
        suggestions: suggestions_manage
44
        suggestions:
45
          - suggestions_manage
46
          - suggestions_delete
47
          - suggestions_create
45
  post:
48
  post:
46
    x-mojo-to: Suggestions#add
49
    x-mojo-to: Suggestions#add
47
    operationId: addSuggestions
50
    operationId: addSuggestions
Lines 100-106 Link Here
100
          $ref: "../swagger.yaml#/definitions/error"
103
          $ref: "../swagger.yaml#/definitions/error"
101
    x-koha-authorization:
104
    x-koha-authorization:
102
      permissions:
105
      permissions:
103
        suggestions: suggestions_manage
106
        suggestions: suggestions_create
104
"/suggestions/{suggestion_id}":
107
"/suggestions/{suggestion_id}":
105
  get:
108
  get:
106
    x-mojo-to: Suggestions#get
109
    x-mojo-to: Suggestions#get
Lines 139-145 Link Here
139
          $ref: "../swagger.yaml#/definitions/error"
142
          $ref: "../swagger.yaml#/definitions/error"
140
    x-koha-authorization:
143
    x-koha-authorization:
141
      permissions:
144
      permissions:
142
        suggestions: suggestions_manage
145
        suggestions:
146
          - suggestions_manage
147
          - suggestions_delete
148
          - suggestions_create
143
  put:
149
  put:
144
    x-mojo-to: Suggestions#update
150
    x-mojo-to: Suggestions#update
145
    operationId: updateSuggestion
151
    operationId: updateSuggestion
Lines 229-235 Link Here
229
          $ref: "../swagger.yaml#/definitions/error"
235
          $ref: "../swagger.yaml#/definitions/error"
230
    x-koha-authorization:
236
    x-koha-authorization:
231
      permissions:
237
      permissions:
232
        suggestions: suggestions_manage
238
        suggestions: suggestions_delete
233
/suggestions/managers:
239
/suggestions/managers:
234
  get:
240
  get:
235
    x-mojo-to: Suggestions#list_managers
241
    x-mojo-to: Suggestions#list_managers
Lines 281-284 Link Here
281
          $ref: "../swagger.yaml#/definitions/error"
287
          $ref: "../swagger.yaml#/definitions/error"
282
    x-koha-authorization:
288
    x-koha-authorization:
283
      permissions:
289
      permissions:
284
        suggestions: suggestions_manage
290
        suggestions:
291
          - suggestions_manage
292
          - suggestions_delete
293
          - suggestions_create
(-)a/installer/data/mysql/atomicupdate/bug_33363.pl (+25 lines)
Line 0 Link Here
1
use Modern::Perl;
2
3
return {
4
    bug_number  => "33363",
5
    description =>
6
        "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions",
7
    up => sub {
8
        my ($args) = @_;
9
        my ( $dbh, $out ) = @$args{qw(dbh out)};
10
11
        $dbh->do(
12
            q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_create', 'Create purchase suggestions')}
13
        );
14
        $dbh->do(
15
            q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_delete', 'Update purchase suggestions')}
16
        );
17
18
        $dbh->do(
19
            q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_create' FROM borrowers WHERE flags & (1 << 2)}
20
        );
21
        $dbh->do(
22
            q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_delete' FROM borrowers WHERE flags & (1 << 2)}
23
        );
24
    },
25
};
(-)a/installer/data/mysql/mandatory/userpermissions.sql (+2 lines)
Lines 91-97 INSERT INTO permissions (module_bit, code, description) VALUES Link Here
91
   (11, 'delete_invoices', 'Delete invoices'),
91
   (11, 'delete_invoices', 'Delete invoices'),
92
   (11, 'merge_invoices', 'Merge invoices'),
92
   (11, 'merge_invoices', 'Merge invoices'),
93
   (11, 'delete_baskets', 'Delete baskets'),
93
   (11, 'delete_baskets', 'Delete baskets'),
94
   (12, 'suggestions_create', 'Create purchase suggestions'),
94
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
95
   (12, 'suggestions_manage', 'Manage purchase suggestions'),
96
   (12, 'suggestions_delete', 'Delete purchase suggestions'),
95
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
97
   (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'),
96
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
98
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
97
   (13, 'edit_calendar', 'Define days when the library is closed'),
99
   (13, 'edit_calendar', 'Define days when the library is closed'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc (-1 / +1 lines)
Lines 6-12 Link Here
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
6
            <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
7
            <li><a href="/cgi-bin/koha/acqui/histsearch.pl">Advanced search</a></li>
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
8
            [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %]
9
            [% IF ( CAN_user_suggestions_suggestions_manage ) %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
9
            [% IF ( suggestion && ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete )  )  %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %]
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
10
            <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li>
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
11
            [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %]
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
12
                <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li>
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc (-1 / +1 lines)
Lines 226-232 Link Here
226
                [% END %]
226
                [% END %]
227
            [% END %]
227
            [% END %]
228
228
229
            [% IF CAN_user_suggestions_suggestions_manage %]
229
            [% IF CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete %]
230
                [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]
230
