Attachment 162995 Details for Bug 34631 – Bug 34631: Independentbranches - Non-superuser should not be able to write Additional contents for other branches

[patch] Bug 34631: Independentbranches - Non-superuser should not be able to write Additional contents for other branches

Bug-34631-Independentbranches---Non-superuser-shou.patch (text/plain), 5.99 KB, created by Myka Kennedy Stephens on 2024-03-09 01:05:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Myka Kennedy Stephens

Created: 2024-03-09 01:05:56 UTC

Size: 5.99 KB

patch

obsolete

>From cf26ee2665355de639fe35d98f067ecb69a8df0e Mon Sep 17 00:00:00 2001
>From: Hammat Wele <hammat.wele@inlibro.com>
>Date: Mon, 28 Aug 2023 17:21:44 +0000
>Subject: [PATCH] Bug 34631: Independentbranches - Non-superuser should not be
> able to write Additional contents for other branches
>
>When syspref Independentbranches is enabled Non-superuser should not be able to write Additional contents for other branches
>
>To reproduce:
>1- Connect to staff interface as superlibrarian
>2- Enable IndependentBranches preference
>3- Go to Tools -> HTML customizations
>4- Crete an additional content for all libraries
>5- Create or edit a borrower
>    5-1- Set permission for the borrower
>        - catalogue
>        - edit_additional_contents
>4- Log in to the staff interface with the non-superlibrarian staff user
>5- Go to Tools -> HTML customizations
>    --> you can delete or edit the additional contents created by superlibrarian for All libraries
>6- Click on New entry
>    --> you can add additional content for other branches
>7- Apply the patch
>8- Repeat step 5
>    --> you cannot delete or edit the additional contents create by superlibrarian for All libraries
>9- Repeat step 6
>    --> you cannot add additional content for other branches
>10- submit the form
>    --> the branch of the created additional content is the current user branch
>
>Signed-off-by: John Doe <you@example.com>
>---
> .../prog/en/modules/tools/additional-contents.tt     |  6 ++++++
> tools/additional-contents.pl                         | 12 +++++++++---
> 2 files changed, 15 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
>index 2a7ff46f7b..c811e35ddd 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
>@@ -239,6 +239,7 @@
>                     </select>
>                     [% INCLUDE 'html-customization-help.inc' %]
>                 </li>
>+                [% UNLESS my_branch %]
>                 <li>
>                     <label for="branchcode">Library: </label>
>                     <select id="branchcode" name="branchcode">
>@@ -250,6 +251,7 @@
>                         [% PROCESS options_for_libraries libraries => Branches.all( selected => additional_content.branchcode, unfiltered => 1, ) %]
>                     </select>
>                 </li>
>+                [% END %]
>                 [% UNLESS languages.size %]
>                     <li>
>                         [% IF category == 'news' %]
>@@ -404,7 +406,9 @@
>                             [% SET default_localization = c.default_localization %]
>                             [% IF ( c.is_expired ) %]<tr class="expired">[% ELSE %]<tr>[% END %]
>                             <td>
>+                            [% UNLESS ( my_branch && my_branch != c.branchcode ) %]
>                                 <input type="checkbox" name="ids" value="[% c.id | html %]" />
>+                            [% END %]
>                             </td>
>                             <td>
>                                 [% IF c.category == 'news' || c.category == 'pages' %]
>@@ -460,6 +464,7 @@
>                                 </div>
>                             </td>
>                             <td class="actions">
>+                            [% UNLESS ( my_branch && my_branch != c.branchcode ) %]
>                                 <div class="btn-group dropup">
>                                     <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&amp;id=[% c.id | uri %]&editmode=[% editmode | uri %]" class="btn btn-default btn-xs"> <i class="fa-solid fa-pencil"></i> Edit</a><button class="btn btn-default btn-xs dropdown-toggle" data-toggle="dropdown">
>                                         <span class="caret"></span>
>@@ -477,6 +482,7 @@
>                                 <div class="btn-group">
>                                     <a href="#" class="delete_news btn btn-default btn-xs" data-id="[% c.id | html %]"><i class="fa fa-trash-can"></i> Delete</a>
>                                 </div>
>+                            [% END %]
>                             </td>
>                         </tr>
>                         [% END %]
>diff --git a/tools/additional-contents.pl b/tools/additional-contents.pl
>index 8cfdd34ab5..9e7f6287fa 100755
>--- a/tools/additional-contents.pl
>+++ b/tools/additional-contents.pl
>@@ -63,6 +63,11 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
> );
> 
> my @messages;
>+my $my_branch =
>+    C4::Context->preference("IndependentBranches")
>+    && !C4::Context->IsSuperLibrarian()
>+    ? C4::Context->userenv()->{'branch'}
>+    : undef;
> if ( $op eq 'add_form' ) {
> 
>     my $additional_content = Koha::AdditionalContents->find($id);
>@@ -72,7 +77,8 @@ if ( $op eq 'add_form' ) {
>         $category            = $additional_content->category;
>     }
>     $template->param(
>-        additional_content => $additional_content,
>+        my_branch           => $my_branch,
>+        additional_content  => $additional_content,
>         translated_contents => $translated_contents,
>     );
> }
>@@ -80,7 +86,7 @@ elsif ( $op eq 'cud-add_validate' ) {
>     output_and_exit_if_error( $cgi, $cookie, $template, { check => 'csrf_token' } );
>     my $location   = $cgi->param('location');
>     my $code       = $cgi->param('code');
>-    my $branchcode = $cgi->param('branchcode') || undef;
>+    my $branchcode = $my_branch ? $my_branch : $cgi->param('branchcode') || undef;
> 
>     my @lang       = $cgi->multi_param('lang');
> 
>@@ -223,7 +229,7 @@ if ( $op eq 'list' ) {
>         { category => $category, 'additional_contents_localizations.lang' => 'default' },
>         { order_by => { -desc => 'published_on' }, join => 'additional_contents_localizations' }
>     );
>-    $template->param( additional_contents => $additional_contents );
>+    $template->param( additional_contents => $additional_contents, my_branch => $my_branch );
> }
> 
> my $translated_languages = C4::Languages::getTranslatedLanguages;
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 34631: 154889 | 154890 | 162787 | 162788 | 162856 | 162929 | 162972 | 162995 | 172231