From 3ecec131fc3c36433919bd9358df2cab80afc46d Mon Sep 17 00:00:00 2001
From: Hammat Wele <hammat.wele@inlibro.com>
Date: Mon, 28 Aug 2023 17:21:44 +0000
Subject: [PATCH] Bug 34631: Independentbranches - Non-superuser should not be
 able to write Additional contents for other branches

When syspref Independentbranches is enabled Non-superuser should not be able to write Additional contents for other branches

To reproduce:
1- Connect to staff interface as superlibrarian
2- Enable IndependentBranches preference
3- Go to Tools -> HTML customizations
4- Crete an additional content for all libraries
5- Create or edit a borrower
    5-1- Set permission for the borrower
        - catalogue
        - edit_additional_contents
4- Log in to the staff interface with the non-superlibrarian staff user
5- Go to Tools -> HTML customizations
    --> you can delete or edit the additional contents created by superlibrarian for All libraries
6- Click on New entry
    --> you can add additional content for other branches
7- Apply the patch
8- Repeat step 5
    --> you cannot delete or edit the additional contents create by superlibrarian for All libraries
9- Repeat step 6
    --> you cannot add additional content for other branches
10- submit the form
    --> the branch of the created additional content is the current user branch

Signed-off-by: John Doe <you@example.com>
---
 .../en/modules/tools/additional-contents.tt   |  8 +-
 tools/additional-contents.pl                  | 83 ++++++++++---------
 2 files changed, 53 insertions(+), 38 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
index 2a7ff46f7b..a8e8990529 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt
@@ -239,6 +239,7 @@
                     </select>
                     [% INCLUDE 'html-customization-help.inc' %]
                 </li>
+                [% UNLESS my_branch %]
                 <li>
                     <label for="branchcode">Library: </label>
                     <select id="branchcode" name="branchcode">
@@ -250,6 +251,7 @@
                         [% PROCESS options_for_libraries libraries => Branches.all( selected => additional_content.branchcode, unfiltered => 1, ) %]
                     </select>
                 </li>
+                [% END %]
                 [% UNLESS languages.size %]
                     <li>
                         [% IF category == 'news' %]
@@ -404,7 +406,9 @@
                             [% SET default_localization = c.default_localization %]
                             [% IF ( c.is_expired ) %]<tr class="expired">[% ELSE %]<tr>[% END %]
                             <td>
-                                <input type="checkbox" name="ids" value="[% c.id | html %]" />
+                            [% UNLESS ( my_branch && my_branch != c.branchcode ) %]
+                                <input type="checkbox" name="ids" value="[% c.idnew | html %]" />
+                            [% END %]
                             </td>
                             <td>
                                 [% IF c.category == 'news' || c.category == 'pages' %]
@@ -460,6 +464,7 @@
                                 </div>
                             </td>
                             <td class="actions">
+                            [% UNLESS ( my_branch && my_branch != c.branchcode ) %]
                                 <div class="btn-group dropup">
                                     <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&amp;id=[% c.id | uri %]&editmode=[% editmode | uri %]" class="btn btn-default btn-xs"> <i class="fa-solid fa-pencil"></i> Edit</a><button class="btn btn-default btn-xs dropdown-toggle" data-toggle="dropdown">
                                         <span class="caret"></span>
@@ -477,6 +482,7 @@
                                 <div class="btn-group">
                                     <a href="#" class="delete_news btn btn-default btn-xs" data-id="[% c.id | html %]"><i class="fa fa-trash-can"></i> Delete</a>
                                 </div>
+                            [% END %]
                             </td>
                         </tr>
                         [% END %]
diff --git a/tools/additional-contents.pl b/tools/additional-contents.pl
index 8cfdd34ab5..eaaa59cfe5 100755
--- a/tools/additional-contents.pl
+++ b/tools/additional-contents.pl
@@ -38,14 +38,14 @@ use Koha::AdditionalContents;
 
 my $cgi = CGI->new;
 
-my $op             = $cgi->param('op') || 'list';
-my $id             = $cgi->param('id');
-my $category       = $cgi->param('category') || 'news';
+my $op       = $cgi->param('op') || 'list';
+my $id       = $cgi->param('id');
+my $category = $cgi->param('category') || 'news';
 my $wysiwyg;
-my $redirect       = $cgi->param('redirect');
+my $redirect = $cgi->param('redirect');
 my $editmode;
 
-if( $cgi->param('editmode') ){
+if ( $cgi->param('editmode') ) {
     $wysiwyg = $cgi->param('editmode') eq "wysiwyg" ? 1 : 0;
 } else {
     $wysiwyg = C4::Context->preference("AdditionalContentsEditor") eq "tinymce" ? 1 : 0;
@@ -55,14 +55,19 @@ $editmode = $wysiwyg eq 1 ? "wysiwyg" : "text";
 
