Attachment 16345 Details for Bug 9833 – Bug 9833: Refine shelves permissions.

[patch] Bug 9833: Refine shelves permissions.

Bug-9833-Refine-shelves-permissions.patch (text/plain), 7.29 KB, created by Paul Poulain on 2013-03-19 09:51:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Paul Poulain

Created: 2013-03-19 09:51:42 UTC

Size: 7.29 KB

patch

obsolete

>From e0a40e1bc95d7cf855695e0b05fc12e8a06a31c0 Mon Sep 17 00:00:00 2001
>From: Matthias Meusburger <matthias.meusburger@biblibre.com>
>Date: Mon, 18 Mar 2013 16:11:44 +0100
>Subject: [PATCH] Bug 9833: Refine shelves permissions.
>
> - This patch adds two new permissions for shelves:
>   -  manage_shelves: allows to manage shelves
>   - merge_from_shelves: allows to merge records from shelves
>
>Signed-off-by: Pierre Angot <tredok.pierre@gmail.com>
>---
> C4/Auth.pm                                         |    4 ++++
> C4/VirtualShelves.pm                               |   10 ++++++++--
> C4/VirtualShelves/Page.pm                          |    2 ++
> cataloguing/merge.pl                               |    7 ++++++-
> cataloguing/merge_ajax.pl                          |    2 +-
> installer/data/mysql/updatedatabase.pl             |   14 ++++++++++++++
> .../prog/en/modules/virtualshelves/shelves.tt      |    2 +-
> 7 files changed, 36 insertions(+), 5 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index efe1200..9dca04f 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1135,6 +1135,10 @@ sub check_api_auth {
>     # is deferred so as to not introduce bugs into the
>     # regular authentication code for Koha 3.0.
> 
>+    # FIXME: check_cookie_auth happens to disconnect the
>+    # user when authentication fails. Imho, it should not.
>+    # It should just deny authentication.
>+
>     # see if we have a valid session cookie already
>     # however, if a userid parameter is present (i.e., from
>     # a form submission, assume that any current cookie
>diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm
>index 254d732..1e3a190 100644
>--- a/C4/VirtualShelves.pm
>+++ b/C4/VirtualShelves.pm
>@@ -23,6 +23,7 @@ use warnings;
> use Carp;
> use C4::Context;
> use C4::Debug;
>+use C4::Members;
> 
> use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead
> use constant SHELVES_COMBO_MAX => 10; #add to combo in search
>@@ -431,7 +432,7 @@ ShelfPossibleAction($loggedinuser, $shelfnumber, $action);
> 
> C<$loggedinuser,$shelfnumber,$action>
> 
>-$action can be "view", "add", "delete", "manage", "new_public", "new_private".
>+$action can be "view", "add", "delete", "manage", "new_public", "new_private" or "merge".
> Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage.
> new_public and new_private refers to creating a new public or private list.
> The distinction between deleting your own entries from the list or entries from
>@@ -489,7 +490,12 @@ sub ShelfPossibleAction {
>         return 1 if $user>0 && ($shelf->{allow_delete_own}==1 || $shelf->{allow_delete_other}==1);
>     }
>     elsif($action eq 'manage') {
>-        return 1 if $user && $shelf->{owner}==$user;
>+        my $borrower = GetMemberDetails($user);
>+        return 1 if ($user && $shelf->{owner}==$user) || C4::Auth::haspermission($borrower->{'userid'},  {'editcatalogue' => 'manage_shelves'});
>+    }
>+    elsif($action eq 'merge') {
>+        my $borrower = GetMemberDetails($user);
>+        return 1 if C4::Auth::haspermission($borrower->{'userid'},  {'editcatalogue' => 'merge_from_shelves'});
>     }
>     return 0;
> }
>diff --git a/C4/VirtualShelves/Page.pm b/C4/VirtualShelves/Page.pm
>index f393cb1..297c1af 100644
>--- a/C4/VirtualShelves/Page.pm
>+++ b/C4/VirtualShelves/Page.pm
>@@ -295,12 +295,14 @@ sub shelfpage {
>                 $showadd = 1;
>                 my $i = 0;
