From 6795a5179154d82128876c6dcd7ba848db28e200 Mon Sep 17 00:00:00 2001 From: Baptiste Wojtkowski Date: Mon, 30 Dec 2024 12:29:17 +0100 Subject: [PATCH] Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore --- serials/serials-collection.pl | 1 + serials/subscription-detail.pl | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/serials/serials-collection.pl b/serials/serials-collection.pl index cd662a58..1464556b 100755 --- a/serials/serials-collection.pl +++ b/serials/serials-collection.pl @@ -206,6 +206,7 @@ $template->param( routing => C4::Context->preference("RoutingSerials"), subscr=>scalar $query->param('subscriptionid'), subscriptioncount => $subscriptioncount, + cannotedit => (not C4::Serials::can_edit_subscription( $subscriptionid )), location => $location, callnumber => $callnumber, uc(C4::Context->preference("marcflavour")) => 1, diff --git a/serials/subscription-detail.pl b/serials/subscription-detail.pl index 8140feb8..bca4fc49 100755 --- a/serials/subscription-detail.pl +++ b/serials/subscription-detail.pl @@ -43,7 +43,14 @@ my $subscriptionid = $query->param('subscriptionid'); # Permission needed if it is a deletion (del) : delete_subscription # Permission needed otherwise : * -my $permission = ($op eq "cud-del") ? "delete_subscription" : "*"; + +my %permissions = ( + "cud-del" => "delete_subscription", + "cud-close" => "edit_subscription", + "reopen" => "edit_subscription", +); + +my $permission = $permissions{$op} // "*"; my ($template, $loggedinuser, $cookie) = get_template_and_user({template_name => "serials/subscription-detail.tt", -- 2.30.2