Bugzilla – Attachment 35763 Details for
Bug 13417
New permission to allow staff to remove public lists
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 13417: Limit the permission to delete
Bug-13417-Limit-the-permission-to-delete.patch (text/plain), 6.78 KB, created by
Jonathan Druart
on 2015-02-10 08:17:25 UTC
(
hide
)
Description:
Bug 13417: Limit the permission to delete
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2015-02-10 08:17:25 UTC
Size:
6.78 KB
patch
obsolete
>From 25a4ea3c936538fcb82284ab454f367e615fcfc4 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@biblibre.com> >Date: Wed, 17 Dec 2014 16:27:11 +0100 >Subject: [PATCH] Bug 13417: Limit the permission to delete > >It's preferable to limit the permission to delete shelves. > >Apply both patches before testing, then follow this test plan > >Currently a public list can only be deleted by its owner. >This means lists can exist infinitely. >This will introduce a new permission for list. With this permission, a >staff member will be allow to delete any public lists. > >Test plan: >1/ Add the manage_shelves permission to a patron. >2/ Login with this patron >3/ Go on the public list view >4/ You should be able to delete all public lists > >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > C4/VirtualShelves.pm | 6 +++--- > C4/VirtualShelves/Page.pm | 10 ++++++++-- > installer/data/mysql/en/mandatory/userpermissions.sql | 2 +- > installer/data/mysql/updatedatabase.pl | 4 ++-- > .../intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt | 4 +++- > 5 files changed, 17 insertions(+), 9 deletions(-) > >diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm >index f461d3c..8fd003a 100644 >--- a/C4/VirtualShelves.pm >+++ b/C4/VirtualShelves.pm >@@ -463,10 +463,10 @@ sub ShelfPossibleAction { > > return 0 unless defined($shelfnumber); > >- if ( $user > 0 ) { >+ if ( $user > 0 and $action eq 'delete_shelf' ) { > my $borrower = C4::Members::GetMember( borrowernumber => $user ); > return 1 >- if C4::Auth::haspermission( $borrower->{userid}, { shelves => 'manage_shelves' } ); >+ if C4::Auth::haspermission( $borrower->{userid}, { shelves => 'delete_shelves' } ); > } > > my $dbh = C4::Context->dbh; >@@ -520,7 +520,7 @@ sub ShelfPossibleAction { > return (0, 5); # code 5: should be private list > } > } >- elsif($action eq 'manage') { >+ elsif($action eq 'manage' or $action eq 'delete_shelf') { > return 1 if $user && $shelf->{owner}==$user; > } > return 0; >diff --git a/C4/VirtualShelves/Page.pm b/C4/VirtualShelves/Page.pm >index a5b3164..6117ea9 100644 >--- a/C4/VirtualShelves/Page.pm >+++ b/C4/VirtualShelves/Page.pm >@@ -310,6 +310,7 @@ sub shelfpage { > $showadd = 1; > my $i = 0; > my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' ); >+ my $can_delete_shelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete_shelf' ); > $template->param( > shelfname => $shelfname, > shelfnumber => $shelfnumber, >@@ -318,6 +319,7 @@ sub shelfpage { > manageshelf => $manageshelf, > allowremovingitems => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'), > allowaddingitem => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'), >+ allowdeletingshelf => $can_delete_shelf, > "category$category" => 1, > category => $category, > itemsloop => $items, >@@ -374,8 +376,10 @@ sub shelfpage { > $stay=0; > next; > } >- # >- unless ( ShelfPossibleAction( $loggedinuser, $number, 'manage' ) ) { >+ >+ my $can_manage = ShelfPossibleAction( $loggedinuser, $number, 'manage' ); >+ my $can_delete = ShelfPossibleAction( $loggedinuser, $number, 'delete_shelf' ); >+ unless ( $can_manage or $can_delete ) { > push( @paramsloop, { nopermission => $shelfnumber } ); > last; > } >@@ -428,8 +432,10 @@ sub shelfpage { > my $category = $shelflist->{$element}->{'category'}; > my $owner = $shelflist->{$element}->{'owner'}||0; > my $canmanage = ShelfPossibleAction( $loggedinuser, $element, 'manage' ); >+ my $candelete = ShelfPossibleAction( $loggedinuser, $element, 'delete_shelf' ); > $shelflist->{$element}->{"viewcategory$category"} = 1; > $shelflist->{$element}->{manageshelf} = $canmanage; >+ $shelflist->{$element}->{allowdeletingshelf} = $candelete; > if($canmanage || ($loggedinuser && $owner==$loggedinuser)) { > $shelflist->{$element}->{'mine'} = 1; > } >diff --git a/installer/data/mysql/en/mandatory/userpermissions.sql b/installer/data/mysql/en/mandatory/userpermissions.sql >index 12768b7..a5f574f 100644 >--- a/installer/data/mysql/en/mandatory/userpermissions.sql >+++ b/installer/data/mysql/en/mandatory/userpermissions.sql >@@ -72,5 +72,5 @@ INSERT INTO permissions (module_bit, code, description) VALUES > (19, 'tool', 'Use tool plugins'), > (19, 'report', 'Use report plugins'), > (19, 'configure', 'Configure plugins'), >- (20, 'manage_shelves', 'Manage shelves') >+ (20, 'delete_shelves', 'Delete shelves') > ; >diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl >index b4d1953..bdb6efa 100755 >--- a/installer/data/mysql/updatedatabase.pl >+++ b/installer/data/mysql/updatedatabase.pl >@@ -9767,9 +9767,9 @@ if ( CheckVersion($DBversion) ) { > |); > $dbh->do(q| > INSERT INTO permissions (module_bit, code, description) VALUES >- (20, 'manage_shelves', 'Manage shelves') >+ (20, 'delete_shelves', 'Delete shelves') > |); >- print "Upgrade to $DBversion done (Bug 13417: Add permission to manage shelves)\n"; >+ print "Upgrade to $DBversion done (Bug 13417: Add permission to delete shelves)\n"; > SetVersion ($DBversion); > } > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >index 97e47a7..bba00b3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >@@ -600,12 +600,14 @@ function placeHold () { > [% IF ( shelvesloo.viewcategory2 ) %]Public[% END %] > </td> > <td> >- [% IF ( shelvesloo.manageshelf ) %] >+ [% IF shelvesloo.manageshelf %] > <form action="shelves.pl" method="get"> > <input type="hidden" name="shelfnumber" value="[% shelvesloo.shelf %]" /> > <input type="hidden" name="op" value="modif" /> > <input type="submit" class="editshelf" value="Edit" /> > </form> >+ [% END %] >+ [% IF shelvesloo.manageshelf OR shelvesloo.allowdeletingshelf %] > <form action="shelves.pl" method="post"> > <input type="hidden" name="shelfoff" value="[% shelfoff %]" /> > <input type="hidden" name="shelves" value="1" /> >-- >2.1.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 13417
:
34233
|
34249
|
34483
|
34485
|
34743
|
34744
|
34942
|
34943
|
35083
|
35084
|
35085
|
35086
|
35089
|
35762
| 35763 |
35764
|
35765
|
35766
|
37051