 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
     {
-        template_name   => "tools/additional-contents.tt",
-        query           => $cgi,
-        type            => "intranet",
-        flagsrequired   => { tools => 'edit_additional_contents' },
+        template_name => "tools/additional-contents.tt",
+        query         => $cgi,
+        type          => "intranet",
+        flagsrequired => { tools => 'edit_additional_contents' },
     }
 );
 
 my @messages;
+my $my_branch =
+    C4::Context->preference("IndependentBranches")
+    && !C4::Context->IsSuperLibrarian()
+    ? C4::Context->userenv()->{'branch'}
+    : undef;
 if ( $op eq 'add_form' ) {
 
     my $additional_content = Koha::AdditionalContents->find($id);
@@ -72,21 +77,22 @@ if ( $op eq 'add_form' ) {
         $category            = $additional_content->category;
     }
     $template->param(
-        additional_content => $additional_content,
+        my_branch           => $my_branch,
+        additional_content  => $additional_content,
         translated_contents => $translated_contents,
     );
-}
-elsif ( $op eq 'cud-add_validate' ) {
+} elsif ( $op eq 'cud-add_validate' ) {
     output_and_exit_if_error( $cgi, $cookie, $template, { check => 'csrf_token' } );
     my $location   = $cgi->param('location');
     my $code       = $cgi->param('code');
-    my $branchcode = $cgi->param('branchcode') || undef;
+    my $branchcode = $my_branch ? $my_branch : $cgi->param('branchcode') || undef;
+    my $idnew      = $cgi->param('idnew');
 
-    my @lang       = $cgi->multi_param('lang');
+    my @lang = $cgi->multi_param('lang');
 
     my $expirationdate = $cgi->param('expirationdate');
-    my $published_on = $cgi->param('published_on');
-    my $number = $cgi->param('number');
+    my $published_on   = $cgi->param('published_on');
+    my $number         = $cgi->param('number');
 
     try {
         Koha::Database->new->schema->txn_do(
@@ -181,28 +187,33 @@ elsif ( $op eq 'cud-add_validate' ) {
         }
     };
 
-    if( $redirect eq "just_save" ){
-        print $cgi->redirect("/cgi-bin/koha/tools/additional-contents.pl?op=add_form&id=$id&category=$category&editmode=$editmode&redirect=done");
+    if ( $redirect eq "just_save" ) {
+        print $cgi->redirect(
+            "/cgi-bin/koha/tools/additional-contents.pl?op=add_form&id=$id&category=$category&editmode=$editmode&redirect=done"
+        );
         exit;
     } else {
         $op = 'list';
     }
-}
-elsif ( $op eq 'cud-delete_confirmed' ) {
-    output_and_exit_if_error($cgi, $cookie, $template, { check => 'csrf_token' });
+} elsif ( $op eq 'cud-delete_confirmed' ) {
+    output_and_exit_if_error( $cgi, $cookie, $template, { check => 'csrf_token' } );
     my @ids = $cgi->multi_param('ids');
 
     try {
         Koha::Database->new->schema->txn_do(
             sub {
-                my $contents =
-                  Koha::AdditionalContents->search( { id => \@ids } );
+                my $contents = Koha::AdditionalContents->search( { id => \@ids } );
 
                 if ( C4::Context->preference("NewsLog") ) {
                     while ( my $c = $contents->next ) {
                         my $translated_contents = $c->translated_contents;
                         while ( my $translated_content = $translated_contents->next ) {
-                            logaction('NEWS', 'DELETE' , undef, sprintf("%s|%s|%s|%s", $c->code, $translated_content->lang, $translated_content->content));
+                            logaction(
+                                'NEWS', 'DELETE', undef,
+                                sprintf(
+                                    "%s|%s|%s|%s", $c->code, $translated_content->lang, $translated_content->content
+                                )
+                            );
                         }
                     }
                 }
@@ -220,10 +231,10 @@ elsif ( $op eq 'cud-delete_confirmed' ) {
 
 if ( $op eq 'list' ) {
     my $additional_contents = Koha::AdditionalContents->search(
-        { category => $category, 'additional_contents_localizations.lang' => 'default' },
+        { category => $category,                   'additional_contents_localizations.lang' => 'default' },
         { order_by => { -desc => 'published_on' }, join => 'additional_contents_localizations' }
     );
-    $template->param( additional_contents => $additional_contents );
+    $template->param( additional_contents => $additional_contents, my_branch => $my_branch );
 }
 
 my $translated_languages = C4::Languages::getTranslatedLanguages;
@@ -232,24 +243,22 @@ for my $language (@$translated_languages) {
     for my $sublanguage ( @{ $language->{sublanguages_loop} } ) {
         if ( $language->{plural} ) {
             push @languages,
-              {
+                {
                 lang        => $sublanguage->{rfc4646_subtag},
                 description => $sublanguage->{native_description} . ' '
-                  . $sublanguage->{region_description} . ' ('
-                  . $sublanguage->{rfc4646_subtag} . ')',
-              };
-        }
-        else {
+                    . $sublanguage->{region_description} . ' ('
+                    . $sublanguage->{rfc4646_subtag} . ')',
+                };
+        } else {
             push @languages,
-              {
+                {
                 lang        => $sublanguage->{rfc4646_subtag},
-                description => $sublanguage->{native_description} . ' ('
-                  . $sublanguage->{rfc4646_subtag} . ')',
-              };
+                description => $sublanguage->{native_description} . ' (' . $sublanguage->{rfc4646_subtag} . ')',
+                };
         }
     }
 }
-unshift @languages, {lang => 'default'} if @languages;
+unshift @languages, { lang => 'default' } if @languages;
 
 $template->param(
     op        => $op,
-- 
2.30.2