Bugzilla – Attachment 150450 Details for
Bug 33363
More specific permissions for purchase suggestions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 33363: Add separate permissions for creating and deleting suggestions
Bug-33363-Add-separate-permissions-for-creating-an.patch (text/plain), 47.77 KB, created by
PTFS Europe Sandboxes
on 2023-05-01 10:21:05 UTC
(
hide
)
Description:
Bug 33363: Add separate permissions for creating and deleting suggestions
Filename:
MIME Type:
Creator:
PTFS Europe Sandboxes
Created:
2023-05-01 10:21:05 UTC
Size:
47.77 KB
patch
obsolete
>From 4d8b628db9030cdf0120ead8360f7f96474c1fc6 Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Wed, 26 Apr 2023 15:21:39 +0000 >Subject: [PATCH] Bug 33363: Add separate permissions for creating and deleting > suggestions > >There are a number of libraries that would like for their staff to be able to submit (and view existing) purchase suggestions from the borrower record, but not give the staff the ability to edit/manage/delete purchase suggestions. > >Test Plan: >1) Apply this patch >2) Run restart all the things! >3) Run updatedatabase >4) Verify anyone with the suggestions manage permissions now has the create and delete permissions as well >5) Verify anyone without the suggestions manage permission has not recieved the new permissions >6) Enable only the create permission for a librarian >7) Verify that librarian can only create new suggestions ( not manage or delete ) >8) Enable only the manage permission for a librarian >9) Verify that librarian can only manage existing suggestions ( not create or delete ) >10) Enable only the delete permission for a librarian >11) Verify that librarian can only delete suggestions ( not create or manage ) > >Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu> >--- > api/v1/swagger/paths/suggestions.yaml | 19 +- > .../data/mysql/atomicupdate/bug_33363.pl | 16 + > .../data/mysql/mandatory/userpermissions.sql | 2 + > .../prog/en/includes/acquisitions-menu.inc | 2 +- > .../prog/en/includes/circ-menu.inc | 2 +- > .../intranet-tmpl/prog/en/includes/header.inc | 2 +- > .../prog/en/includes/patron-search.inc | 2 +- > .../prog/en/includes/permissions.inc | 10 + > .../modules/members/purchase-suggestions.tt | 4 +- > .../prog/en/modules/suggestion/suggestion.tt | 275 ++++++++++-------- > members/purchase-suggestions.pl | 2 +- > suggestion/suggestion.pl | 84 ++++-- > t/Koha/Auth/Permissions.t | 2 + > 13 files changed, 268 insertions(+), 154 deletions(-) > create mode 100755 installer/data/mysql/atomicupdate/bug_33363.pl > >diff --git a/api/v1/swagger/paths/suggestions.yaml b/api/v1/swagger/paths/suggestions.yaml >index 5438188591..41394c241b 100644 >--- a/api/v1/swagger/paths/suggestions.yaml >+++ b/api/v1/swagger/paths/suggestions.yaml >@@ -42,7 +42,10 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- suggestions: suggestions_manage >+ suggestions: >+ - suggestions_manage >+ - suggestions_delete >+ - suggestions_create > post: > x-mojo-to: Suggestions#add > operationId: addSuggestions >@@ -101,7 +104,7 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- suggestions: suggestions_manage >+ suggestions: suggestions_create > "/suggestions/{suggestion_id}": > get: > x-mojo-to: Suggestions#get >@@ -140,7 +143,10 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- suggestions: suggestions_manage >+ suggestions: >+ - suggestions_manage >+ - suggestions_delete >+ - suggestions_create > put: > x-mojo-to: Suggestions#update > operationId: updateSuggestion >@@ -230,7 +236,7 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- suggestions: suggestions_manage >+ suggestions: suggestions_delete > /suggestions/managers: > get: > x-mojo-to: Suggestions#list_managers >@@ -283,4 +289,7 @@ > $ref: "../swagger.yaml#/definitions/error" > x-koha-authorization: > permissions: >- suggestions: suggestions_manage >+ suggestions: >+ - suggestions_manage >+ - suggestions_delete >+ - suggestions_create >diff --git a/installer/data/mysql/atomicupdate/bug_33363.pl b/installer/data/mysql/atomicupdate/bug_33363.pl >new file mode 100755 >index 0000000000..46ceea7b42 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/bug_33363.pl >@@ -0,0 +1,16 @@ >+use Modern::Perl; >+ >+return { >+ bug_number => "33363", >+ description => "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions", >+ up => sub { >+ my ($args) = @_; >+ my ($dbh, $out) = @$args{qw(dbh out)}; >+ >+ $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_create', 'Create purchase suggestions')}); >+ $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_delete', 'Update purchase suggestions')}); >+ >+ $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_create' FROM borrowers WHERE flags & (1 << 2)}); >+ $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_delete' FROM borrowers WHERE flags & (1 << 2)}); >+ }, >+}; >diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql >index 7b6955de44..a2a51489bd 100644 >--- a/installer/data/mysql/mandatory/userpermissions.sql >+++ b/installer/data/mysql/mandatory/userpermissions.sql >@@ -83,7 +83,9 @@ INSERT INTO permissions (module_bit, code, description) VALUES > (11, 'delete_invoices', 'Delete invoices'), > (11, 'merge_invoices', 'Merge invoices'), > (11, 'delete_baskets', 'Delete baskets'), >+ (12, 'suggestions_create', 'Create purchase suggestions'), > (12, 'suggestions_manage', 'Manage purchase suggestions'), >+ (12, 'suggestions_delete', 'Delete purchase suggestions'), > (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'), > (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'), > (13, 'edit_calendar', 'Define days when the library is closed'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc >index f97eadc18d..69ff0be9c0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc >@@ -5,7 +5,7 @@ > <ul> > <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions home</a></li> > [% IF ( CAN_user_acquisition_order_receive ) %]<li><a href="/cgi-bin/koha/acqui/lateorders.pl">Late orders</a></li>[% END %] >- [% IF ( suggestion && CAN_user_suggestions_suggestions_manage ) %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %] >+ [% IF ( suggestion && ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete ) ) %]<li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li>[% END %] > <li><a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a></li> > [% IF Koha.Preference('EDIFACT') && CAN_user_acquisition_edi_manage %] > <li><a href="/cgi-bin/koha/acqui/edifactmsgs.pl">EDIFACT messages</a></li> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >index 9f78956dd3..eed80536c1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >@@ -170,7 +170,7 @@ > [% END %] > [% END %] > >- [% IF CAN_user_suggestions_suggestions_manage %] >+ [% IF CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete %] > [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | uri %]">Purchase suggestions</a></li> > [% END %] > [% IF CAN_user_borrowers_edit_borrowers && useDischarge %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >index a63e8443c7..30528306fe 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >@@ -52,7 +52,7 @@ > [% IF ( CAN_user_reports ) %] > <li><a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a></li> > [% END %] >- [% IF ( CAN_user_suggestions_suggestions_manage ) %] >+ [% IF ( CAN_user_suggestions_suggestions_create || CAN_user_suggestions_suggestions_manage || CAN_user_suggestions_suggestions_delete ) %] > <li><a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a></li> > [% END %] > [% IF ( CAN_user_tools || CAN_user_clubs ) %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >index 6ae5ebb9e2..3b09d8cd1b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >@@ -96,7 +96,7 @@ > [% BLOCK patron_search_table %] > > [% IF filter == 'suggestions_managers' %] >- <div class="hint">Only staff with superlibrarian or suggestions_manage permissions are returned in the search results</div> >+ <div class="hint">Only staff with superlibrarian or full suggestions permissions are returned in the search results</div> > [% ELSIF filter == 'orders_managers' %] > <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div> > [% ELSIF filter == 'funds_owners' OR filter == 'funds_users' %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >index e4c4cbe2a6..b4bdb05273 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc >@@ -409,11 +409,21 @@ > Add manual credits to a patron account > </span> > <span class="permissioncode">([% name | html %])</span> >+ [%- CASE 'suggestions_create' -%] >+ <span class="sub_permission suggestions_create_subpermission"> >+ Create purchase suggestions >+ </span> >+ <span class="permissioncode">([% name | html %])</span> > [%- CASE 'suggestions_manage' -%] > <span class="sub_permission suggestions_manage_subpermission"> > Manage purchase suggestions > </span> > <span class="permissioncode">([% name | html %])</span> >+ [%- CASE 'suggestions_delete' -%] >+ <span class="sub_permission suggestions_delete_subpermission"> >+ Delete purchase suggestions >+ </span> >+ <span class="permissioncode">([% name | html %])</span> > [%- CASE 'budget_add_del' -%] > <span class="sub_permission budget_add_del_subpermission"> > Add and delete funds (but can't modify funds) >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >index 4ccd814755..2d82beaf61 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >@@ -38,7 +38,9 @@ > <h1>Purchase suggestions</h1> > > <div id="toolbar" class="btn-toolbar"> >- <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&suggestedby=[% patron.borrowernumber | html %]&redirect=purchase_suggestions&borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a> >+ [% IF CAN_user_suggestions_suggestions_create %] >+ <a class="btn btn-default" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&suggestedby=[% patron.borrowernumber | html %]&redirect=purchase_suggestions&borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a> >+ [% END %] > </div> > > [% IF suggestions.size %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >index cfbb831d69..8beebbdcd8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >@@ -114,8 +114,12 @@ > <div class="col-md-8 col-md-offset-2"> > > <div id="toolbar" class="btn-toolbar"> >- <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&suggestionid=[% suggestionid | html %]"><i class="fa fa-pencil"></i> Edit</a> >- <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a> >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&suggestionid=[% suggestionid | html %]"><i class="fa fa-pencil"></i> Edit</a> >+ [% END %] >+ [% IF CAN_user_suggestions_suggestions_delete %] >+ <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a> >+ [% END %] > </div> > > <fieldset class="rows"> >@@ -348,6 +352,12 @@ > <span>A similar document already exists: <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% m.id | uri %]">[% m.title | html %]</a>. Click on "Confirm your suggestion" to ignore this message.</span> > [% CASE 'manager_not_enough_permissions' %] > <span>The manager you selected does not have sufficient permissions.</span> >+ [% CASE 'no_manage_permission' %] >+ <span>You do not have permissions to manage suggestions</span> >+ [% CASE 'no_create_permission' %] >+ <span>You do not have permissions to create suggestions</span> >+ [% CASE 'no_delete_permission' %] >+ <span>You do not have permissions to delete suggestions</span> > [% CASE %] > <span>[% m.code | html %]</span> > [% END %] >@@ -567,7 +577,11 @@ > <label for="managedby_name">by:</label> > <div> > <span id="managedby_name" name="managedby_name"> >- <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a> >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% logged_in_user.borrowernumber | uri %]">You</a> >+ [% ELSE %] >+ Nobody >+ [% END %] > </span> > [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %] > | Previously was [% INCLUDE 'patron-title.inc' patron=managedby_patron hide_patron_infos_if_needed=1 %] [% Branches.GetName( managedby_patron.branchcode ) | html %] ([% managedby_patron.category.description | html %]) >@@ -577,7 +591,10 @@ > [% IF managedby_patron.borrowernumber && logged_in_user.borrowernumber != managedby_patron.borrowernumber %] > <a id="restore_previous_manager" href="#"><i class="fa fa-trash"></i> Keep existing manager</a> > [% END %] >- <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" /> >+ >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <input type="hidden" name="managedby" id="managedby" value="[% logged_in_user.borrowernumber | html %]" /> >+ [% END %] > > <br/> > <label for="notify">Notify manager:</label> >@@ -671,7 +688,9 @@ > > [% IF op == 'else' %] > <div id="toolbar" class="btn-toolbar"> >- <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a> >+ [% IF CAN_user_suggestions_suggestions_create %] >+ <a class="btn btn-default" id="newsuggestion" href="suggestion.pl?op=add&branchcode=[% branchcode | uri %]"><i class="fa fa-plus"></i> New purchase suggestion</a> >+ [% END %] > </div> > > <h1>Suggestions management</h1> >@@ -859,13 +878,21 @@ > </td> > <td class="actions"> > <div class="btn-group dropup"> >- <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a> >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a> >+ [% ELSIF CAN_user_suggestions_suggestions_delete %] >+ <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?op=delete&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-trash"></i>Delete</a> >+ [% END %] > <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]"> >- <li><a class="deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li> >- [% UNLESS s.archived %] >- <li><a class="archivesuggestion" href="suggestion.pl?op=archive&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li> >- [% ELSE %] >- <li><a class="unarchivesuggestion" href="suggestion.pl?op=unarchive&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Unarchive</a></li> >+ [% IF CAN_user_suggestions_suggestions_delete %] >+ <li><a class="deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li> >+ [% END %] >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ [% UNLESS s.archived %] >+ <li><a class="archivesuggestion" href="suggestion.pl?op=archive&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li> >+ [% ELSE %] >+ <li><a class="unarchivesuggestion" href="suggestion.pl?op=unarchive&suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Unarchive</a></li> >+ [% END %] > [% END %] > </ul> > </div> >@@ -881,119 +908,125 @@ > </div> > </div> > <div id="suggestions_batch_ops" class="row"> >- <div class="col-sm-4"> >- <fieldset class="brief"> >- <div id="select-reason[% loop.index | html %]"> >- <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label> >- <select name="STATUS" id="STATUSreason[% loop.index | html %]"> >- <option value=""> -- Choose a status --</option> >- >- [% IF (statusselected_ASKED ) %] >- <option value="ASKED" selected="selected">Pending</option> >- [% ELSE %] >- <option value="ASKED">Pending</option> >- [% END %] >- >- [% IF (statusselected_ACCEPTED ) %] >- <option value="ACCEPTED" selected="selected">Accepted</option> >- [% ELSE %] >- <option value="ACCEPTED">Accepted</option> >- [% END %] >- >- [% IF (statusselected_CHECKED ) %] >- <option value="CHECKED" selected="selected">Checked</option> >- [% ELSE %] >- <option value="CHECKED">Checked</option> >- [% END %] >- >- [% IF ( statusselected_REJECTED ) %] >- <option value="REJECTED" selected="selected">Rejected</option> >- [% ELSE %] >- <option value="REJECTED">Rejected</option> >- [% END %] >- >- [% IF ( statusselected_ORDERED ) %] >- <option value="ORDERED" selected="selected">Ordered</option> >- [% ELSE %] >- <option value="ORDERED">Ordered</option> >- [% END %] >- >- [% FOREACH s IN SuggestionStatuses %] >- <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option> >- [% END %] >- </select> >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <div class="col-sm-4"> >+ <fieldset class="brief"> >+ <div id="select-reason[% loop.index | html %]"> >+ <label for="STATUSreason[% loop.index | html %]">Mark selected as: </label> >+ <select name="STATUS" id="STATUSreason[% loop.index | html %]"> >+ <option value=""> -- Choose a status --</option> >+ >+ [% IF (statusselected_ASKED ) %] >+ <option value="ASKED" selected="selected">Pending</option> >+ [% ELSE %] >+ <option value="ASKED">Pending</option> >+ [% END %] >+ >+ [% IF (statusselected_ACCEPTED ) %] >+ <option value="ACCEPTED" selected="selected">Accepted</option> >+ [% ELSE %] >+ <option value="ACCEPTED">Accepted</option> >+ [% END %] >+ >+ [% IF (statusselected_CHECKED ) %] >+ <option value="CHECKED" selected="selected">Checked</option> >+ [% ELSE %] >+ <option value="CHECKED">Checked</option> >+ [% END %] >+ >+ [% IF ( statusselected_REJECTED ) %] >+ <option value="REJECTED" selected="selected">Rejected</option> >+ [% ELSE %] >+ <option value="REJECTED">Rejected</option> >+ [% END %] >+ >+ [% IF ( statusselected_ORDERED ) %] >+ <option value="ORDERED" selected="selected">Ordered</option> >+ [% ELSE %] >+ <option value="ORDERED">Ordered</option> >+ [% END %] >+ >+ [% FOREACH s IN SuggestionStatuses %] >+ <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option> >+ [% END %] >+ </select> >+ >+ <label for="choosereason[% loop.index | html %]">with this reason:</label> >+ <select name="reason" id="choosereason[% loop.index | html %]"> >+ <option value=""> -- Choose a reason -- </option> >+ [% FOREACH reasonsloo IN suggestion.reasonsloop %] >+ <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option> >+ [% END %] >+ <option value="other">Others...