                [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]
231
                    <a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a>
231
                    <a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a>
232
                </li>
232
                </li>
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc (-1 / +1 lines)
Lines 59-65 Link Here
59
                    [% IF ( CAN_user_reports ) %]
59
                    [% IF ( CAN_user_reports ) %]
60
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
60
                        <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li>
61
                    [% END %]
61
                    [% END %]
62
                    [% IF ( CAN_user_suggestions_suggestions_manage ) %]
62
                    [% IF ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete ) %]
63
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
63
                        <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>
64
                    [% END %]
64
                    [% END %]
65
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
65
                    [% IF ( CAN_user_tools || CAN_user_clubs ) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (-1 / +1 lines)
Lines 127-133 Link Here
127
    [% END %]
127
    [% END %]
128
128
129
    [% IF filter == 'suggestions_managers' %]
129
    [% IF filter == 'suggestions_managers' %]
130
        <div class="note">Only staff with superlibrarian or suggestions_manage permissions are returned in the search results</div>
130
        <div class="note">Only staff with superlibrarian or full suggestions permissions are returned in the search results</div>
131
    [% ELSIF filter == 'orders_managers' OR filter == 'baskets_managers' %]
131
    [% ELSIF filter == 'orders_managers' OR filter == 'baskets_managers' %]
132
        <div class="note">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
132
        <div class="note">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
133
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
133
    [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc (+10 lines)
Lines 437-447 Link Here
437
            Add manual credits to a patron account
437
            Add manual credits to a patron account
438
        </span>
438
        </span>
439
        <span class="permissioncode">([% name | html %])</span>
439
        <span class="permissioncode">([% name | html %])</span>
440
    [%- CASE 'suggestions_create' -%]
441
        <span class="sub_permission suggestions_create_subpermission">
442
            Create purchase suggestions
443
        </span>
444
        <span class="permissioncode">([% name | html %])</span>
440
    [%- CASE 'suggestions_manage' -%]
445
    [%- CASE 'suggestions_manage' -%]
441
        <span class="sub_permission suggestions_manage_subpermission">
446
        <span class="sub_permission suggestions_manage_subpermission">
442
            Manage purchase suggestions
447
            Manage purchase suggestions
443
        </span>
448
        </span>
444
        <span class="permissioncode">([% name | html %])</span>
449
        <span class="permissioncode">([% name | html %])</span>
450
    [%- CASE 'suggestions_delete' -%]
451
        <span class="sub_permission suggestions_delete_subpermission">
452
            Delete purchase suggestions
453
        </span>
454
        <span class="permissioncode">([% name | html %])</span>
445
    [%- CASE 'budget_add_del' -%]
455
    [%- CASE 'budget_add_del' -%]
446
        <span class="sub_permission budget_add_del_subpermission">
456
        <span class="sub_permission budget_add_del_subpermission">
447
            Add and delete funds (but can't modify funds)
457
            Add and delete funds (but can't modify funds)
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt (-1 / +3 lines)
Lines 44-50 Link Here
44
                <h1>Purchase suggestions</h1>
44
                <h1>Purchase suggestions</h1>
45
45
46
                <div id="toolbar" class="btn-toolbar">
46
                <div id="toolbar" class="btn-toolbar">
47
                    <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add_form&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
47
                    [% IF CAN_user_suggestions_suggestions_create %]
48
                        <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add_form&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
49
                    [% END %]
48
                </div>
50
                </div>
49
51
50
                [% IF suggestions.size %]
52
                [% IF suggestions.size %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-29 / +60 lines)
Lines 97-111 Link Here
97
                    [% INCLUDE 'messages.inc' %]
97
                    [% INCLUDE 'messages.inc' %]
98
98
99
                    <div id="toolbar" class="btn-toolbar">
99
                    <div id="toolbar" class="btn-toolbar">
100
                        <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit_form&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
100
                        [% IF CAN_user_suggestions_suggestions_manage %]
101
                        <form class="delete_form" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl">
101
                            <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit_form&amp;suggestionid=[% suggestionid | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>a
102
                            [% INCLUDE 'csrf-token.inc' %]
102
                        [% END %]
103
                            <fieldset class="action">
103
                        [% IF CAN_user_suggestions_suggestions_delete %]
104
                                <input type="hidden" name="op" value="cud-delete" />
104
                            <form class="delete_form" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl">
