View | Details | Raw Unified | Return to bug 26346
Collapse All | Expand All

(-)a/Koha/Virtualshelf.pm (-3 / +7 lines)
Lines 187-193 sub add_biblio { Link Here
187
    return if $already_exists;
187
    return if $already_exists;
188
188
189
    # Check permissions
189
    # Check permissions
190
    return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) || ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) || $self->allow_change_from_others;
190
    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
191
    return unless ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) || ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) || $self->allow_change_from_others;
191
192
192
    my $content = Koha::Virtualshelfcontent->new(
193
    my $content = Koha::Virtualshelfcontent->new(
193
        {
194
        {
Lines 209-216 sub remove_biblios { Link Here
209
    return unless @$biblionumbers;
210
    return unless @$biblionumbers;
210
211
211
    my $number_removed = 0;
212
    my $number_removed = 0;
213
    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
212
    if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )
214
    if( ( $self->owner == $borrowernumber && $self->allow_change_from_owner )
213
      || ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists )
215
      || ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists )
214
      || $self->allow_change_from_others ) {
216
      || $self->allow_change_from_others ) {
215
        $number_removed += $self->get_contents->search({
217
        $number_removed += $self->get_contents->search({
216
            biblionumber => $biblionumbers,
218
            biblionumber => $biblionumbers,
Lines 258-266 sub can_be_managed { Link Here
258
sub can_biblios_be_added {
260
sub can_biblios_be_added {
259
    my ( $self, $borrowernumber ) = @_;
261
    my ( $self, $borrowernumber ) = @_;
260
262
263
    my $patron = Koha::Patrons->find( $borrowernumber ) or return 0;
261
    return 1
264
    return 1
262
      if $borrowernumber
265
      if $borrowernumber
263
      and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );
266
      and ( ( $self->owner == $borrowernumber && $self->allow_change_from_owner ) or ( $self->allow_change_from_staff && $patron->can_patron_change_staff_only_lists ) or $self->allow_change_from_others );
264
    return 0;
267
    return 0;
265
}
268
}
266
269
Lines 274-276 sub _type { Link Here
274
    return 'Virtualshelve';
277
    return 'Virtualshelve';
275
}
278
}
276
279
280
1;
(-)a/Koha/Virtualshelves.pm (-26 / +11 lines)
Lines 23-30 use Koha::Database; Link Here
23
23
24
use Koha::Virtualshelf;
24
use Koha::Virtualshelf;
25
25
26
use C4::Auth;
27
28
use base qw(Koha::Objects);
26
use base qw(Koha::Objects);
29
27
30
=head1 NAME
28
=head1 NAME
Lines 90-119 sub get_some_shelves { Link Here
90
88
91
    my @conditions;
89
    my @conditions;
92
    if ( $add_allowed ) {
90
    if ( $add_allowed ) {
93
        if ( Koha::Patrons->find( $borrowernumber )->can_patron_change_staff_only_lists ) {
91
        push @conditions, {
94
            push @conditions, {
92
            -or =>
95
                -or =>
93
            [
96
                [
94
                {
97
                    {
95
                    "me.owner" => $borrowernumber,
98
                        "me.owner" => $borrowernumber,
96
                    "me.allow_change_from_owner" => 1,
99
                        "me.allow_change_from_owner" => 1,
97
                },
100
                    },
98
                "me.allow_change_from_others" => 1,
101
                    "me.allow_change_from_others" => 1,
99
                "me.allow_change_from_staff" => 1,
102
                    "me.allow_change_from_staff"  => 1
100
            ]
103
                ]
101
        };
104
            };
105
        } else {
106
            push @conditions, {
107
                -or =>
108
                [
109
                    {
110
                        "me.owner" => $borrowernumber,
111
                        "me.allow_change_from_owner" => 1,
112
                    },
113
                    "me.allow_change_from_others" => 1,
114
                ]
115
            };
116
        }
117
    }
102
    }
118
    if ( $category == 1 ) {
103
    if ( $category == 1 ) {
119
        push @conditions, {
104
        push @conditions, {
(-)a/opac/opac-shelves.pl (-1 / +2 lines)
Lines 436-442 if ( $op eq 'list' ) { Link Here
436
        ),
436
        ),
437
    );
437
    );
438
}
438
}
439
my $staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;
439
my $staffuser;
440
$staffuser = Koha::Patrons->find( $loggedinuser )->can_patron_change_staff_only_lists if $loggedinuser;
440
$template->param(
441
$template->param(
441
    op       => $op,
442
    op       => $op,
442
    referer  => $referer,
443
    referer  => $referer,
(-)a/t/db_dependent/Virtualshelves.t (-6 / +5 lines)
Lines 381-407 subtest 'Shelf permissions' => sub { Link Here
381
    $private_shelf->allow_change_from_staff(1);
381
    $private_shelf->allow_change_from_staff(1);
382
    $private_shelf->allow_change_from_others(0);
382
    $private_shelf->allow_change_from_others(0);
383
    $private_shelf->store;
383
