Attachment 72240 Details for Bug 15520 – Bug 15520: Add permission to restrict circ rules editing to own library

[patch] Bug 15520: Add permission to restrict circ rules editing to own library

Bug-15520-Add-permission-to-restrict-circ-rules-ed.patch (text/plain), 8.41 KB, created by Jesse Weaver on 2018-02-26 19:33:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jesse Weaver

Created: 2018-02-26 19:33:38 UTC

Size: 8.41 KB

patch

obsolete

>From 3d04b3f8601d1285be96819e93904721ae2fa8e3 Mon Sep 17 00:00:00 2001
>From: Jesse Weaver <jweaver@bywatersolutions.com>
>Date: Thu, 31 Aug 2017 17:02:42 -0600
>Subject: [PATCH] Bug 15520: Add permission to restrict circ rules editing to
> own library
>
>Test plan:
>
>1) Ensure that you have four users:
> a) A superlibrarian
> b) A user with all `parameters` permissions (the toplevel `parameters`
>    box is checked).
> c) A user with the `manage_circ_rules` permission (and, of course,
>    `catalogue`).
> d) A user with the `manage_circ_rules`, `manage_circ_rules_restricted`
>    and `catalogue` permissions.
>2) As all four users, load the "Circulation and fine rules"
>   administration page (admin/smart-rules.pl).
>3) The page should be unchanged for the first three users. It should be
>   possible to view and edit the circ rules for all libraries.
>4) The last (restricted) user should only be able to view and edit the
>   circ rules for their own library.
>
>Followed test plan, patch worked as described
>Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
>---
> C4/Auth.pm                                         | 12 ++++++---
> admin/smart-rules.pl                               |  7 +++++
> .../bug_15520-add_manage_circ_rules_restricted.sql |  1 +
> .../intranet-tmpl/prog/en/includes/permissions.inc |  3 ++-
> .../prog/en/modules/admin/smart-rules.tt           | 30 ++++++++++++----------
> 5 files changed, 34 insertions(+), 19 deletions(-)
> create mode 100644 installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index c3ad351aa1..7fee0870a4 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -2026,17 +2026,20 @@ sub get_all_subpermissions {
> 
> =head2 haspermission
> 
>-  $flags = ($userid, $flagsrequired);
>+  $flags = ( $userid, $flagsrequired[, { no_inherit => 1 } ] );
> 
> C<$userid> the userid of the member
> C<$flags> is a hashref of required flags like C<$borrower-&lt;{authflags}> 
>+C<no_inherit>, if true, means that this function will not return true if
>+$flagsrequired is { module => 'sub_perm' } and the user only has { module => 1 }.
>+This is useful for *_restricted permissions.
> 
> Returns member's flags or 0 if a permission is not met.
> 
> =cut
> 
> sub haspermission {
>-    my ( $userid, $flagsrequired ) = @_;
>+    my ( $userid, $flagsrequired, $options ) = @_;
>     my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
>     $sth->execute($userid);
>     my $row = $sth->fetchrow();
>@@ -2047,7 +2050,7 @@ sub haspermission {
>         $flags->{'superlibrarian'} = 1;
>     }
> 
>-    return $flags if $flags->{superlibrarian};
>+    return $flags if $flags->{superlibrarian} && !$options->{no_inherit};
> 
>     foreach my $module ( keys %$flagsrequired ) {
>         my $subperm = $flagsrequired->{$module};
>@@ -2056,7 +2059,8 @@ sub haspermission {
>         } else {
>             return 0 unless (
>                 ( defined $flags->{$module} and
>-                    $flags->{$module} == 1 )
>+                    $flags->{$module} == 1 and
>+                    !$options->{no_inherit} )
>                 or
>                 ( ref( $flags->{$module} ) and
>                     exists $flags->{$module}->{$subperm} and
>diff --git a/admin/smart-rules.pl b/admin/smart-rules.pl
>index 718b68235c..fb3254a74f 100755
>--- a/admin/smart-rules.pl
>+++ b/admin/smart-rules.pl
>@@ -33,6 +33,7 @@ use Koha::RefundLostItemFeeRule;
> use Koha::RefundLostItemFeeRules;
> use Koha::Libraries;
> use Koha::Patron::Categories;
>+use Koha::Patrons;
> 
> my $input = CGI->new;
> my $dbh = C4::Context->dbh;
>@@ -59,6 +60,12 @@ unless ( $branch ) {
>         $branch = C4::Context::only_my_library() ? ( C4::Context::mybranch() || '*' ) : '*';
>     }
> }
>+
>+my $uid = Koha::Patrons->find( $loggedinuser )->userid;
>+my $restricted_to_own_library = $uid && haspermission( $uid, { parameters => 'manage_circ_rules_restricted' }, { no_inherit => 1 } );