</option> >+ </select> >+ >+ <span class="other_reason"> >+ <input type="text" size="31" name="other_reason" placeholder="please note your reason here..." /> >+ <a href="#" class="cancel_note">Cancel</a> >+ </span> >+ </div> >+ >+ <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >+ <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ </fieldset> >+ <fieldset class="action"> >+ <button type="submit" class="btn btn-primary" value="update_status">Submit</button> >+ </fieldset> >+ </div> <!-- /.col-sm-4 --> >+ >+ <div class="col-sm-2"> >+ <fieldset class="brief"> >+ <label id="suggestion_itemtype"> >+ Update item types with: >+ </label> >+ [% PROCESS 'av-build-dropbox.inc' name="suggestion_itemtype", category="SUGGEST_FORMAT", size = 20 %] >+ <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >+ <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ </fieldset> >+ <fieldset class="action"> >+ <button type="submit" class="btn btn-primary" value="update_itemtype">Submit</button> >+ </fieldset> >+ </div> <!-- /.col-sm-4 --> >+ >+ <div class="col-sm-2"> >+ <fieldset class="brief"> >+ <span class="label">Update manager</span> >+ <a id="set_manager_[% loop.count | html %]" data-tab="[% loop.count | html %]" class="set_manager" href="#"><i class="fa fa-search"></i> Select manager</a> >+ <span id="managedby_name[% loop.count | html %]"></span> >+ <input type="hidden" name="suggestion_managedby" id="managedby[% loop.count | html %]" value="[% logged_in_user.borrowernumber | html %]" /> >+ <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >+ <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ </fieldset> >+ <fieldset class="action"> >+ <button type="submit" class="btn btn-primary" value="update_manager">Submit</button> >+ </fieldset> >+ </div> <!-- /.col-sm-2 --> >+ [% END %] > >- <label for="choosereason[% loop.index | html %]">with this reason:</label> >- <select name="reason" id="choosereason[% loop.index | html %]"> >- <option value=""> -- Choose a reason -- </option> >- [% FOREACH reasonsloo IN suggestion.reasonsloop %] >- <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option> >- [% END %] >- <option value="other">Others...</option> >- </select> >- >- <span class="other_reason"> >- <input type="text" size="31" name="other_reason" placeholder="please note your reason here..." /> >- <a href="#" class="cancel_note">Cancel</a> >- </span> >- </div> >- >- <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >- <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >- </fieldset> >- <fieldset class="action"> >- <button type="submit" class="btn btn-primary" value="update_status">Submit</button> >- </fieldset> >- </div> <!-- /.col-sm-4 --> >- >- <div class="col-sm-2"> >- <fieldset class="brief"> >- <label id="suggestion_itemtype"> >- Update item types with: >- </label> >- [% PROCESS 'av-build-dropbox.inc' name="suggestion_itemtype", category="SUGGEST_FORMAT", size = 20 %] >- <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >- <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >- </fieldset> >- <fieldset class="action"> >- <button type="submit" class="btn btn-primary" value="update_itemtype">Submit</button> >- </fieldset> >- </div> <!-- /.col-sm-4 --> >- >- <div class="col-sm-2"> >- <fieldset class="brief"> >- <span class="label">Update manager</span> >- <a id="set_manager_[% loop.count | html %]" data-tab="[% loop.count | html %]" class="set_manager" href="#"><i class="fa fa-search"></i> Select manager</a> >- <span id="managedby_name[% loop.count | html %]"></span> >- <input type="hidden" name="suggestion_managedby" id="managedby[% loop.count | html %]" value="[% logged_in_user.borrowernumber | html %]" /> >- <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >- <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >- </fieldset> >- <fieldset class="action"> >- <button type="submit" class="btn btn-primary" value="update_manager">Submit</button> >- </fieldset> >- </div> <!