View | Details | Raw Unified | Return to bug 7295
Collapse All | Expand All

(-)a/C4/Acquisition.pm (-5 / +18 lines)
Lines 689-701 C4::Acquisition::GetBasket. Link Here
689
The third parameter is optional. If given, it should be a hashref as returned
689
The third parameter is optional. If given, it should be a hashref as returned
690
by C4::Auth::getuserflags. If not, getuserflags is called.
690
by C4::Auth::getuserflags. If not, getuserflags is called.
691
691
692
Fourth parameter is a hash of options.
693
Avaiable options are:
694
695
=over 2
696
697
=item * B<assume_in_user_list>:
698
Assume the borrower is in the basket's users list. So don't check this. This
699
is useful to check if a borrower can be added to the users list.
700
701
=back
702
692
If user is authorised to manage basket, returns 1.
703
If user is authorised to manage basket, returns 1.
693
Otherwise returns 0.
704
Otherwise returns 0.
694
705
695
=cut
706
=cut
696
707
697
sub CanUserManageBasket {
708
sub CanUserManageBasket {
698
    my ($borrower, $basket, $userflags) = @_;
709
    my ($borrower, $basket, $userflags, %options) = @_;
699
710
700
    if (!ref $borrower) {
711
    if (!ref $borrower) {
701
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);
712
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);
Lines 734-743 sub CanUserManageBasket { Link Here
734
            return 0;
745
            return 0;
735
        }
746
        }
736
747
737
        if ($AcqViewBaskets eq 'user'
748
        unless ($options{assume_in_user_list}) {
738
        && $basket->{authorisedby} != $borrowernumber
749
            if ($AcqViewBaskets eq 'user'
739
        && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
750
            && $basket->{authorisedby} != $borrowernumber
740
            return 0;
751
            && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
752
                return 0;
753
            }
741
        }
754
        }
742
755
743
        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
756
        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
(-)a/acqui/aqbasketuser_search.pl (-14 / +16 lines)
Lines 25-30 use CGI; Link Here
25
use C4::Auth;
25
use C4::Auth;
26
use C4::Output;
26
use C4::Output;
27
use C4::Members;
27
use C4::Members;
28
use C4::Acquisition;
28
29
29
my $input = new CGI;
30
my $input = new CGI;
30
31
Lines 41-69 my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user( Link Here
41
42
42
my $q = $input->param('q') || '';
43
my $q = $input->param('q') || '';
43
my $op = $input->param('op') || '';
44
my $op = $input->param('op') || '';
45
my $basketno = $input->param('basketno');
46
my $basket = C4::Acquisition::GetBasket($basketno);
44
47
45
if( $op eq "do_search" ) {
48
if( $op eq "do_search" ) {
46
    my $results = C4::Members::Search( $q, "surname");
49
    my $results = C4::Members::Search( $q, "surname");
47
50
48
    my @users_loop;
51
    my @users_loop;
49
    my $nresults = 0;
52
    my $nresults = 0;
50
    foreach my $res (@$results) {
53
    foreach my $borrower (@$results) {
51
        my $perms = haspermission( $res->{userid} );
54
        if (C4::Acquisition::CanUserManageBasket(
52
        my $subperms = get_user_subpermissions( $res->{userid} );
55
                $borrower, $basket, undef, assume_in_user_list => 1))
53
56
        {
54
        if( $perms->{superlibrarian} == 1
55
         || $perms->{acquisition} == 1
56
         || $subperms->{acquisition}->{'order_manage'} ) {
57
            my %row = (
57
            my %row = (
58
                borrowernumber  => $res->{borrowernumber},
58
                borrowernumber => $borrower->{borrowernumber},
59
                cardnumber      => $res->{cardnumber},
59
                cardnumber     => $borrower->{cardnumber},
60
                surname         => $res->{surname},
60
                surname        => $borrower->{surname},
61
                firstname       => $res->{firstname},
61
                firstname      => $borrower->{firstname},
62
                categorycode    => $res->{categorycode},
62
                categorycode   => $borrower->{categorycode},
63
                branchcode      => $res->{branchcode},
63
                branchcode     => $borrower->{branchcode},
64
            );
64
            );
65
            push( @users_loop, \%row );
65
            push( @users_loop, \%row );
66
            $nresults ++;
66
            $nresults++;
67
        }
67
        }
68
    }
68
    }
69
69
Lines 74-77 if( $op eq "do_search" ) { Link Here
74
    );
74
    );
75
}
75
}
76
76
77
$template->param(basketno => $basketno);
78
77
output_html_with_http_headers( $input, $cookie, $template->output );
79
output_html_with_http_headers( $input, $cookie, $template->output );
(-)a/installer/data/mysql/updatedatabase.pl (+5 lines)
Lines 6783-6788 if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) { Link Here
6783
            ON UPDATE CASCADE ON DELETE SET NULL
6783
            ON UPDATE CASCADE ON DELETE SET NULL
6784
    ");
6784
    ");
6785
    $dbh->do("
6785
    $dbh->do("
6786
        UPDATE aqbasket, borrowers
6787
        SET aqbasket.branch = borrowers.branchcode
6788
        WHERE aqbasket.authorisedby = borrowers.borrowernumber
6789
    ");
6790
    $dbh->do("
6786
        DROP TABLE IF EXISTS aqbasketusers
6791
        DROP TABLE IF EXISTS aqbasketusers
6787
    ");
6792
    ");
6788
    $dbh->do("
6793
    $dbh->do("
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/aqbasketuser_search.tt (-1 / +3 lines)
Lines 34-43 Link Here
34
      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
34
      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
35
        <fieldset>
35
        <fieldset>
36
          <input type="hidden" name="op" id="op" value="do_search" />
36
          <input type="hidden" name="op" id="op" value="do_search" />
37
          <input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
37
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
38
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
38
          <input type="submit" class="button" value="Search" />
39
          <input type="submit" class="button" value="Search" />
39
        </fieldset>
40
        </fieldset>
40
        <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
41
        <p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
42
        <p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
41
      </form>
43
      </form>
42
44
43
[% IF (q) %]
45
[% IF (q) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-2 / +1 lines)
Lines 117-123 Link Here
117
117
118
    function basketUserSearchPopup(f) {
118
    function basketUserSearchPopup(f) {
119
        window.open(
119
        window.open(
120
            "/cgi-bin/koha/acqui/aqbasketuser_search.pl",
120
            "/cgi-bin/koha/acqui/aqbasketuser_search.pl?basketno=[% basketno %]",
121
            'BasketUserSearchPopup',
121
            'BasketUserSearchPopup',
122
            'width=740,height=450,toolbar=no,'
122
            'width=740,height=450,toolbar=no,'
123
         );
123
         );
124
- 

Return to bug 7295