From 5df5f3dbea5d2f6652269e063e92292c3a707312 Mon Sep 17 00:00:00 2001 From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Date: Mon, 31 Jul 2023 18:19:49 +0200 Subject: [PATCH] Bug 30708: Do not allow non-authorised users to edit the settings Content-Type: text/plain; charset=utf-8 In case the logged in user does not have manage_sysprefs we should no display the form in the settings. Signed-off-by: Laurence Rault <laurence.rault@biblibre.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Koha/REST/V1/Preservation.pm | 4 ++ .../definitions/preservation_config.yaml | 3 ++ .../vue/components/Preservation/Settings.vue | 46 ++++++++++++++++++- 3 files changed, 51 insertions(+), 2 deletions(-) diff --git a/Koha/REST/V1/Preservation.pm b/Koha/REST/V1/Preservation.pm index 994f9eb583..1bc2ca4f0a 100644 --- a/Koha/REST/V1/Preservation.pm +++ b/Koha/REST/V1/Preservation.pm @@ -39,6 +39,7 @@ Return the configuration options needed for the Preservation Vue app sub config { my $c = shift->openapi->valid_input or return; + my $patron = $c->stash('koha.user'); return $c->render( status => 200, openapi => { @@ -47,6 +48,9 @@ sub config { not_for_loan_waiting_list_in => C4::Context->preference('PreservationNotForLoanWaitingListIn'), not_for_loan_default_train_in => C4::Context->preference('PreservationNotForLoanDefaultTrainIn'), }, + permissions => { + 'manage_sysprefs' => $patron->has_permission( { parameters => 'manage_sysprefs' } ) ? 1 : 0, + }, }, ); } diff --git a/api/v1/swagger/definitions/preservation_config.yaml b/api/v1/swagger/definitions/preservation_config.yaml index c88e1bd0bd..1e789d9c48 100644 --- a/api/v1/swagger/definitions/preservation_config.yaml +++ b/api/v1/swagger/definitions/preservation_config.yaml @@ -4,4 +4,7 @@ properties: settings: type: object description: List of sysprefs used for the Preservation module + permissions: + type: object + description: List of permissions of the logged in user used for the Preservation module additionalProperties: false diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue b/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue index 4170114aa9..6c8db0d2ee 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue +++ b/koha-tmpl/intranet-tmpl/prog/js/vue/components/Preservation/Settings.vue @@ -5,7 +5,10 @@ {{ $__("Edit preservation settings") }} </h2> <div> - <form @submit="onSubmit($event)"> + <form + v-if="config.permissions.manage_sysprefs" + @submit="onSubmit($event)" + > <fieldset class="rows"> <legend>{{ $__("General settings") }}</legend> <ol> @@ -72,6 +75,38 @@ > </fieldset> </form> + <fieldset v-else class="rows"> + <legend>{{ $__("General settings") }}</legend> + <ol> + <li> + <label for="not_for_loan_waiting_list_in" + >{{ + $__("Status for item added to waiting list") + }}:</label + > + <span>{{ + get_lib_from_av( + "av_notforloan", + config.settings.not_for_loan_waiting_list_in + ) + }}</span> + </li> + <li> + <label for="not_for_loan_default_train_in" + >{{ + $__("Default status for item added to train") + }}:</label + > + <span>{{ + get_lib_from_av( + "av_notforloan", + config.settings.not_for_loan_default_train_in + ) + }}</span> + </li> + </ol> + </fieldset> + <SettingsProcessings /> </div> </div> @@ -87,12 +122,19 @@ export default { setup() { const AVStore = inject("AVStore") const { av_notforloan } = storeToRefs(AVStore) + const { get_lib_from_av } = AVStore const { setMessage, setWarning } = inject("mainStore") const PreservationStore = inject("PreservationStore") const { config } = PreservationStore - return { av_notforloan, setMessage, setWarning, config } + return { + av_notforloan, + get_lib_from_av, + setMessage, + setWarning, + config, + } }, data() { return { -- 2.30.2