Bugzilla – Attachment 173710 Details for
Bug 38297
The "New vendor" button needs a permissions guard
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38297: Add a permissions check to the New vendor button
Bug-38297-Add-a-permissions-check-to-the-New-vendo.patch (text/plain), 5.78 KB, created by
Matt Blenkinsop
on 2024-10-30 11:51:23 UTC
(
hide
)
Description:
Bug 38297: Add a permissions check to the New vendor button
Filename:
MIME Type:
Creator:
Matt Blenkinsop
Created:
2024-10-30 11:51:23 UTC
Size:
5.78 KB
patch
obsolete
>From 36a2b7acc012f285c75dc2b2d4e01d3cfaa8d1d0 Mon Sep 17 00:00:00 2001 >From: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> >Date: Wed, 30 Oct 2024 11:46:05 +0000 >Subject: [PATCH] Bug 38297: Add a permissions check to the New vendor button > >Test plan: >1) Choose a staff patron and make sure they have permissions to log into the staff interface >2) Ensure that the patron does not have the vendors_manage permission but give them one other acquisitions permission so that they can see the link on the homepage (e.g. budget_manage) >3) In an incognito browser, log in with that patron and go to the acquisitions homepage >4) The New vendor button will be visible >5) Click on it and fill in the required fields. Submit the form and it will error for lack of permissions >6) Apply patch >7) Return to the acquisitions page and the New vendor button should no longer be visible >8) Back in your main browser, give the patron the vendors_manage permission and then refresh the incognito window - the button should be visible >--- > .../prog/en/includes/acquisitions-toolbar.inc | 48 +++++++++---------- > 1 file changed, 24 insertions(+), 24 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >index d6b6ff9f98b..aaedbabcd95 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc >@@ -3,34 +3,34 @@ > <div id="toolbar" class="btn-toolbar"> > [% IF ( booksellerid ) %] > <div class="btn-group"> >- <a class="btn btn-default dropdown-toggle" data-bs-toggle="dropdown" href="#"><i class="fa fa-plus"></i> New</a> >- <ul class="dropdown-menu"> >- [% IF CAN_user_acquisition_order_manage && active %] >- <li><a class="dropdown-item" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% booksellerid | uri %]&op=add_form">Basket</a></li> >- [% END %] >- [% IF CAN_user_acquisition_contracts_manage && active %] >- <li><a class="dropdown-item" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&booksellerid=[% booksellerid | uri %]">Contract</a></li> >- [% END %] >- [% IF ( CAN_user_acquisition_vendors_manage ) %] >- <li><a class="dropdown-item" href="/cgi-bin/koha/acqui/supplier.pl?op=enter">Vendor</a></li> >- [% END %] >- </ul> >+ <a class="btn btn-default dropdown-toggle" data-bs-toggle="dropdown" href="#"><i class="fa fa-plus"></i> New</a> >+ <ul class="dropdown-menu"> >+ [% IF CAN_user_acquisition_order_manage && active %] >+ <li><a class="dropdown-item" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% booksellerid | uri %]&op=add_form">Basket</a></li> >+ [% END %] >+ [% IF CAN_user_acquisition_contracts_manage && active %] >+ <li><a class="dropdown-item" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&booksellerid=[% booksellerid | uri %]">Contract</a></li> >+ [% END %] >+ [% IF ( CAN_user_acquisition_vendors_manage ) %] >+ <li><a class="dropdown-item" href="/cgi-bin/koha/acqui/supplier.pl?op=enter">Vendor</a></li> >+ [% END %] >+ </ul> > </div> >- [% IF ( CAN_user_acquisition_vendors_manage ) %] >+ [% IF ( CAN_user_acquisition_vendors_manage ) %] >+ <div class="btn-group"> >+ <a class="btn btn-default" id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]&op=enter"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit vendor</a> >+ </div> >+ [% UNLESS ( basketcount OR subscriptioncount ) %] > <div class="btn-group"> >- <a class="btn btn-default" id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]&op=enter"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit vendor</a> >+ <button type="button" data-bs-toggle="modal" data-bs-target="#deleteVendorModal" data-booksellerid="[% booksellerid | html %]" class="btn btn-default"><i class="fa fa-trash-can"></i> Delete vendor</button> > </div> >- [% UNLESS ( basketcount OR subscriptioncount ) %] >- <div class="btn-group"> >- <button type="button" data-bs-toggle="modal" data-bs-target="#deleteVendorModal" data-booksellerid="[% booksellerid | html %]" class="btn btn-default"><i class="fa fa-trash-can"></i> Delete vendor</button> >- </div> >- [% END %] > [% END %] >- [% IF CAN_user_acquisition_order_receive && basketcount && active %] >- <div class="btn-group"><a class="btn btn-default" id="receive" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid | html %]"><i class="fa fa-inbox"></i> Receive shipments</a></div> >- [% END %] >- [% ELSE %] >- <div class="btn-group"><a class="btn btn-default" href="/cgi-bin/koha/acqui/supplier.pl?op=enter"><i class="fa fa-plus"></i> New vendor</a></div> > [% END %] >+ [% IF CAN_user_acquisition_order_receive && basketcount && active %] >+ <div class="btn-group"><a class="btn btn-default" id="receive" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid | html %]"><i class="fa fa-inbox"></i> Receive shipments</a></div> >+ [% END %] >+ [% ELSIF ( CAN_user_acquisition_vendors_manage ) %] >+ <div class="btn-group"><a class="btn btn-default" href="/cgi-bin/koha/acqui/supplier.pl?op=enter"><i class="fa fa-plus"></i> New vendor</a></div> >+ [% END %] > </div> > <!-- / acquisitions-toolbar.inc --> >-- >2.39.3 (Apple Git-146)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38297
:
173710
|
173711
|
173713
|
173763