Attachment 156672 Details for Bug 30708 – Bug 30708: Do not allow non-authorised users to edit the settings

[patch] Bug 30708: Do not allow non-authorised users to edit the settings

Bug-30708-Do-not-allow-non-authorised-users-to-edi.patch (text/plain), 5.00 KB, created by Marcel de Rooy on 2023-10-07 06:42:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2023-10-07 06:42:01 UTC

Size: 5.00 KB

patch

obsolete

>From 5df5f3dbea5d2f6652269e063e92292c3a707312 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Mon, 31 Jul 2023 18:19:49 +0200
>Subject: [PATCH] Bug 30708: Do not allow non-authorised users to edit the
> settings
>Content-Type: text/plain; charset=utf-8
>
>In case the logged in user does not have manage_sysprefs we should no
>display the form in the settings.
>
>Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> Koha/REST/V1/Preservation.pm                  |  4 ++
> .../definitions/preservation_config.yaml      |  3 ++
> .../vue/components/Preservation/Settings.vue  | 46 ++++++++++++++++++-
> 3 files changed, 51 insertions(+), 2 deletions(-)
>
>diff --git a/Koha/REST/V1/Preservation.pm b/Koha/REST/V1/Preservation.pm
>index 994f9eb583..1bc2ca4f0a 100644
>--- a/Koha/REST/V1/Preservation.pm
>+++ b/Koha/REST/V1/Preservation.pm
>@@ -39,6 +39,7 @@ Return the configuration options needed for the Preservation Vue app
> 
> sub config {
>     my $c = shift->openapi->valid_input or return;
>+    my $patron = $c->stash('koha.user');
>     return $c->render(
>         status  => 200,
>         openapi => {
>@@ -47,6 +48,9 @@ sub config {
>                 not_for_loan_waiting_list_in  => C4::Context->preference('PreservationNotForLoanWaitingListIn'),
>                 not_for_loan_default_train_in => C4::Context->preference('PreservationNotForLoanDefaultTrainIn'),
>             },
>+            permissions => {
>+                'manage_sysprefs' => $patron->has_permission( { parameters => 'manage_sysprefs' } ) ? 1 : 0,
>+            },
>         },
>     );
> }
>diff --git a/api/v1/swagger/definitions/preservation_config.yaml b/api/v1/swagger/definitions/preservation_config.yaml
>index c88e1bd0bd..1e789d9c48 100644
>--- a/api/v1/swagger/definitions/preservation_config.yaml
>+++ b/api/v1/swagger/definitions/preservation_config.yaml
>@@ -4,4 +4,7 @@ properties:
>   settings:
>     type: object
>     description: List of sysprefs used for the Preservation module
>+  permissions:
>+    type: object
>+    description: List of permissions of the logged in user used for the Preservation module
> additionalProperties: false
>diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue b/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue
>index 4170114aa9..6c8db0d2ee 100644
>--- a/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue
>+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue
>@@ -5,7 +5,10 @@
>             {{ $__("Edit preservation settings") }}
>         </h2>
>         <div>
>-            <form @submit="onSubmit($event)">
>+            <form
>+                v-if="config.permissions.manage_sysprefs"
>+                @submit="onSubmit($event)"
>+            >
>                 <fieldset class="rows">
>                     <legend>{{ $__("General settings") }}</legend>
>                     <ol>
>@@ -72,6 +75,38 @@
>                     >
>                 </fieldset>
>             </form>
>+            <fieldset v-else class="rows">
>+                <legend>{{ $__("General settings") }}</legend>
>+                <ol>
>+                    <li>
>+                        <label for="not_for_loan_waiting_list_in"
>+                            >{{
>+                                $__("Status for item added to waiting list")
>+                            }}:</label
>+                        >
>+                        <span>{{
>+                            get_lib_from_av(
>+                                "av_notforloan",
>+                                config.settings.not_for_loan_waiting_list_in
>+                            )
>+                        }}</span>
>+                    </li>
>+                    <li>
>+                        <label for="not_for_loan_default_train_in"
>+                            >{{
>+                                $__("Default status for item added to train")
>+                            }}:</label
>+                        >
>+                        <span>{{
>+                            get_lib_from_av(
>+                                "av_notforloan",
>+                                config.settings.not_for_loan_default_train_in
>+                            )
>+                        }}</span>
>+                    </li>
>+                </ol>
>+            </fieldset>
>+
>             <SettingsProcessings />
>         </div>
>     </div>
>@@ -87,12 +122,19 @@ export default {
>     setup() {
>         const AVStore = inject("AVStore")
>         const { av_notforloan } = storeToRefs(AVStore)
>+        const { get_lib_from_av } = AVStore
> 
>         const { setMessage, setWarning } = inject("mainStore")
>         const PreservationStore = inject("PreservationStore")
>         const { config } = PreservationStore
> 
>-        return { av_notforloan, setMessage, setWarning, config }
>+        return {
>+            av_notforloan,
>+            get_lib_from_av,
>+            setMessage,
>+            setWarning,
>+            config,
>+        }
>     },
>     data() {
>         return {
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 30708: 134715 | 134716 | 134732 | 134733 | 134734 | 134736 | 134737 | 134738 | 134782 | 134783 | 134784 | 134785 | 152939 | 152940 | 152941 | 152942 | 152943 | 152944 | 152945 | 152946 | 152947 | 152948 | 152949 | 152950 | 152951 | 152952 | 152953 | 152954 | 152955 | 152956 | 152957 | 152958 | 152959 | 152960 | 152961 | 152962 | 152963 | 152964 | 152965 | 152966 | 152967 | 152968 | 152969 | 152970 | 153102 | 153576 | 154167 | 154168 | 154169 | 154170 | 154171 | 154172 | 154173 | 154174 | 154175 | 154176 | 154177 | 154178 | 154179 | 154180 | 154181 | 154182 | 154183 | 154184 | 154185 | 154186 | 154187 | 154188 | 154189 | 154190 | 154191 | 154192 | 154193 | 154194 | 154195 | 154196 | 154197 | 154198 | 154199 | 154200 | 154201 | 154202 | 154203 | 156592 | 156596 | 156597 | 156636 | 156637 | 156638 | 156639 | 156640 | 156641 | 156642 | 156643 | 156644 | 156645 | 156646 | 156647 | 156648 | 156649 | 156650 | 156651 | 156652 | 156653 | 156654 | 156655 | 156656 | 156657 | 156658 | 156659 | 156660 | 156661 | 156662 | 156663 | 156664 | 156665 | 156666 | 156667 | 156668 | 156669 | 156670 | 156671 | 156672 | 156673 | 156674 | 156675 | 157502 | 157503 | 157506 | 157508 | 157512 | 157514 | 157557