Attachment #18340 for bug #7295

View | Details | Raw Unified | Return to bug 7295
Collapse All | Expand All




The third parameter is optional. If given, it should be a hashref as returned
by C4::Auth::getuserflags. If not, getuserflags is called.

Fourth parameter is a hash of options.
Avaiable options are:

=over 2

=item * B<assume_in_user_list>:
Assume the borrower is in the basket's users list. So don't check this. This
is useful to check if a borrower can be added to the users list.

=back

If user is authorised to manage basket, returns 1.
Otherwise returns 0.

=cut

sub CanUserManageBasket {
    my ($borrower, $basket, $userflags, %options) = @_;

    if (!ref $borrower) {
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);

            return 0;
        }

        unless ($options{assume_in_user_list}) {
            if ($AcqViewBaskets eq 'user'
            && $basket->{authorisedby} != $borrowernumber
            && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
                return 0;
            }
        }

        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}




use C4::Auth;
use C4::Output;
use C4::Members;
use C4::Acquisition;

my $input = new CGI;



my $q = $input->param('q') || '';
my $op = $input->param('op') || '';
my $basketno = $input->param('basketno');
my $basket = C4::Acquisition::GetBasket($basketno);

if( $op eq "do_search" ) {
    my $results = C4::Members::Search( $q, "surname");

    my @users_loop;
    my $nresults = 0;
    foreach my $borrower (@$results) {
        if (C4::Acquisition::CanUserManageBasket(
                $borrower, $basket, undef, assume_in_user_list => 1))
        {
        if( $perms->{superlibrarian} == 1
         || $perms->{acquisition} == 1
         || $subperms->{acquisition}->{'order_manage'} ) {
            my %row = (
                borrowernumber => $borrower->{borrowernumber},
                cardnumber     => $borrower->{cardnumber},
                surname        => $borrower->{surname},
                firstname      => $borrower->{firstname},
                categorycode   => $borrower->{categorycode},
                branchcode     => $borrower->{branchcode},
            );
            push( @users_loop, \%row );
            $nresults++;
        }
    }


    );
}

$template->param(basketno => $basketno);

output_html_with_http_headers( $input, $cookie, $template->output );

Lines 6961-6966 if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) { Link Here

(-)a/installer/data/mysql/updatedatabase.pl (+5 lines)
6961	ON UPDATE CASCADE ON DELETE SET NULL	6961	ON UPDATE CASCADE ON DELETE SET NULL
6962	");	6962	");
6963	$dbh->do("	6963	$dbh->do("
		6964	UPDATE aqbasket, borrowers
		6965	SET aqbasket.branch = borrowers.branchcode
		6966	WHERE aqbasket.authorisedby = borrowers.borrowernumber
		6967	");
		6968	$dbh->do("
6964	DROP TABLE IF EXISTS aqbasketusers	6969	DROP TABLE IF EXISTS aqbasketusers
6965	");	6970	");
6966	$dbh->do("	6971	$dbh->do("




      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
        <fieldset>
          <input type="hidden" name="op" id="op" value="do_search" />
          <input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
          <input type="submit" class="button" value="Search" />
        </fieldset>
        <p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
        <p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
      </form>

[% IF (q) %]

Lines 117-123 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-2 / +1 lines)
117		117
118	function basketUserSearchPopup(f) {	118	function basketUserSearchPopup(f) {
119	window.open(	119	window.open(
120	"/cgi-bin/koha/acqui/aqbasketuser_search.pl",	120	"/cgi-bin/koha/acqui/aqbasketuser_search.pl?basketno=[% basketno %]",
121	'BasketUserSearchPopup',	121	'BasketUserSearchPopup',
122	'width=740,height=450,toolbar=no,'	122	'width=740,height=450,toolbar=no,'
123	);	123	);
124	-