105
                                <input type="hidden" name="suggestionid" value="[% suggestionid | html %]" />
105
                                [% INCLUDE 'csrf-token.inc' %]
106
                                <button type="submit" class="btn btn-primary">Delete</button>
106
                                <fieldset class="action">
107
                            </fieldset>
107
                                    <input type="hidden" name="op" value="cud-delete" />
108
                        </form>
108
                                    <input type="hidden" name="suggestionid" value="[% suggestionid | html %]" />
109
                                    <button type="submit" class="btn btn-primary">Delete</button>
110
                                </fieldset>
111
                            </form>
112
                        [% END %]
109
                    </div>
113
                    </div>
110
114
111
                    <fieldset class="rows">
115
                    <fieldset class="rows">
Lines 340-345 Link Here
340
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
344
                        <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span>
341
                    [%  CASE 'manager_not_enough_permissions' %]
345
                    [%  CASE 'manager_not_enough_permissions' %]
342
                        <span>The manager you selected does not have sufficient permissions.</span>
346
                        <span>The manager you selected does not have sufficient permissions.</span>
347
                    [% CASE 'no_manage_permission' %]
348
                        <span>You do not have permissions to manage suggestions</span>
349
                    [% CASE 'no_create_permission' %]
350
                        <span>You do not have permissions to create suggestions</span>
351
                    [% CASE 'no_delete_permission' %]
352
                        <span>You do not have permissions to delete suggestions</span>
343
                    [% CASE %]
353
                    [% CASE %]
344
                        <span>[% m.code | html %]</span>
354
                        <span>[% m.code | html %]</span>
345
                    [% END %]
355
                    [% END %]
Lines 560-566 Link Here
560
                            <label for="managedby_name">by:</label>
570
                            <label for="managedby_name">by:</label>
561
                            <div>
571
                            <div>
562
                                <span id="managedby_name" name="managedby_name">
572
                                <span id="managedby_name" name="managedby_name">
563
                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
573
                                    [% IF CAN_user_suggestions_suggestions_manage %]
574
                                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a>
575
                                    [% ELSE %]
576
                                        Nobody
577
                                    [% END %]
564
                                </span>
578
                                </span>
565
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
579
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
566
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
580
                                    | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %])
Lines 570-576 Link Here
570
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
584
                                [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %]
571
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
585
                                    <a id="restore_previous_manager" href="#"><i class="fa fa-trash-can"></i> Keep existing manager</a>
572
                                [% END %]
586
                                [% END %]
573
                                <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
587
                                [% IF CAN_user_suggestions_suggestions_manage %]
588
                                    <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" />
589
                                [% END %]
574
590
575
                                <br/>
591
                                <br/>
576
                                <label for="notify">Notify manager:</label>
592
                                <label for="notify">Notify manager:</label>
Lines 665-671 Link Here
665
681
666
        [% IF op == 'else' %]
682
        [% IF op == 'else' %]
667
            <div id="toolbar" class="btn-toolbar">
683
            <div id="toolbar" class="btn-toolbar">
668
                <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add_form&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
684
                [% IF CAN_user_suggestions_suggestions_create %]
685
                    <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add_form&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
686
                [% END %]
669
            </div>
687
            </div>
670
688
671
            <h1>Suggestions management</h1>
689
            <h1>Suggestions management</h1>
Lines 859-881 Link Here
859
                                                        [% END %]
877
                                                        [% END %]
860
                                                    </td>
878
                                                    </td>
861
                                                    <td class="actions">
879
                                                    <td class="actions">
862
                                                        <div class="btn-group dropup">
880
                                                        [% IF CAN_user_suggestions_suggestions_manage %]
863
