Attachment 107354 Details for Bug 24157 – Bug 24157: Handle the case where logged in user does not have edit_invoices

[patch] Bug 24157: Handle the case where logged in user does not have edit_invoices

Bug-24157-Handle-the-case-where-logged-in-user-doe.patch (text/plain), 4.22 KB, created by Alex Arnaud on 2020-07-24 13:08:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alex Arnaud

Created: 2020-07-24 13:08:45 UTC

Size: 4.22 KB

patch

obsolete

>From 7d6e84f9e7d2736fba8f367ccf3b7f40885e7f31 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Fri, 24 Jul 2020 13:03:31 +0200
>Subject: [PATCH] Bug 24157: Handle the case where logged in user does not have
> edit_invoices
>
>This patch make possible the reopening and merging of invoices even if
>the logged in user does not have the edit_invoices permission
>
>I don't think it really makes sense but at least it's now possible.
>
>Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>
>---
> acqui/invoice.pl                                      | 19 ++++++++++++++++++-
> .../intranet-tmpl/prog/en/modules/acqui/invoice.tt    |  2 ++
> .../intranet-tmpl/prog/en/modules/acqui/invoices.tt   |  2 ++
> 3 files changed, 22 insertions(+), 1 deletion(-)
>
>diff --git a/acqui/invoice.pl b/acqui/invoice.pl
>index 00f5ff2bb0..fa6dc26c1e 100755
>--- a/acqui/invoice.pl
>+++ b/acqui/invoice.pl
>@@ -58,7 +58,10 @@ my $op        = $input->param('op');
> 
> output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
>   if $op
>-  && not $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
>+  && ! $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } )
>+  && ! $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } )
>+  && ! $logged_in_patron->has_permission( { acquisition => 'merge_invoices' } )
>+  && ! $logged_in_patron->has_permission( { acquisition => 'delete_invoices' } );
> 
> my $invoice_files;
> if ( C4::Context->preference('AcqEnableFiles') ) {
>@@ -67,6 +70,8 @@ if ( C4::Context->preference('AcqEnableFiles') ) {
> }
> 
> if ( $op && $op eq 'close' ) {
>+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
>+        unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
>     CloseInvoice($invoiceid);
>     my $referer = $input->param('referer');
>     if ($referer) {
>@@ -101,6 +106,10 @@ elsif ( $op && $op eq 'mod' ) {
>         ReopenInvoice($invoiceid)
>             if $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
>     } elsif ($input->param('close')) {
>+
>+        output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
>+            unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
>+
>         CloseInvoice($invoiceid);
>     } elsif ($input->param('merge')) {
> 
>@@ -127,11 +136,19 @@ elsif ( $op && $op eq 'delete' ) {
>     }
> }
> elsif ( $op && $op eq 'del_adj' ) {
>+
>+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
>+        unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
>+
>     my $adjustment_id  = $input->param('adjustment_id');
>     my $del_adj = Koha::Acquisition::Invoice::Adjustments->find( $adjustment_id );
>     $del_adj->delete() if ($del_adj);
> }
> elsif ( $op && $op eq 'mod_adj' ) {
>+
>+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
>+        unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
>+
>     my @adjustment_id  = $input->multi_param('adjustment_id');
>     my @adjustment     = $input->multi_param('adjustment');
>     my @reason         = $input->multi_param('reason');
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
>index 10367982ba..2348004cd6 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
>@@ -24,6 +24,8 @@
>         <div class="col-sm-10 col-sm-push-2">
>             <main>
> 
>+                [% INCLUDE 'blocking_errors.inc' %]
>+
>       [% IF ( modified ) %]
>         <div class="dialog message">
>           <p>Invoice has been modified</p>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>index 57aeb2749b..4536842f41 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>@@ -20,6 +20,8 @@
>         <div class="col-sm-10 col-sm-push-2">
>             <main>
> 
>+                [% INCLUDE 'blocking_errors.inc' %]
>+
>       <h1>Invoices</h1>
>       [% IF ( do_search ) %]
>         [% IF invoices %]
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 24157: 96274 | 96275 | 96276 | 96277 | 96278 | 98651 | 98652 | 98653 | 98654 | 98655 | 100283 | 100284 | 100285 | 100286 | 100287 | 100288 | 107132 | 107133 | 107134 | 107135 | 107136 | 107137 | 107138 | 107139 | 107309 | 107346 | 107347 | 107348 | 107349 | 107350 | 107351 | 107352 | 107353 | 107354