-- /.col-sm-2 --> >- >- <div class="col-sm-2"> >- <fieldset class="brief"> >- <span class="label">Delete selected</span> >- <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >- <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >- </fieldset> >- <fieldset class="action"> >- <button type="submit" class="btn btn-primary" value="delete">Delete</button> >- </fieldset> >- </div> <!-- /.col-sm-2 --> >- <div class="col-sm-2"> >- <fieldset class="brief"> >- <span class="label">Archive selected</span> >- <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >- <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ [% IF CAN_user_suggestions_suggestions_delete %] >+ <div class="col-sm-2"> >+ <fieldset class="brief"> >+ <span class="label">Delete selected</span> >+ <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >+ <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ </fieldset> > <fieldset class="action"> >- <button type="submit" class="btn btn-primary" value="archive">Archive</button> >+ <button type="submit" class="btn btn-primary" value="delete">Delete</button> > </fieldset> >- </fieldset> >- </div> <!-- /.col-sm-2 --> >+ </div> <!-- /.col-sm-2 --> >+ [% END %] >+ [% IF CAN_user_suggestions_suggestions_manage %] >+ <div class="col-sm-2"> >+ <fieldset class="brief"> >+ <span class="label">Archive selected</span> >+ <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> >+ <input type="hidden" name="filter_archived" value="[% filter_archived | html %]" /> >+ <fieldset class="action"> >+ <button type="submit" class="btn btn-primary" value="archive">Archive</button> >+ </fieldset> >+ </fieldset> >+ </div> <!-- /.col-sm-2 --> >+ [% END %] > </div> <!-- /.row --> > > [% ELSE %] >diff --git a/members/purchase-suggestions.pl b/members/purchase-suggestions.pl >index 1739e841ae..87343cfc95 100755 >--- a/members/purchase-suggestions.pl >+++ b/members/purchase-suggestions.pl >@@ -32,7 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > { template_name => "members/purchase-suggestions.tt", > query => $input, > type => "intranet", >- flagsrequired => { suggestions => 'suggestions_manage' }, >+ flagsrequired => { suggestions => '*' }, > } > ); > >diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl >index f85b4366ea..09f123d2de 100755 >--- a/suggestion/suggestion.pl >+++ b/suggestion/suggestion.pl >@@ -120,10 +120,12 @@ my ( $template, $borrowernumber, $cookie, $userflags ) = get_template_and_user( > template_name => "suggestion/suggestion.tt", > query => $input, > type => "intranet", >- flagsrequired => { suggestions => 'suggestions_manage' }, >+ flagsrequired => { suggestions => '*' }, > } > ); > >+my $librarian = Koha::Patrons->find($borrowernumber); >+ > $borrowernumber = $input->param('borrowernumber') if ( $input->param('borrowernumber') ); > $template->param('borrowernumber' => $borrowernumber); > my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch'}; >@@ -132,8 +134,8 @@ my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch > ## Operations > ## > >+my @messages; > if ( $op =~ /save/i ) { >- my @messages; > my $biblio = MarcRecordFromNewSuggestion({ > title => $suggestion_only->{title}, > author => $suggestion_only->{author}, >@@ -192,7 +194,13 @@ if ( $op =~ /save/i ) { > if exists $suggestion_only->{branchcode} > && $suggestion_only->{branchcode} eq ""; > >- &ModSuggestion($suggestion_only); >+ if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) { >+ &ModSuggestion($suggestion_only); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_manage_permission' }; >+ $template->param( messages => \@messages, ); >+ } > > if ( $notify ) { > my $patron = Koha::Patrons->find( $suggestion_only->{managedby} ); >@@ -232,7 +240,13 @@ if ( $op =~ /save/i ) { > } > else { > ## Adding some informations related to suggestion >- &NewSuggestion($suggestion_only); >+ if ( $librarian->has_permission({ 'suggestions' => 'suggestions_create' }) ) { >+ &NewSuggestion($suggestion_only); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_delete_permission' }; >+ $template->param( messages => \@messages ); >+ } > } > # empty fields, to avoid filter in "SearchSuggestion" > } >@@ -295,17 +309,31 @@ elsif ($op eq "update_status" ) { > $suggestion->{reason} = $reason; > } > >- foreach my $suggestionid (@editsuggestions) { >- next unless $suggestionid; >- $suggestion->{suggestionid} = $suggestionid; >- &ModSuggestion($suggestion); >+ if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) { >+ foreach my $suggestionid (@editsuggestions) { >+ next unless $suggestionid; >+ $suggestion->{suggestionid} = $suggestionid; >+ &ModSuggestion($suggestion); >+ } >+ redirect_with_params($input); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_manage_permission' }; >+ $template->param( messages => \@messages, ); > } >- redirect_with_params($input); > }elsif ($op eq "delete" ) { >- foreach my $delete_field (@editsuggestions) { >- &DelSuggestion( $borrowernumber, $delete_field,'intranet' ); >+ if ( $librarian->has_permission( { 'suggestions' => 'suggestions_delete' } ) >+ ) >+ { >+ foreach my $delete_field (@editsuggestions) { >+ &DelSuggestion( $borrowernumber, $delete_field, 'intranet' ); >+ } >+ redirect_with_params($input); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_delete_permission' }; >+ $template->param( messages => \@messages, ); > } >- redirect_with_params($input); > } > elsif ($op eq "archive" ) { > Koha::Suggestions->find($_)->update({ archived => 1 }) for @editsuggestions; >@@ -318,20 +346,32 @@ elsif ($op eq "unarchive" ) { > redirect_with_params($input); > } > elsif ( $op eq 'update_itemtype' ) { >- my $new_itemtype = $input->param('suggestion_itemtype'); >- foreach my $suggestionid (@editsuggestions) { >- next unless $suggestionid; >- &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype }); >+ if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) { >+ my $new_itemtype = $input->param('suggestion_itemtype'); >+ foreach my $suggestionid (@editsuggestions) { >+ next unless $suggestionid; >+ &ModSuggestion({ suggestionid => $suggestionid, itemtype => $new_itemtype }); >+ } >+ redirect_with_params($input); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_manage_permission' }; >+ $template->param( messages => \@messages, ); > } >- redirect_with_params($input); > } > elsif ( $op eq 'update_manager' ) { >- my $managedby = $input->param('suggestion_managedby'); >- foreach my $suggestionid (@editsuggestions) { >- next unless $suggestionid; >- &ModSuggestion({ suggestionid => $suggestionid, managedby => $managedby }); >+ if ( $librarian->has_permission( { 'suggestions' => 'suggestions_manage' } ) ) { >+ my $managedby = $input->param('suggestion_managedby'); >+ foreach my $suggestionid (@editsuggestions) { >+ next unless $suggestionid; >+ &ModSuggestion({ suggestionid => $suggestionid, managedby => $managedby }); >+ } >+ redirect_with_params($input); >+ } >+ else { >+ push @messages, { type => 'error', code => 'no_manage_permission' }; >+ $template->param( messages => \@messages, ); > } >- redirect_with_params($input); > } > elsif ( $op eq 'show' ) { > $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'}); >diff --git a/t/Koha/Auth/Permissions.t b/t/Koha/Auth/Permissions.t >index d5d2b98d1c..967edc6d49 100755 >--- a/t/Koha/Auth/Permissions.t >+++ b/t/Koha/Auth/Permissions.t >@@ -234,7 +234,9 @@ subtest 'superlibrarian tests' => sub { > 'CAN_user_stockrotation_manage_rota_items' => 1, > 'CAN_user_stockrotation_manage_rotas' => 1, > 'CAN_user_stockrotation' => 1, >+ 'CAN_user_suggestions_suggestions_create' => 1, > 'CAN_user_suggestions_suggestions_manage' => 1, >+ 'CAN_user_suggestions_suggestions_delete' => 1, > 'CAN_user_suggestions' => 1, > 'CAN_user_superlibrarian' => 1, > 'CAN_user_tools_access_files' => 1, >-- >2.30.2
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=150450">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 33363
:
150247
|
150450
|
153177
|
160846
|
160847
|
160902
|
160903
|
165142
|
165143
|
168052
|
168053
|
168055
|
168056
|
168356
|
168357
|
168358
|
168359
|
168803
|
168804
|
168805
|
168806
|
168807
|
168808
|
168865
|
168866
|
168867
|
168868
|
168869