                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
881
                                                            <div class="btn-group dropup">
864
                                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
882
                                                                <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
865
                                                                <li>
883
                                                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
866
                                                                    <button data-op="cud-delete" data-suggestionid="[% s.suggestionid | html %]" class="btn btn-default trigger_action">Delete</button>
884
                                                                    [% IF CAN_user_suggestions_suggestions_delete %]
867
                                                                </li>
885
                                                                        <li>
868
                                                                [% UNLESS s.archived %]
886
                                                                            <button data-op="cud-delete" data-suggestionid="[% s.suggestionid | html %]" class="btn btn-default trigger_action">Delete</button>
869
                                                                    <li>
887
                                                                        </li>
870
                                                                        <button class="btn btn-default trigger_action" data-op="cud-archive" data-suggestionid="[% s.suggestionid | html %]">Archive</button>
888
                                                                    [% END %]
871
                                                                    </li>
889
                                                                    [% UNLESS s.archived %]
872
                                                                [% ELSE %]
890
                                                                        <li>
873
                                                                    <li>
891
                                                                            <button class="btn btn-default trigger_action" data-op="cud-archive" data-suggestionid="[% s.suggestionid | html %]">Archive</button>
874
                                                                        <button class="btn btn-default trigger_action" data-op="cud-unarchive" data-suggestionid="[% s.suggestionid | html %]">Unarchive</button>
892
                                                                        </li>
875
                                                                    </li>
893
                                                                    [% ELSE %]
876
                                                                [% END %]
894
                                                                        <li>
877
                                                            </ul>
895
                                                                            <button class="btn btn-default trigger_action" data-op="cud-unarchive" data-suggestionid="[% s.suggestionid | html %]">Unarchive</button>
878
                                                        </div>
896
                                                                        </li>
897
                                                                    [% END %]
898
                                                                </ul>
899
                                                            </div>
900
                                                        [% ELSIF CAN_user_suggestions_suggestions_delete %]
901
                                                            <button data-op="cud-delete" data-suggestionid="[% s.suggestionid | html %]" class="btn btn-default trigger_action">Delete</button>
902
                                                        [% END %]
879
                                                    </td>
903
                                                    </td>
880
                                                </tr>
904
                                                </tr>
881
                                            [% END # /FOREACH s %]
905
                                            [% END # /FOREACH s %]
Lines 888-893 Link Here
888
                                        </div>
912
                                        </div>
889
                                    </div>
913
                                    </div>
890
                                    <div class="suggestions_batch_ops row">
914
                                    <div class="suggestions_batch_ops row">
915
                                        [% IF CAN_user_suggestions_suggestions_manage %]
891
                                        <div class="col-sm-4">
916
                                        <div class="col-sm-4">
892
                                            <fieldset class="brief">
917
                                            <fieldset class="brief">
893
                                                <div id="select-reason[% loop.index | html %]">
918
                                                <div id="select-reason[% loop.index | html %]">
Lines 980-986 Link Here
980
                                                <button type="submit" data-op="cud-update_manager" class="btn btn-primary">Submit</button>
1005
                                                <button type="submit" data-op="cud-update_manager" class="btn btn-primary">Submit</button>
981
                                            </fieldset>
1006
                                            </fieldset>
982
                                        </div> <!-- /.col-sm-2 -->
1007
