Attachment #19753 for bug #7295

View | Details | Raw Unified | Return to bug 7295
Collapse All | Expand All




The third parameter is optional. If given, it should be a hashref as returned
by C4::Auth::getuserflags. If not, getuserflags is called.

Fourth parameter is a hash of options.
Avaiable options are:

=over 2

=item * B<assume_in_user_list>:
Assume the borrower is in the basket's users list. So don't check this. This
is useful to check if a borrower can be added to the users list.

=back

If user is authorised to manage basket, returns 1.
Otherwise returns 0.

=cut

sub CanUserManageBasket {
    my ($borrower, $basket, $userflags, %options) = @_;

    if (!ref $borrower) {
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);

            return 0;
        }

        unless ($options{assume_in_user_list}) {
            if ($AcqViewBaskets eq 'user'
            && $basket->{authorisedby} != $borrowernumber
            && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
                return 0;
            }
        }

        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}




use C4::Auth;
use C4::Output;
use C4::Members;
use C4::Acquisition;

my $input = new CGI;



my $q = $input->param('q') || '';
my $op = $input->param('op') || '';
my $basketno = $input->param('basketno');
my $basket = C4::Acquisition::GetBasket($basketno);

if( $op eq "do_search" ) {
    my $results = C4::Members::Search( $q, "surname");

    my @users_loop;
    my $nresults = 0;
    foreach my $borrower (@$results) {
        if (C4::Acquisition::CanUserManageBasket(
                $borrower, $basket, undef, assume_in_user_list => 1))
        {
        if( $perms->{superlibrarian} == 1
         || $perms->{acquisition} == 1
         || $subperms->{acquisition}->{'order_manage'} ) {
            my %row = (
                borrowernumber => $borrower->{borrowernumber},
                cardnumber     => $borrower->{cardnumber},
                surname        => $borrower->{surname},
                firstname      => $borrower->{firstname},
                categorycode   => $borrower->{categorycode},
                branchcode     => $borrower->{branchcode},
            );
            push( @users_loop, \%row );
            $nresults++;
        }
    }


    );
}

$template->param(basketno => $basketno);

output_html_with_http_headers( $input, $cookie, $template->output );

Lines 7055-7060 if ( CheckVersion($DBversion) ) { Link Here

(-)a/installer/data/mysql/updatedatabase.pl (+5 lines)
7055	ON UPDATE CASCADE ON DELETE SET NULL	7055	ON UPDATE CASCADE ON DELETE SET NULL
7056	");	7056	");
7057	$dbh->do("	7057	$dbh->do("
		7058	UPDATE aqbasket, borrowers
		7059	SET aqbasket.branch = borrowers.branchcode
		7060	WHERE aqbasket.authorisedby = borrowers.borrowernumber
		7061	");
		7062	$dbh->do("
7058	DROP TABLE IF EXISTS aqbasketusers	7063	DROP TABLE IF EXISTS aqbasketusers
7059	");	7064	");
7060	$dbh->do("	7065	$dbh->do("




      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
        <fieldset>
          <input type="hidden" name="op" id="op" value="do_search" />
          <input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
          <input type="submit" class="button" value="Search" />
        </fieldset>
        <p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
        <p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
      </form>

[% IF (q) %]

Lines 117-123 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-2 / +1 lines)
117		117
118	function basketUserSearchPopup(f) {	118	function basketUserSearchPopup(f) {
119	window.open(	119	window.open(
120	"/cgi-bin/koha/acqui/aqbasketuser_search.pl",	120	"/cgi-bin/koha/acqui/aqbasketuser_search.pl?basketno=[% basketno %]",
121	'BasketUserSearchPopup',	121	'BasketUserSearchPopup',
122	'width=740,height=450,toolbar=no,'	122	'width=740,height=450,toolbar=no,'
123	);	123	);
124	-

