From 70c745955e8a0c4c3857ecf476694f3177d9e0da Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 12 Jan 2021 14:24:41 +0000 Subject: [PATCH] Bug 15788: Use delete_borrowers permission Link the new delete_borrowers sub-permission to the delete actions. Test plan 1/ Remove the delete_borrowers permission from a staff user 2/ Check that the user cannot use the 'Delete' option from the members menu. --- koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc | 2 +- koha-tmpl/intranet-tmpl/prog/js/members-menu.js | 4 +++- members/deletemem.pl | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc index bebe5a143c..4600a35d20 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -63,7 +63,7 @@ [% END %] [% END %] - [% IF CAN_user_borrowers_edit_borrowers %] + [% IF CAN_user_borrowers_delete_borrowers %]
  • Delete
  • [% ELSE %]
  • Delete
  • diff --git a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js index 9db8b24bbe..40d6176f99 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/members-menu.js +++ b/koha-tmpl/intranet-tmpl/prog/js/members-menu.js @@ -26,10 +26,12 @@ $(document).ready(function(){ searchfield_date_tooltip('_filter'); }); - if( CAN_user_borrowers_edit_borrowers ){ + if( CAN_user_borrowers_delete_borrowers ){ $("#deletepatron").click(function(){ window.location='/cgi-bin/koha/members/deletemem.pl?member=' + borrowernumber; }); + } + if( CAN_user_borrowers_edit_borrowers ){ $("#renewpatron").click(function(){ confirm_reregistration(); $(".btn-group").removeClass("open"); diff --git a/members/deletemem.pl b/members/deletemem.pl index 492e00e581..c5277949f1 100755 --- a/members/deletemem.pl +++ b/members/deletemem.pl @@ -42,7 +42,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({template_name => "members/deletemem.tt", query => $input, type => "intranet", - flagsrequired => {borrowers => 'edit_borrowers'}, + flagsrequired => {borrowers => 'delete_borrowers'}, debug => 1, }); @@ -70,7 +70,7 @@ if ($patron->category->category_type eq "S") { exit 0; # Exit without error } } else { - unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>'edit_borrowers'})) { + unless(C4::Auth::haspermission($userenv->{'id'},{'borrowers'=>'delete_borrowers'})) { print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE"); exit 0; # Exit without error } -- 2.20.1