                                        </div> <!-- /.col-sm-2 -->
1008
                                        [% END %]
983
1009
1010
                                        [% IF CAN_user_suggestions_suggestions_delete %]
984
                                        <div class="col-sm-2">
1011
                                        <div class="col-sm-2">
985
                                            <fieldset class="brief">
1012
                                            <fieldset class="brief">
986
                                                <span class="label">Delete selected</span>
1013
                                                <span class="label">Delete selected</span>
Lines 991-996 Link Here
991
                                                <button type="submit" data-op="cud-delete" class="btn btn-primary">Delete</button>
1018
                                                <button type="submit" data-op="cud-delete" class="btn btn-primary">Delete</button>
992
                                            </fieldset>
1019
                                            </fieldset>
993
                                        </div> <!-- /.col-sm-2 -->
1020
                                        </div> <!-- /.col-sm-2 -->
1021
                                        [% END %]
1022
1023
                                        [% IF CAN_user_suggestions_suggestions_manage %]
994
                                        <div class="col-sm-2">
1024
                                        <div class="col-sm-2">
995
                                            <fieldset class="brief">
1025
                                            <fieldset class="brief">
996
                                                <span class="label">Archive selected</span>
1026
                                                <span class="label">Archive selected</span>
Lines 1001-1006 Link Here
1001
                                                </fieldset>
1031
                                                </fieldset>
1002
                                            </fieldset>
1032
                                            </fieldset>
1003
                                        </div> <!-- /.col-sm-2 -->
1033
                                        </div> <!-- /.col-sm-2 -->
1034
                                        [% END %]
1004
                                    </div> <!-- /.row -->
1035
                                    </div> <!-- /.row -->
1005
1036
1006
                                [% ELSE %]
1037
                                [% ELSE %]
(-)a/members/purchase-suggestions.pl (-1 / +1 lines)
Lines 32-38 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
32
    {   template_name   => "members/purchase-suggestions.tt",
32
    {   template_name   => "members/purchase-suggestions.tt",
33
        query           => $input,
33
        query           => $input,
34
        type            => "intranet",
34
        type            => "intranet",
35
        flagsrequired   => { suggestions => 'suggestions_manage' },
35
        flagsrequired   => { suggestions => '*' },
36
    }
36
    }
37
);
37
);
38
38
(-)a/suggestion/suggestion.pl (-25 / +62 lines)
Lines 125-137 unless ( $op eq 'cud-save' ) { Link Here
125
}
125
}
126
126
127
my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user(
127
my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user(
128
        {
128
    {
129
            template_name   => "suggestion/suggestion.tt",
129
        template_name => "suggestion/suggestion.tt",
130
            query           => $input,
130
        query         => $input,
131
            type            => "intranet",
131
        type          => "intranet",
132
            flagsrequired   => { suggestions => 'suggestions_manage' },
132
        flagsrequired => { suggestions => '*' },
133
        }
133
    }
134
    );
134
);
135
136
my $librarian = Koha::Patrons->find($borrowernumber);
135
137
136
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
138
$borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') );
137
$template->param('borrowernumber' => $borrowernumber);
139
$template->param('borrowernumber' => $borrowernumber);
Lines 141-148 my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch Link Here
141
##  Operations
143
##  Operations
142
##
144
##
143
145
146
my @messages;
144
if ( $op =~ /cud-save/ ) {
147
if ( $op =~ /cud-save/ ) {
148
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
149
145
    my @messages;
150
    my @messages;
151
146
    my $biblio = MarcRecordFromNewSuggestion({
152
    my $biblio = MarcRecordFromNewSuggestion({
147
            title => $suggestion_only->{title},
153
            title => $suggestion_only->{title},
148
            author => $suggestion_only->{author},
154
            author => $suggestion_only->{author},
Lines 201-207 if ( $op =~ /cud-save/ ) { Link Here
201
              if exists $suggestion_only->{branchcode}
207
              if exists $suggestion_only->{branchcode}
202
              && $suggestion_only->{branchcode} eq "";
208
              && $suggestion_only->{branchcode} eq "";
203
209
204
            &ModSuggestion($suggestion_only);
210
            if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
211
                &ModSuggestion($suggestion_only);
212
            } else {
213
                push @messages, { type => 'error', code => 'no_manage_permission' };
214
                $template->param( messages => \@messages, );
215
            }
205
216
206
            if ( $notify ) {
217
            if ( $notify ) {
207
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
218
                my $patron = Koha::Patrons->find( $suggestion_only->{managedby} );
Lines 241-247 if ( $op =~ /cud-save/ ) { Link Here
241
            }
252
            }
242
            else {
253
            else {
243
