Attachment 153560 Details for Bug 34288 – Bug 34288: Allow access to the cataloguing module with `tools` permission

[patch] Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug-34288-Allow-access-to-the-cataloguing-module-w.patch (text/plain), 7.35 KB, created by Tomás Cohen Arazi (tcohen) on 2023-07-17 15:15:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2023-07-17 15:15:39 UTC

Size: 7.35 KB

patch

obsolete

>From 9e93338285654790b342f2f96d23d85aa59757a9 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Fri, 14 Jul 2023 20:15:41 -0300
>Subject: [PATCH] Bug 34288: Allow access to the cataloguing module with
> `tools` permission
>
>Bug 31162 moved the cataloguing tools to a new cataloguing module home
>page. This prevents people without cataloguing permissions, but with
>some tools permissions to access things like the labels creator tool.
>
>I tracked all permissions on the cataloging-home.tt template, including
>the Stock Rotation ones which I initially missed because I was focusing
>on tools.
>
>This patch makes the cataloging-home.pl page require either
>'cataloguing' or any relevant 'tools' permission to allow access. the
>page.
>
>The staff interface main page and the top bar dropdown are updated using
>the same logic to display the cataloguing module link.
>
>For that purpose, I wrapped the permissions on a sub in `C4::Auth`.
>
>To test:
>1. Have a patron with only 'catalogue' and some of this permissions:
>
>* inventory
>* items_batchdel
>* items_batchmod
>* items_batchmod
>* label_creator
>* manage_staged_marc
>* marc_modification_templates
>* records_batchdel
>* records_batchmod
>* stage_marc_import
>* upload_cover_images
>* stockrotation => manage_rotas
>
>2. Log in
>=> FAIL: No link to the cataloguing module, neither in the dropdown
>3. Apply this patch
>4. Repeat 2
>=> SUCCESS: You have the link!
>5. Play with the different combinations and notice things are sound and
>   correct
>6. Sign off :-D
>---
> C4/Auth.pm                                    | 40 +++++++++++++++++--
> cataloguing/cataloging-home.pl                | 12 +++---
> .../intranet-tmpl/prog/en/includes/header.inc |  2 +-
> .../prog/en/modules/intranet-main.tt          |  2 +-
> 4 files changed, 45 insertions(+), 11 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 3a3c559bad2..44e126b4cbe 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -72,9 +72,9 @@ BEGIN {
>     @ISA = qw(Exporter);
> 
>     @EXPORT_OK = qw(
>-      checkauth check_api_auth get_session check_cookie_auth checkpw checkpw_internal checkpw_hash
>-      get_all_subpermissions get_user_subpermissions track_login_daily in_iprange
>-      get_template_and_user haspermission create_basic_session
>+        checkauth check_api_auth get_session check_cookie_auth checkpw checkpw_internal checkpw_hash
>+        get_all_subpermissions get_cataloguing_page_permissions get_user_subpermissions track_login_daily in_iprange
>+        get_template_and_user haspermission create_basic_session
>     );
> 
>     $ldap      = C4::Context->config('useldapserver') || 0;
>@@ -471,7 +471,9 @@ sub get_template_and_user {
>         minPasswordLength  => $minPasswordLength,
>     );
>     if ( $in->{'type'} eq "intranet" ) {
>+
>         $template->param(
>+            can_see_cataloguing_module => haspermission( $user, get_cataloguing_page_permissions() ) ? 1 : 0,
>             AmazonCoverImages                                                          => C4::Context->preference("AmazonCoverImages"),
>             AutoLocation                                                               => C4::Context->preference("AutoLocation"),
>             PatronAutoComplete                                                         => C4::Context->preference("PatronAutoComplete"),
>@@ -2185,6 +2187,38 @@ sub get_all_subpermissions {
>     return $all_perms;
> }
> 
>+=head2 get_cataloguing_page_permissions
>+
>+    my $required_permissions = get_cataloguing_page_permissions();
>+
>+Returns the required permissions to access the main cataloguing page. Useful for building
>+the global I<can_see_cataloguing_module> template variable, and also for reusing in
>+I<cataloging-home.pl>.
>+
>+=cut
>+
>+sub get_cataloguing_page_permissions {
>+
>+    my @cataloguing_tools_subperms = qw(
>+        inventory
>+        items_batchdel
>+        items_batchmod
>+        items_batchmod
>+        label_creator
>+        manage_staged_marc
>+        marc_modification_templates
>+        records_batchdel
>+        records_batchmod
>+        stage_marc_import
>+        upload_cover_images
>+    );
>+
>+    return [
>+        { editcatalogue => '*' }, { tools => \@cataloguing_tools_subperms },
>+        C4::Context->preference('StockRotation') ? { stockrotation => 'manage_rotas' } : ()
>+    ];
>+}
>+
> =head2 haspermission
> 
>   $flagsrequired = '*';                                 # Any permission at all
>diff --git a/cataloguing/cataloging-home.pl b/cataloguing/cataloging-home.pl
>index 28c52939b30..d8e76d23cc0 100755
>--- a/cataloguing/cataloging-home.pl
>+++ b/cataloguing/cataloging-home.pl
>@@ -18,7 +18,7 @@
> 
> use Modern::Perl;
> use CGI qw ( -utf8 );
>-use C4::Auth qw( get_template_and_user );
>+use C4::Auth qw( get_cataloguing_page_permissions get_template_and_user );
> use C4::Output qw( output_html_with_http_headers );
> use C4::Context;
> 
>@@ -26,12 +26,12 @@ use Koha::BiblioFrameworks;
> use Koha::Z3950Servers;
> 
> my $query = CGI->new;
>-my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user(
>+my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
>     {
>-        template_name   => "cataloguing/cataloging-home.tt",
>-        query           => $query,
>-        type            => "intranet",
>-        flagsrequired   => { editcatalogue => '*' },
>+        template_name => "cataloguing/cataloging-home.tt",
>+        query         => $query,
>+        type          => "intranet",
>+        flagsrequired => get_cataloguing_page_permissions(),
>     }
> );
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>index a63e8443c7e..e4c62802856 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
>@@ -30,7 +30,7 @@
>                 <a href="/cgi-bin/koha/mainpage.pl" class="dropdown-toggle" data-toggle="dropdown">More <b class="caret"></b></a>
>                 <ul class="dropdown-menu dropdown-menu-right">
>                     <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl">Lists</a></li>
>-                    [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ) %]
>+                    [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || can_see_cataloguing_module ) %]
>                         <li><a href="/cgi-bin/koha/cataloguing/cataloging-home.pl">Cataloging</a></li>
>                     [% END %]
>                     [% IF ( CAN_user_acquisition ) %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
>index ce9f4b231d5..1b4dfe93dd6 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
>@@ -124,7 +124,7 @@
>                             </li>
>                             [% END %]
> 
>-                            [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || ( fast_cataloging && CAN_user_editcatalogue_fast_cataloging ) ) %]
>+                            [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || ( fast_cataloging && CAN_user_editcatalogue_fast_cataloging || can_see_cataloguing_module ) ) %]
>                             <li>
>                                 <a class="icon_general icon_cataloging" href="/cgi-bin/koha/cataloguing/cataloging-home.pl"><i class="fa fa-fw fa-tag"></i>Cataloging</a>
>                             </li>
>-- 
>2.41.0

Actions: View | Diff | Splinter Review

Attachments on bug 34288: 153527 | 153560 | 153561 | 153562 | 153565 | 153566 | 153567 | 153571 | 153572 | 153573