Return to bug 7295

Lines 697-709 C4::Acquisition::GetBasket. Link Here

(-)a/C4/Acquisition.pm (-5 / +18 lines)
697	The third parameter is optional. If given, it should be a hashref as returned	697	The third parameter is optional. If given, it should be a hashref as returned
698	by C4::Auth::getuserflags. If not, getuserflags is called.	698	by C4::Auth::getuserflags. If not, getuserflags is called.
699		699
		700	Fourth parameter is a hash of options.
		701	Avaiable options are:
		702
		703	=over 2
		704
		705	=item * B<assume_in_user_list>:
		706	Assume the borrower is in the basket's users list. So don't check this. This
		707	is useful to check if a borrower can be added to the users list.
		708
		709	=back
		710
700	If user is authorised to manage basket, returns 1.	711	If user is authorised to manage basket, returns 1.
701	Otherwise returns 0.	712	Otherwise returns 0.
702		713
703	=cut	714	=cut
704		715
705	sub CanUserManageBasket {	716	sub CanUserManageBasket {
706	my ($borrower, $basket, $userflags) = @_;	717	my ($borrower, $basket, $userflags, %options) = @_;
707		718
708	if (!ref $borrower) {	719	if (!ref $borrower) {
709	$borrower = C4::Members::GetMember(borrowernumber => $borrower);	720	$borrower = C4::Members::GetMember(borrowernumber => $borrower);
Lines 742-751 sub CanUserManageBasket { Link Here
742	return 0;	753	return 0;
743	}	754	}
744		755
745	if ($AcqViewBaskets eq 'user'	756	unless ($options{assume_in_user_list}) {
746	&& $basket->{authorisedby} != $borrowernumber	757	if ($AcqViewBaskets eq 'user'
747	&& grep($borrowernumber, GetBasketUsers($basketno)) == 0) {	758	&& $basket->{authorisedby} != $borrowernumber
748	return 0;	759	&& grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
		760	return 0;
		761	}
749	}	762	}
750		763
751	if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}	764	if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}

Lines 25-30 use CGI; Link Here

(-)a/acqui/aqbasketuser_search.pl (-14 / +16 lines)
25	use C4::Auth;	25	use C4::Auth;
26	use C4::Output;	26	use C4::Output;
27	use C4::Members;	27	use C4::Members;
		28	use C4::Acquisition;
28		29
29	my $input = new CGI;	30	my $input = new CGI;
30		31
Lines 41-69 my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user( Link Here
41		42
42	my $q = $input->param('q') \|\| '';	43	my $q = $input->param('q') \|\| '';
43	my $op = $input->param('op') \|\| '';	44	my $op = $input->param('op') \|\| '';
		45	my $basketno = $input->param('basketno');
		46	my $basket = C4::Acquisition::GetBasket($basketno);
44		47
45	if( $op eq "do_search" ) {	48	if( $op eq "do_search" ) {
46	my $results = C4::Members::Search( $q, "surname");	49	my $results = C4::Members::Search( $q, "surname");
47		50
48	my @users_loop;	51	my @users_loop;
49	my $nresults = 0;	52	my $nresults = 0;
50	foreach my $res (@$results) {	53	foreach my $borrower (@$results) {
51	my $perms = haspermission( $res->{userid} );	54	if (C4::Acquisition::CanUserManageBasket(
52	my $subperms = get_user_subpermissions( $res->{userid} );	55	$borrower, $basket, undef, assume_in_user_list => 1))
53		56	{
54	if( $perms->{superlibrarian} == 1
55	\|\| $perms->{acquisition} == 1
56	\|\| $subperms->{acquisition}->{'order_manage'} ) {
57	my %row = (	57	my %row = (
58	borrowernumber => $res->{borrowernumber},	58	borrowernumber => $borrower->{borrowernumber},
59	cardnumber => $res->{cardnumber},	59	cardnumber => $borrower->{cardnumber},
60	surname => $res->{surname},	60	surname => $borrower->{surname},
61	firstname => $res->{firstname},	61	firstname => $borrower->{firstname},
62	categorycode => $res->{categorycode},	62	categorycode => $borrower->{categorycode},
63	branchcode => $res->{branchcode},	63	branchcode => $borrower->{branchcode},
64	);	64	);
65	push( @users_loop, \%row );	65	push( @users_loop, \%row );
66	$nresults ++;	66	$nresults++;
67	}	67	}
68	}	68	}
69		69
Lines 74-77 if( $op eq "do_search" ) { Link Here
74	);	74	);
75	}	75	}
76		76
		77	$template->param(basketno => $basketno);
		78
77	output_html_with_http_headers( $input, $cookie, $template->output );	79	output_html_with_http_headers( $input, $cookie, $template->output );

Lines 34-43 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/aqbasketuser_search.tt (-1 / +3 lines)
34	<form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">	34	<form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
35	<fieldset>	35	<fieldset>
36	<input type="hidden" name="op" id="op" value="do_search" />	36	<input type="hidden" name="op" id="op" value="do_search" />
		37	<input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
37	<input type="text" name="q" id="q" value="[% q %]" class="focus" />	38	<input type="text" name="q" id="q" value="[% q %]" class="focus" />
38	<input type="submit" class="button" value="Search" />	39	<input type="submit" class="button" value="Search" />
39	</fieldset>	40	</fieldset>
40	<div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>	41	<p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
		42	<p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
41	</form>	43	</form>
42		44
43	[% IF (q) %]	45	[% IF (q) %]