                ## Adding some informations related to suggestion
254
                ## Adding some informations related to suggestion
244
                Koha::Suggestion->new($suggestion_only)->store();
255
                if ( $librarian->has_permission( { 'suggestions' => 'suggestions_create' } ) ) {
256
                    Koha::Suggestion->new($suggestion_only)->store();
257
                } else {
258
                    push @messages, { type => 'error', code => 'no_delete_permission' };
259
                    $template->param( messages => \@messages );
260
                }
245
            }
261
            }
246
            # empty fields, to avoid filter in "SearchSuggestion"
262
            # empty fields, to avoid filter in "SearchSuggestion"
247
        }
263
        }
Lines 303-319 elsif ($op eq "cud-update_status" ) { Link Here
303
        $suggestion->{reason} = $reason;
319
        $suggestion->{reason} = $reason;
304
    }
320
    }
305
321
306
    foreach my $suggestionid (@editsuggestions) {
322
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
307
        next unless $suggestionid;
323
        foreach my $suggestionid (@editsuggestions) {
308
        $suggestion->{suggestionid} = $suggestionid;
324
            next unless $suggestionid;
309
        &ModSuggestion($suggestion);
325
            $suggestion->{suggestionid} = $suggestionid;
326
            &ModSuggestion($suggestion);
327
        }
328
        redirect_with_params($input);
329
    } else {
330
        push @messages, { type => 'error', code => 'no_manage_permission' };
331
        $template->param( messages => \@messages, );
310
    }
332
    }
311
    redirect_with_params($input);
333
    redirect_with_params($input);
312
}elsif ($op eq "cud-delete" ) {
334
} elsif ($op eq "cud-delete" ) {
313
    foreach my $delete_field (@editsuggestions) {
335
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_delete' } ) ) {
314
        &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
336
        foreach my $delete_field (@editsuggestions) {
337
            &DelSuggestion( $borrowernumber, $delete_field, 'intranet' );
338
        }
339
        redirect_with_params($input);
340
    } else {
341
        push @messages, { type => 'error', code => 'no_delete_permission' };
342
        $template->param( messages => \@messages, );
315
    }
343
    }
316
    redirect_with_params($input);
317
}
344
}
318
elsif ($op eq "cud-archive" ) {
345
elsif ($op eq "cud-archive" ) {
319
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
346
    Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions;
Lines 324-341 elsif ($op eq "cud-unarchive" ) { Link Here
324
    redirect_with_params($input);
351
    redirect_with_params($input);
325
}
352
}
326
elsif ( $op eq 'cud-update_itemtype' ) {
353
elsif ( $op eq 'cud-update_itemtype' ) {
327
    foreach my $suggestionid (@editsuggestions) {
354
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
328
        next unless $suggestionid;
355
        foreach my $suggestionid (@editsuggestions) {
329
        &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype });
356
            next unless $suggestionid;
357
            &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype });
358
        }
359
        redirect_with_params($input);
360
    } else {
361
        push @messages, { type => 'error', code => 'no_manage_permission' };
362
        $template->param( messages => \@messages, );
330
    }
363
    }
331
    redirect_with_params($input);
332
}
364
}
333
elsif ( $op eq 'cud-update_manager' ) {
365
elsif ( $op eq 'cud-update_manager' ) {
334
    foreach my $suggestionid (@editsuggestions) {
366
    if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) {
335
        next unless $suggestionid;
367
        foreach my $suggestionid (@editsuggestions) {
336
        &ModSuggestion({ suggestionid => $suggestionid, managedby => $sugg_managedby });
368
            next unless $suggestionid;
369
            &ModSuggestion({ suggestionid => $suggestionid, managedby => $sugg_managedby });
370
        }
371
        redirect_with_params($input);
372
    } else {
373
        push @messages, { type => 'error', code => 'no_manage_permission' };
374
        $template->param( messages => \@messages, );
337
    }
375
    }
338
    redirect_with_params($input);
339
}
376
}
340
elsif ( $op eq 'show' ) {
377
elsif ( $op eq 'show' ) {
341
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
378
    $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
(-)a/t/Koha/Auth/Permissions.t (-1 / +2 lines)
Lines 244-250 subtest 'superlibrarian tests' => sub { Link Here
244
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
244
        'CAN_user_stockrotation_manage_rota_items'                  => 1,
245
        'CAN_user_stockrotation_manage_rotas'                       => 1,
245
        'CAN_user_stockrotation_manage_rotas'                       => 1,
246
        'CAN_user_stockrotation'                                    => 1,
246
        'CAN_user_stockrotation'                                    => 1,
247
        'CAN_user_suggestions_suggestions_create'                   => 1,
247
        'CAN_user_suggestions_suggestions_manage'                   => 1,
248
        'CAN_user_suggestions_suggestions_manage'                   => 1,
249
        'CAN_user_suggestions_suggestions_delete'                   => 1,
248
        'CAN_user_suggestions'                                      => 1,
250
        'CAN_user_suggestions'                                      => 1,
249
        'CAN_user_superlibrarian'                                   => 1,
251
        'CAN_user_superlibrarian'                                   => 1,
250
        'CAN_user_tools_access_files'                               => 1,
252
        'CAN_user_tools_access_files'                               => 1,
251
- 

Return to bug 33363