From 36a85e804763b0a9494a97808bce2cde9f9bcee4 Mon Sep 17 00:00:00 2001 From: Sukhmandeep Benipal Date: Fri, 25 Oct 2024 12:30:51 -0400 Subject: [PATCH] Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. Signed-off-by: David Nind --- .../prog/en/modules/reserve/request.tt | 22 +++++++++++++++++++ reserve/request.pl | 17 ++++++++++---- 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt index 437f32c189..b15d0075e5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt @@ -102,6 +102,12 @@ :disabled{ opacity:0.5 } + + .disabled_trash{ + pointer-events: none; + cursor: not-allowed ; + color: #777; + } [% END %] @@ -1860,6 +1866,22 @@ return false; }); + [% IF (!is_super_librarian) %] + var user_branch = "[% user_branch %]"; + if(user_branch !== undefined && user_branch !== ""){ + $('#patron_holds_table tbody tr').each(function() { + var link = $(this).find('a[href*="member"]'); + var rankRequest = $(this).find("select[name='rank-request']"); + if (!link.length){ + $(this).find('.cancel-hold, .fa-trash').addClass('disabled_trash'); + } + $(this).find('.select_hold, .rank-request, td a[data-op="cud-move"], .flatpickr, .toggle-suspend, .clear_date, [name*="change_hold_type_"]').addClass('disabled').attr('disabled', 'disabled'); + $('.select_hold_all, .hold-arrow').addClass('disabled').attr('disabled', 'disabled'); + $('.suspend-hold').prop('disabled', true); + }); + } + [% END %] + [% UNLESS ( patron || patron.borrowernumber || borrowers || noitems || nobiblio ) %] [% IF ( PatronAutoComplete ) %] patron_autocomplete($(".search_patron_filter"), { 'link-to': 'reserve', 'url-params': '[% url_biblio_params | url %]' }); diff --git a/reserve/request.pl b/reserve/request.pl index b9a3182d7c..d06b6a5aba 100755 --- a/reserve/request.pl +++ b/reserve/request.pl @@ -40,6 +40,7 @@ use C4::Serials qw( CountSubscriptionFromBiblionumber ); use C4::Circulation qw( _GetCircControlBranch GetBranchItemRule ); use Koha::DateUtils qw( dt_from_string ); use C4::Search qw( enabled_staff_search_views ); +use C4::Context; use Koha::Biblios; use Koha::Checkouts; @@ -64,6 +65,14 @@ my ( $template, $borrowernumber, $cookie, $flags ) = get_template_and_user( } ); +my $is_super_librarian = C4::Context->IsSuperLibrarian(); +my $user_branch = C4::Context->preference("IndependentBranches") ? C4::Context->userenv->{'branch'}: undef; + +$template->param( + is_super_librarian => $is_super_librarian, + user_branch => $user_branch, +); + my $showallitems = $input->param('showallitems'); my $pickup = $input->param('pickup'); @@ -112,10 +121,10 @@ if ( $op eq 'cud-move' ) { } } elsif ( $op eq 'cud-cancel' ) { - my $reserve_id = $input->param('reserve_id'); - my $cancellation_reason = $input->param("cancellation-reason"); - my $hold = Koha::Holds->find($reserve_id); - $hold->cancel( { cancellation_reason => $cancellation_reason } ) if $hold; + my $reserve_id = $input->param('reserve_id'); + my $cancellation_reason = $input->param("cancellation-reason"); + my $hold = Koha::Holds->find($reserve_id); + $hold->cancel( { cancellation_reason => $cancellation_reason } ) if $hold; } elsif ( $op eq 'cud-setLowestPriority' ) { my $reserve_id = $input->param('reserve_id'); -- 2.39.5