Bugzilla – Attachment 179186 Details for
Bug 38040
IndependentBranches doesn't prevent editing other libraries' holds
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled
Bug-38040-Prevent-editing-other-libraries-holds-wh.patch (text/plain), 4.65 KB, created by
William Lavoie
on 2025-03-11 20:09:11 UTC
(
hide
)
Description:
Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled
Filename:
MIME Type:
Creator:
William Lavoie
Created:
2025-03-11 20:09:11 UTC
Size:
4.65 KB
patch
obsolete
>From 23be3e350d53397b3973e0324c24bcf38f2aef77 Mon Sep 17 00:00:00 2001 >From: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> >Date: Fri, 25 Oct 2024 12:30:51 -0400 >Subject: [PATCH] Bug 38040: Prevent editing other libraries' holds when > IndependentBranches is enabled > >When IndependentBranches is enabled, any staff member from >any library can see and edit the holds for patrons from >other libraries. > >Only superlibrarians should be able to edit all holds, >including those from other libraries. > >Staff patrons should only be able to edit or delete holds >for their library. > >Test plan: >1. Set IndependentBranches, IndependentBranchesPatronModifications, > and IndependentBranchesTransfers to 'Yes'. >2. Set canreservefromotherbranches to "Don't allow (with > independent branches)". >3. Give limited permissions to a staff patron > - circulate > - catalogue > - delete_borrowers > - edit_borrowers > - list_borrowers > - send_messages_to_borrowers > - reserveforothers > - updatecharges >4. As the superlibrarian, place several holds on a record with > items from various branches. >5. Log in as the restricted staff >6. View the holds for the record > --> Some will say "A patron from library XX" instead > of the name -- OK >7. Click the trash bin icon to cancel a hold from another library > --> Hold is cancelled -- NOT OK >8. Apply the patch and validate that step 7 is not possible now. > >Signed-off-by: David Nind <david@davidnind.com> >--- > .../prog/en/modules/reserve/request.tt | 22 +++++++++++++++++++ > reserve/request.pl | 13 +++++++++++ > 2 files changed, 35 insertions(+) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >index 558b5e0d9f..2473961b74 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >@@ -105,6 +105,12 @@ > :disabled { > opacity: 0.5; > } >+ >+ .disabled_trash{ >+ pointer-events: none; >+ cursor: not-allowed ; >+ color: #777; >+ } > </style> > [% END %] > </head> >@@ -1801,6 +1807,22 @@ > return false; > }); > >+ [% IF (!CAN_user_superlibrarian) %] >+ var user_branch = "[% Branches.GetLoggedInBranchcode %]"; >+ if(user_branch !== undefined && user_branch !== ""){ >+ $('#patron_holds_table tbody tr').each(function() { >+ var link = $(this).find('a[href*="member"]'); >+ var rankRequest = $(this).find("select[name='rank-request']"); >+ if (!link.length){ >+ $(this).find('.cancel-hold, .fa-trash').addClass('disabled_trash'); >+ } >+ $(this).find('.select_hold, .rank-request, td a[data-op="cud-move"], .flatpickr, .toggle-suspend, .clear_date, [name*="change_hold_type_"]').addClass('disabled').attr('disabled', 'disabled'); >+ $('.select_hold_all, .hold-arrow').addClass('disabled').attr('disabled', 'disabled'); >+ $('.suspend-hold').prop('disabled', true); >+ }); >+ } >+ [% END %] >+ > [% UNLESS ( patron || patron.borrowernumber || borrowers || noitems || nobiblio ) %] > [% IF ( PatronAutoComplete ) %] > patron_autocomplete($(".search_patron_filter"), { 'link-to': 'reserve', 'url-params': '[% url_biblio_params | url %]' }); >diff --git a/reserve/request.pl b/reserve/request.pl >index c5e354aa7d..e6c4b9f368 100755 >--- a/reserve/request.pl >+++ b/reserve/request.pl >@@ -39,7 +39,12 @@ use C4::Koha qw( getitemtypeimagelocation ); > use C4::Serials qw( CountSubscriptionFromBiblionumber ); > use C4::Circulation qw( _GetCircControlBranch GetBranchItemRule ); > use Koha::DateUtils qw( dt_from_string ); >+<<<<<<< HEAD > use C4::Search qw( enabled_staff_search_views ); >+======= >+use C4::Search qw( enabled_staff_search_views ); >+use C4::Context; >+>>>>>>> Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled > > use Koha::Biblios; > use Koha::Checkouts; >@@ -64,6 +69,14 @@ my ( $template, $borrowernumber, $cookie, $flags ) = get_template_and_user( > } > ); > >+my $is_super_librarian = C4::Context->IsSuperLibrarian(); >+my $user_branch = C4::Context->preference("IndependentBranches") ? C4::Context->userenv->{'branch'}: undef; >+ >+$template->param( >+ is_super_librarian => $is_super_librarian, >+ user_branch => $user_branch, >+); >+ > my $showallitems = $input->param('showallitems'); > my $pickup = $input->param('pickup'); > >-- >2.43.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38040
:
173400
|
176050
|
177197
|
177198
|
177292
|
177472
|
177492
|
178014
|
178015
|
178016
|
179186
|
179187
|
179714
|
180531
|
180532
|
180581
|
180582
|
180898
|
180899
|
180900
|
182444
|
182445
|
182446
|
182447