>+$template->param( restricted_to_own_library => $restricted_to_own_library );
>+$branch = C4::Context::mybranch() if $restricted_to_own_library;
>+
> $branch = '*' if $branch eq 'NO_LIBRARY_SET';
> 
> my $op = $input->param('op') || q{};
>diff --git a/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql b/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql
>new file mode 100644
>index 0000000000..830f4fb0aa
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql
>@@ -0,0 +1 @@
>+INSERT IGNORE INTO `permissions` (module_bit, code, description) VALUES(3, 'manage_circ_rules_restricted', 'Only manage circ rules for own library');
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
>index 7dde923c15..7a8a036b1a 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
>@@ -32,7 +32,8 @@
>     [%- CASE 'overdues_report' -%]<span>Execute overdue items report</span>
>     [%- CASE 'override_renewals' -%]<span>Override blocked renewals</span>
>     [%- CASE 'self_checkout' -%]<span>Perform self checkout at the OPAC. It should be used for the patron matching the AutoSelfCheckID</span>
>-    [%- CASE 'manage_circ_rules' -%]<span>manage circulation rules</span>
>+    [%- CASE 'manage_circ_rules' -%]<span>Manage circulation rules</span>
>+    [%- CASE 'manage_circ_rules_restricted' -%]<span>Limit circulation rules editing to the user's own library (please note that manage_circ_rules is still required)</span>
>     [%- CASE 'parameters_remaining_permissions' -%]<span>Remaining system parameters permissions</span>
>     [%- CASE 'edit_borrowers' -%]<span>Add, modify and view patron information</span>
>     [%- CASE 'view_borrower_infos_from_any_libraries' -%]<span>View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries.</span>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
>index e1a5839f8a..fa27da0eba 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
>@@ -38,22 +38,24 @@
>         <p>To modify a rule, create a new one with the same patron category and item type.</p>
>     </div>
>     <div>
>-        <form method="get" action="/cgi-bin/koha/admin/smart-rules.pl" id="selectlibrary">
>-        Select a library :
>-            <select name="branch" id="branch" style="width:20em;">
>-                <option value="*">Standard rules for all libraries</option>
>-                [% PROCESS options_for_libraries libraries => Branches.all( selected => current_branch, unfiltered => 1 ) %]
>-            </select>
>-        </form>
>-        [% IF ( definedbranch ) %]
>-            <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
>-                <label for="tobranch"><strong>Clone these rules to:</strong></label>
>-                <input type="hidden" name="frombranch" value="[% current_branch %]" />
>-                <select name="tobranch" id="tobranch">
>-                    [% PROCESS options_for_libraries libraries => Branches.all( unfiltered => 1 ) %]
>+        [% UNLESS restricted_to_own_library %]
>+            <form method="get" action="/cgi-bin/koha/admin/smart-rules.pl" id="selectlibrary">
>+            Select a library :
>+                <select name="branch" id="branch" style="width:20em;">
>+                    <option value="*">Standard rules for all libraries</option>
>+                    [% PROCESS options_for_libraries libraries => Branches.all( selected => current_branch, unfiltered => 1 ) %]
>                 </select>
>-                <input type="submit" id="clone_rules" value="Clone" />
>             </form>
>+            [% IF ( definedbranch ) %]
>+                <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
>+                    <label for="tobranch"><strong>Clone these rules to:</strong></label>
>+                    <input type="hidden" name="frombranch" value="[% current_branch %]" />
>+                    <select name="tobranch" id="tobranch">
>+                        [% PROCESS options_for_libraries libraries => Branches.all( unfiltered => 1 ) %]
>+                    </select>
>+                    <input type="submit" id="clone_rules" value="Clone" />
>+                </form>
>+            [% END %]
>         [% END %]
> 
>         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
>-- 
>2.15.1

Actions: View | Diff | Splinter Review

Attachments on bug 15520: 66681 | 67177 | 70387 | 72240 | 72241 | 77202 | 77203 | 77219 | 77220 | 78275 | 78276 | 78722 | 78723 | 78735 | 78736 | 79780 | 79781 | 79782