Bugzilla – Attachment 176050 Details for
Bug 38040
IndependentBranches doesn't prevent editing other libraries' holds
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled
Bug-38040-Prevent-editing-other-libraries-holds-wh.patch (text/plain), 5.14 KB, created by
David Nind
on 2025-01-01 20:48:59 UTC
(
hide
)
Description:
Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled
Filename:
MIME Type:
Creator:
David Nind
Created:
2025-01-01 20:48:59 UTC
Size:
5.14 KB
patch
obsolete
>From 36a85e804763b0a9494a97808bce2cde9f9bcee4 Mon Sep 17 00:00:00 2001 >From: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> >Date: Fri, 25 Oct 2024 12:30:51 -0400 >Subject: [PATCH] Bug 38040: Prevent editing other libraries' holds when > IndependentBranches is enabled > >When IndependentBranches is enabled, any staff member from >any library can see and edit the holds for patrons from >other libraries. > >Only superlibrarians should be able to edit all holds, >including those from other libraries. > >Staff patrons should only be able to edit or delete holds >for their library. > >Test plan: >1. Set IndependentBranches, IndependentBranchesPatronModifications, > and IndependentBranchesTransfers to 'Yes'. >2. Set canreservefromotherbranches to "Don't allow (with > independent branches)". >3. Give limited permissions to a staff patron > - circulate > - catalogue > - delete_borrowers > - edit_borrowers > - list_borrowers > - send_messages_to_borrowers > - reserveforothers > - updatecharges >4. As the superlibrarian, place several holds on a record with > items from various branches. >5. Log in as the restricted staff >6. View the holds for the record > --> Some will say "A patron from library XX" instead > of the name -- OK >7. Click the trash bin icon to cancel a hold from another library > --> Hold is cancelled -- NOT OK >8. Apply the patch and validate that step 7 is not possible now. > >Signed-off-by: David Nind <david@davidnind.com> >--- > .../prog/en/modules/reserve/request.tt | 22 +++++++++++++++++++ > reserve/request.pl | 17 ++++++++++---- > 2 files changed, 35 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >index 437f32c189..b15d0075e5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >@@ -102,6 +102,12 @@ > :disabled{ > opacity:0.5 > } >+ >+ .disabled_trash{ >+ pointer-events: none; >+ cursor: not-allowed ; >+ color: #777; >+ } > </style> > [% END %] > </head> >@@ -1860,6 +1866,22 @@ > return false; > }); > >+ [% IF (!is_super_librarian) %] >+ var user_branch = "[% user_branch %]"; >+ if(user_branch !== undefined && user_branch !== ""){ >+ $('#patron_holds_table tbody tr').each(function() { >+ var link = $(this).find('a[href*="member"]'); >+ var rankRequest = $(this).find("select[name='rank-request']"); >+ if (!link.length){ >+ $(this).find('.cancel-hold, .fa-trash').addClass('disabled_trash'); >+ } >+ $(this).find('.select_hold, .rank-request, td a[data-op="cud-move"], .flatpickr, .toggle-suspend, .clear_date, [name*="change_hold_type_"]').addClass('disabled').attr('disabled', 'disabled'); >+ $('.select_hold_all, .hold-arrow').addClass('disabled').attr('disabled', 'disabled'); >+ $('.suspend-hold').prop('disabled', true); >+ }); >+ } >+ [% END %] >+ > [% UNLESS ( patron || patron.borrowernumber || borrowers || noitems || nobiblio ) %] > [% IF ( PatronAutoComplete ) %] > patron_autocomplete($(".search_patron_filter"), { 'link-to': 'reserve', 'url-params': '[% url_biblio_params | url %]' }); >diff --git a/reserve/request.pl b/reserve/request.pl >index b9a3182d7c..d06b6a5aba 100755 >--- a/reserve/request.pl >+++ b/reserve/request.pl >@@ -40,6 +40,7 @@ use C4::Serials qw( CountSubscriptionFromBiblionumber ); > use C4::Circulation qw( _GetCircControlBranch GetBranchItemRule ); > use Koha::DateUtils qw( dt_from_string ); > use C4::Search qw( enabled_staff_search_views ); >+use C4::Context; > > use Koha::Biblios; > use Koha::Checkouts; >@@ -64,6 +65,14 @@ my ( $template, $borrowernumber, $cookie, $flags ) = get_template_and_user( > } > ); > >+my $is_super_librarian = C4::Context->IsSuperLibrarian(); >+my $user_branch = C4::Context->preference("IndependentBranches") ? C4::Context->userenv->{'branch'}: undef; >+ >+$template->param( >+ is_super_librarian => $is_super_librarian, >+ user_branch => $user_branch, >+); >+ > my $showallitems = $input->param('showallitems'); > my $pickup = $input->param('pickup'); > >@@ -112,10 +121,10 @@ if ( $op eq 'cud-move' ) { > } > } > elsif ( $op eq 'cud-cancel' ) { >- my $reserve_id = $input->param('reserve_id'); >- my $cancellation_reason = $input->param("cancellation-reason"); >- my $hold = Koha::Holds->find($reserve_id); >- $hold->cancel( { cancellation_reason => $cancellation_reason } ) if $hold; >+ my $reserve_id = $input->param('reserve_id'); >+ my $cancellation_reason = $input->param("cancellation-reason"); >+ my $hold = Koha::Holds->find($reserve_id); >+ $hold->cancel( { cancellation_reason => $cancellation_reason } ) if $hold; > } > elsif ( $op eq 'cud-setLowestPriority' ) { > my $reserve_id = $input->param('reserve_id'); >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38040
:
173400
|
176050
|
177197
|
177198
|
177292
|
177472
|
177492
|
178014
|
178015
|
178016
|
179186
|
179187
|
179714
|
180531
|
180532
|
180581
|
180582
|
180898
|
180899
|
180900
|
182444
|
182445
|
182446
|
182447