Attachment 89482 Details for Bug 22724 – Bug 22724: (follow-up) Block writeoffs when user has wrong permissions

[patch] Bug 22724: (follow-up) Block writeoffs when user has wrong permissions

Bug-22724-follow-up-Block-writeoffs-when-user-has-.patch (text/plain), 3.25 KB, created by Hayley Pelham on 2019-05-08 22:23:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hayley Pelham

Created: 2019-05-08 22:23:41 UTC

Size: 3.25 KB

patch

obsolete

>From fe7c0e503f8357638d01e6f11fbc4256ec703ec2 Mon Sep 17 00:00:00 2001
>From: Hayley Mapley <hayleymapley@catalyst.net.nz>
>Date: Thu, 9 May 2019 10:11:13 +1200
>Subject: [PATCH] Bug 22724: (follow-up) Block writeoffs when user has wrong
> permissions
>
>This patch is a followup which displays an alert and removes the submit
>button when a user who does not have writeoff permissions manages to
>make it to the 'Make a payment' tab with a writeoff URL.
>
>Test plan:
>1) Login as a staff user with writeoff permissions disabled, ensure you
>have sample users, then click
>the URL: http://localhost:8081/cgi-bin/koha/members/paycollect.pl?borrowernumber=21&type=writeoff&amt=4&selected=1&notes=
>=> Note that you are able to write off the charge with no warning
>2) Apply the patch
>3) Repeat step 1
>=> Note that an alert displays and the button to confirm the writeoff
>has been removed
>4) Repeat step 1, this time logging in as a staff user with writeoff
>permissions enabled
>=> Note that the button displays and you can perform the writeoff
>
>Sponsored-by: Catalyst IT
>---
> .../intranet-tmpl/prog/en/modules/members/paycollect.tt | 17 +++++++++++++++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>index 78ee2ed934..b65d0c4d99 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>@@ -131,6 +131,11 @@
>         </div>
>     </form>
> [% ELSIF ( writeoff_individual ) %]
>+
>+    [% IF CAN_user_updatecharges_writeoff %]
>+        <p class="alert">You do not have the permissions required to write off this charge.</p>
>+    [% END %]
>+
>     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
>     <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>     <fieldset class="rows">
>@@ -171,12 +176,18 @@
>             </ol>
>         </fieldset>
>         <div class="action">
>-            <input type="submit" value="Write off this charge" />
>+            [% IF CAN_user_updatecharges_writeoff %]
>+                <input type="submit" value="Write off this charge" />
>+            [% END %]
>             <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
>         </div>
>     </form>
> [% ELSE %]
> 
>+    [% IF !CAN_user_updatecharges_writeoff %]
>+        <p class="alert">You do not have the permissions required to write off this charge.</p>
>+    [% END %]
>+
>     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
>     <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
>@@ -235,7 +246,9 @@
>     </ol>
>     </fieldset>
>     <div class="action">
>-        <input type="submit" name="submitbutton" value="Confirm" />
>+        [% IF CAN_user_updatecharges_writeoff %]
>+            <input type="submit" name="submitbutton" value="Confirm" />
>+        [% END %]
>         <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
>     </div>
>     </form>
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 22724: 89457 | 89475 | 89482 | 89485 | 89602 | 89603 | 89604 | 89826 | 89827 | 89878 | 89879 | 90153