    $private_shelf->store;
384
    is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view his list' );
384
    is( $private_shelf->can_be_viewed( $patron1->{borrowernumber} ), 1, 'The owner should be able to view their list' );
385
    is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
385
    is( $private_shelf->can_be_viewed( $patron2->{borrowernumber} ), 0, 'Private list should not be viewed by another staff member' );
386
    is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
386
    is( $private_shelf->can_be_viewed( $patron3->{borrowernumber} ), 0, 'Private list should not be viewed by someone with no special permissions' );
387
    is( $private_shelf->can_be_viewed( $patron4->{borrowernumber} ), 0, 'Private list should not be viewed by someone with the edit_public_lists sub-permission checked' );
387
    is( $private_shelf->can_be_viewed( $patron4->{borrowernumber} ), 0, 'Private list should not be viewed by someone with the edit_public_lists sub-permission checked' );
388
388
389
    is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete his list' );
389
    is( $private_shelf->can_be_deleted( $patron1->{borrowernumber} ), 1, 'The owner should be able to delete their list' );
390
    is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
390
    is( $private_shelf->can_be_deleted( $patron2->{borrowernumber} ), 0, 'Private list should not be deleted by another staff member' );
391
    is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
391
    is( $private_shelf->can_be_deleted( $patron3->{borrowernumber} ), 0, 'Private list should not be deleted by someone with no special permissions' );
392
    is( $private_shelf->can_be_deleted( $patron4->{borrowernumber} ), 0, 'Private list should not be deleted by someone with the edit_public_lists sub-permission checked' );
392
    is( $private_shelf->can_be_deleted( $patron4->{borrowernumber} ), 0, 'Private list should not be deleted by someone with the edit_public_lists sub-permission checked' );
393
393
394
    is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage his list' );
394
    is( $private_shelf->can_be_managed( $patron1->{borrowernumber} ), 1, 'The owner should be able to manage their list' );
395
    is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
395
    is( $private_shelf->can_be_managed( $patron2->{borrowernumber} ), 0, 'Private list should not be managed by another staff member' );
396
    is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
396
    is( $private_shelf->can_be_managed( $patron3->{borrowernumber} ), 0, 'Private list should not be managed by someone with no special permissions' );
397
    is( $private_shelf->can_be_managed( $patron4->{borrowernumber} ), 0, 'Private list should not be managed by someone with the edit_public_lists sub-permission checked' );
397
    is( $private_shelf->can_be_managed( $patron4->{borrowernumber} ), 0, 'Private list should not be managed by someone with the edit_public_lists sub-permission checked' );
398
398
399
    is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to his list' );
399
    is( $private_shelf->can_biblios_be_added( $patron1->{borrowernumber} ), 1, 'The owner should be able to add biblios to their list' );
400
    is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list should not modified (add) by another staff member # individual check done later' );
400
    is( $private_shelf->can_biblios_be_added( $patron2->{borrowernumber} ), 1, 'Private list should not modified (add) by another staff member # individual check done later' );
401
    is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );
401
    is( $private_shelf->can_biblios_be_added( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with no special permissions' );
402
    is ( $private_shelf->can_biblios_be_added( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with the edit_public_lists sub-permission checked' );
402
    is ( $private_shelf->can_biblios_be_added( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (add) by someone with the edit_public_lists sub-permission checked' );
403
403
404
    is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to his list' );
404
    is( $private_shelf->can_biblios_be_removed( $patron1->{borrowernumber} ), 1, 'The owner should be able to remove biblios to their list' );
405
    is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list should be modified (remove) by another staff member # individual check done later' );
405
    is( $private_shelf->can_biblios_be_removed( $patron2->{borrowernumber} ), 1, 'Private list should be modified (remove) by another staff member # individual check done later' );
406
    is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );
406
    is( $private_shelf->can_biblios_be_removed( $patron3->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with no special permissions' );
407
    is( $private_shelf->can_biblios_be_removed( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with the edit_public_lists sub-permission checked' );
407
    is( $private_shelf->can_biblios_be_removed( $patron4->{borrowernumber} ), 0, 'Private list should not be modified (remove) by someone with the edit_public_lists sub-permission checked' );
408
- 

Return to bug 26346