>                 my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' );
>+                my $mergefromshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'merge' );
>                 $template->param(
>                     shelfname           => $shelfname,
>                     shelfnumber         => $shelfnumber,
>                     viewshelf           => $shelfnumber,
>                     sortfield           => $sortfield,
>                     manageshelf         => $manageshelf,
>+                    merge_from_shelf => $mergefromshelf,
>                     allowremovingitems  => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'),
>                     allowaddingitem     => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'),
>                     "category$category" => 1,
>diff --git a/cataloguing/merge.pl b/cataloguing/merge.pl
>index 6a46d2f..4c9ac73 100755
>--- a/cataloguing/merge.pl
>+++ b/cataloguing/merge.pl
>@@ -42,7 +42,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>         query           => $input,
>         type            => "intranet",
>         authnotrequired => 0,
>-        flagsrequired   => { editcatalogue => 'edit_catalogue' },
>+
>+        # Important: if you plan to change this permission, do not forget
>+        # to change the matching permission in merge_ajax.pl, otherwise
>+        # you'll end up disconnected without knowing why...
>+        flagsrequired   => { editcatalogue => 'merge_from_shelves' }
>+
>     }
> );
> 
>diff --git a/cataloguing/merge_ajax.pl b/cataloguing/merge_ajax.pl
>index 26f0800..41e250f 100755
>--- a/cataloguing/merge_ajax.pl
>+++ b/cataloguing/merge_ajax.pl
>@@ -16,7 +16,7 @@ use CGI::Cookie; # need to check cookies before
>                  # having CGI parse the POST request
> 
> my %cookies = fetch CGI::Cookie;
>-my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' });
>+my ( $auth_status, $sessionID ) = check_cookie_auth( $cookies{'CGISESSID'}->value, { editcatalogue => 'merge_from_shelves' } );
> if ($auth_status ne "ok") {
>     my $reply = CGI->new("");
>     print $reply->header(-type => 'text/html');
>diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl
>index f0a9269..13d6e73 100755
>--- a/installer/data/mysql/updatedatabase.pl
>+++ b/installer/data/mysql/updatedatabase.pl
>@@ -6532,6 +6532,20 @@ if (C4::Context->preference("Version") < TransformToNum($DBversion)) {
>     SetVersion ($DBversion);
> }
> 
>+$DBversion = '3.11.00.XXX';
>+if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {
>+    $dbh->do(qq{
>+        INSERT INTO `permissions` (`module_bit`, `code`, `description`) VALUES (
>+        '9', 'manage_shelves', 'Allows to manage shelves'), (
>+        '9', 'merge_from_shelves', 'Allows to merge records from shelves'
>+        );
>+    });
>+    print "Upgrade to $DBversion done (Adds new permissions for shelves)\n";
>+    SetVersion($DBversion);
>+}
>+
>+
>+
> =head1 FUNCTIONS
> 
> =head2 TableExists($table)
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
>index 84fb29e..9533227 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
>@@ -283,7 +283,7 @@ function placeHold () {
>         [% IF ( itemsloop ) %]
>             <input type="button" id="placehold" style="display:none" onclick="placeHold(); return false;" value="Place holds" />
>             [% IF ( allowremovingitems ) %]<input type="submit" value="Remove selected records" onclick="return confirm(MSG_REMOVE_FROM_LIST);" />[% END %]
>-            <input type="submit" value="Merge selected records" onclick="return MergeItems();" />
>+            [% IF ( merge_from_shelf ) %]<input type="submit" value="Merge selected records" onclick="return MergeItems();" />[% END %]
>         [% END %]
>  </fieldset>
>  </fieldset>
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 9833: 16262 | 16345 | 16360 | 18247