Return to bug 7295

Lines 692-704 C4::Acquisition::GetBasket. Link Here

(-)a/C4/Acquisition.pm (-5 / +18 lines)
692	The third parameter is optional. If given, it should be a hashref as returned	692	The third parameter is optional. If given, it should be a hashref as returned
693	by C4::Auth::getuserflags. If not, getuserflags is called.	693	by C4::Auth::getuserflags. If not, getuserflags is called.
694		694
		695	Fourth parameter is a hash of options.
		696	Avaiable options are:
		697
		698	=over 2
		699
		700	=item * B<assume_in_user_list>:
		701	Assume the borrower is in the basket's users list. So don't check this. This
		702	is useful to check if a borrower can be added to the users list.
		703
		704	=back
		705
695	If user is authorised to manage basket, returns 1.	706	If user is authorised to manage basket, returns 1.
696	Otherwise returns 0.	707	Otherwise returns 0.
697		708
698	=cut	709	=cut
699		710
700	sub CanUserManageBasket {	711	sub CanUserManageBasket {
701	my ($borrower, $basket, $userflags) = @_;	712	my ($borrower, $basket, $userflags, %options) = @_;
702		713
703	if (!ref $borrower) {	714	if (!ref $borrower) {
704	$borrower = C4::Members::GetMember(borrowernumber => $borrower);	715	$borrower = C4::Members::GetMember(borrowernumber => $borrower);
Lines 737-746 sub CanUserManageBasket { Link Here
737	return 0;	748	return 0;
738	}	749	}
739		750
740	if ($AcqViewBaskets eq 'user'	751	unless ($options{assume_in_user_list}) {
741	&& $basket->{authorisedby} != $borrowernumber	752	if ($AcqViewBaskets eq 'user'
742	&& grep($borrowernumber, GetBasketUsers($basketno)) == 0) {	753	&& $basket->{authorisedby} != $borrowernumber
743	return 0;	754	&& grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
		755	return 0;
		756	}
744	}	757	}
745		758
746	if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}	759	if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}

Lines 25-30 use CGI; Link Here

(-)a/acqui/aqbasketuser_search.pl (-14 / +16 lines)
25	use C4::Auth;	25	use C4::Auth;
26	use C4::Output;	26	use C4::Output;
27	use C4::Members;	27	use C4::Members;
		28	use C4::Acquisition;
28		29
29	my $input = new CGI;	30	my $input = new CGI;
30		31
Lines 41-69 my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user( Link Here
41		42
42	my $q = $input->param('q') \|\| '';	43	my $q = $input->param('q') \|\| '';
43	my $op = $input->param('op') \|\| '';	44	my $op = $input->param('op') \|\| '';
		45	my $basketno = $input->param('basketno');
		46	my $basket = C4::Acquisition::GetBasket($basketno);
44		47
45	if( $op eq "do_search" ) {	48	if( $op eq "do_search" ) {
46	my $results = C4::Members::Search( $q, "surname");	49	my $results = C4::Members::Search( $q, "surname");
47		50
48	my @users_loop;	51	my @users_loop;
49	my $nresults = 0;	52	my $nresults = 0;
50	foreach my $res (@$results) {	53	foreach my $borrower (@$results) {
51	my $perms = haspermission( $res->{userid} );	54	if (C4::Acquisition::CanUserManageBasket(
52	my $subperms = get_user_subpermissions( $res->{userid} );	55	$borrower, $basket, undef, assume_in_user_list => 1))
53		56	{
54	if( $perms->{superlibrarian} == 1
55	\|\| $perms->{acquisition} == 1
56	\|\| $subperms->{acquisition}->{'order_manage'} ) {
57	my %row = (	57	my %row = (
58	borrowernumber => $res->{borrowernumber},	58	borrowernumber => $borrower->{borrowernumber},
59	cardnumber => $res->{cardnumber},	59	cardnumber => $borrower->{cardnumber},
60	surname => $res->{surname},	60	surname => $borrower->{surname},
61	firstname => $res->{firstname},	61	firstname => $borrower->{firstname},
62	categorycode => $res->{categorycode},	62	categorycode => $borrower->{categorycode},
63	branchcode => $res->{branchcode},	63	branchcode => $borrower->{branchcode},
64	);	64	);
65	push( @users_loop, \%row );	65	push( @users_loop, \%row );
66	$nresults ++;	66	$nresults++;
67	}	67	}
68	}	68	}
69		69
Lines 74-77 if( $op eq "do_search" ) { Link Here
74	);	74	);
75	}	75	}
76		76
		77	$template->param(basketno => $basketno);
		78
77	output_html_with_http_headers( $input, $cookie, $template->output );	79	output_html_with_http_headers( $input, $cookie, $template->output );

Lines 34-43 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/aqbasketuser_search.tt (-1 / +3 lines)
34	<form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">	34	<form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
35	<fieldset>	35	<fieldset>
36	<input type="hidden" name="op" id="op" value="do_search" />	36	<input type="hidden" name="op" id="op" value="do_search" />
		37	<input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
37	<input type="text" name="q" id="q" value="[% q %]" class="focus" />	38	<input type="text" name="q" id="q" value="[% q %]" class="focus" />
38	<input type="submit" class="button" value="Search" />	39	<input type="submit" class="button" value="Search" />
39	</fieldset>	40	</fieldset>
40	<div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>	41	<p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
		42	<p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
41	</form>	43	</form>
42		44
43	[% IF (q) %]	45	[% IF (q) %]