From cce39e9d555003da4e2b187227a7d208e102d13a Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 26 Mar 2025 01:26:04 +0000 Subject: [PATCH] Bug 38040: [alternate] Restrict hold management if cannot see patron data This patch leverages the Koha::Patron->can_see_patron_infos() function to determine whether or not the UI will display hold management functions. If the logged in user cannot see the patron info, it seems to follow that they should not be able to manage the hold either. NOTE: This should work for both IndependentBranches and Library Group functionality. This is only the front-end modification. To be coded: a back-end modification that throws a 403 for stateful actions to holds the logged in user is not allowed to manage. --- .../prog/en/includes/holds_table.inc | 522 +++++++++--------- reserve/request.pl | 5 + 2 files changed, 275 insertions(+), 252 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc index 2d65e83dc1..1db42d0124 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc @@ -49,249 +49,263 @@ [%- END -%] [% SET tr_class = hold.suspend ? 'suspend' : '' %] - + [% IF ( hold.can_be_managed ) %][% END %] - - - - [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %] - [% IF Koha.Preference('HoldsSplitQueue') == "nothing" && !hold.found %] - + + + [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %] + [% IF Koha.Preference('HoldsSplitQueue') == "nothing" && !hold.found %] + - [% ELSE %] - - + [% ELSE %] + + + + [% END %] + [% ELSE %] + + [% hold.priority | html %] [% END %] - [% ELSE %] - - [% hold.priority | html %] [% END %] [%- IF ( CAN_user_reserveforothers_modify_holds_priority ) -%] - [%- UNLESS hold.found -%] - [%- SET prev_priority = loop.prev.priority -%] - [%- SET next_priority = loop.next.priority -%] - - - - + [% IF ( hold.can_be_managed ) %] + [%- UNLESS hold.found -%] + [%- SET prev_priority = loop.prev.priority -%] + [%- SET next_priority = loop.next.priority -%] + + + + - - - + + + - - - + + + - - - - + + + + + [% END %] [%- ELSE -%] [%- END -%] [%- END -%] [% INCLUDE 'patron-title.inc' patron=hold.patron hide_patron_infos_if_needed=1 %] - [% hold.notes | html | html_line_break %] + [% IF ( hold.can_be_managed ) %][% hold.notes | html | html_line_break %][% END %] - [% IF Koha.Preference('AllowHoldDateInFuture') %] - - [% ELSE %] - [% hold.date | $KohaDates %] + [% IF ( hold.can_be_managed ) %] + [% IF Koha.Preference('AllowHoldDateInFuture') %] + + [% ELSE %] + [% hold.date | $KohaDates %] + [% END %] [% END %] - + [% IF ( hold.can_be_managed ) %] + + [% END %] - [%- IF ( hold.found ) -%] - - [%- IF ( hold.atdestination ) -%] - Item waiting at [% hold.wbrname | html %][% IF hold.desk_name %], [% hold.desk_name | html %],[% END %] since [% hold.waiting_date | $KohaDates %] - [%- ELSIF (hold.intransit) -%] - Item being transferred to [% hold.wbrname | html %] - [%- ELSIF (hold.inprocessing) -%] - Item being processed at [% hold.wbrname | html %] - [%- ELSE -%] - Hold expected at [% hold.wbrname | html %], please checkin to verify status - [%- END -%] - [%- ELSE -%] - [%- IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 -%] - [% Branches.GetName(hold.branchcode) | html %] + [% IF ( hold.can_be_managed ) %] + [%- IF ( hold.found ) -%] + + [%- IF ( hold.atdestination ) -%] + Item waiting at [% hold.wbrname | html %][% IF hold.desk_name %], [% hold.desk_name | html %],[% END %] since [% hold.waiting_date | $KohaDates %] + [%- ELSIF (hold.intransit) -%] + Item being transferred to [% hold.wbrname | html %] + [%- ELSIF (hold.inprocessing) -%] + Item being processed at [% hold.wbrname | html %] + [%- ELSE -%] + Hold expected at [% hold.wbrname | html %], please checkin to verify status + [%- END -%] [%- ELSE -%] - - + [%- IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 -%] + [% Branches.GetName(hold.branchcode) | html %] + [%- ELSE -%] + + + [%- END -%] [%- END -%] - [%- END -%] + [% END %] - [%- IF ( hold.found ) -%] - - [%- IF ( hold.barcodenumber ) -%] - [%- hold.barcodenumber | html -%] - [%- ELSE -%] - No barcode - [%- END -%] - - - [%- ELSE -%] - [%- IF ( hold.item_level_hold ) -%] - - [%- IF ! hold.change_hold_type_allowed -%] - Only item - - [%- IF ( hold.barcodenumber ) -%] - [%- hold.barcodenumber | html -%] - [%- ELSE -%] - No barcode - [%- END -%] - - + [% IF ( hold.can_be_managed ) %] + [%- IF ( hold.found ) -%] + + [%- IF ( hold.barcodenumber ) -%] + [%- hold.barcodenumber | html -%] [%- ELSE -%] - + + [%- ELSE -%] + [%- IF ( hold.item_level_hold ) -%] + + [%- IF ! hold.change_hold_type_allowed -%] + Only item + [%- IF ( hold.barcodenumber ) -%] [%- hold.barcodenumber | html -%] [%- ELSE -%] - No barcode + No barcode [%- END -%] - - - - [%- IF ( hold.itemnumber ) -%] - - [%- END -%] - [%- IF hold.itemtype -%] - Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + + [%- ELSE -%] - Next available + + [%- IF ( hold.itemnumber ) -%] + + [%- END -%] + [%- IF hold.itemtype -%] + Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + [%- ELSE -%] + Next available + [%- END -%] [%- END -%] - [%- END -%] - - [%- ELSE -%] - [%- IF hold.itemtype -%] - Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item - [%- ELSIF hold.object.item_group -%] - Next available item from group [% hold.object.item_group.description | html %] + [%- ELSE -%] - Next available - [%- END -%] + [%- IF hold.itemtype -%] + Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + [%- ELSIF hold.object.item_group -%] + Next available item from group [% hold.object.item_group.description | html %] + [%- ELSE -%] + Next available + [%- END -%] - + + [%- END -%] [%- END -%] - [%- END -%] - [%- IF hold.non_priority -%] -
Non priority hold - [%- END -%] + [%- IF hold.non_priority -%] +
Non priority hold + [%- END -%] + [% END %] [%- IF ( CAN_user_reserveforothers_modify_holds_priority ) -%] [%- UNLESS hold.found -%] - [% IF ( hold.lowestPriority ) %] - - - - [% ELSE %] - - - + [% IF ( hold.can_be_managed ) %] + [% IF ( hold.lowestPriority ) %] + + + + [% ELSE %] + + + + [% END %] [% END %] [%- ELSE -%] @@ -299,63 +313,67 @@ [%- END -%] [%- END -%] - - - + [% IF ( hold.can_be_managed ) %] + + + + [% END %] - [% IF Koha.Preference('SuspendHoldsIntranet') %] - [% UNLESS ( hold.found ) %] - [% IF ( hold.suspend ) %] - - [% ELSE %] - - [% END %] + [% IF ( hold.can_be_managed ) %] + [% IF Koha.Preference('SuspendHoldsIntranet') %] + [% UNLESS ( hold.found ) %] + [% IF ( hold.suspend ) %] + + [% ELSE %] + + [% END %] - [% IF Koha.Preference('AutoResumeSuspendedHolds') %] - - - [%- ELSE -%] - + [% IF Koha.Preference('AutoResumeSuspendedHolds') %] + + + [%- ELSE -%] + + [%- END -%] [%- END -%] + [%- END # IF SuspendHoldsIntranet -%] + [%- IF ( hold.found ) -%] + [% IF hold.intransit %]Revert transit status[% ELSE %]Revert waiting status[% END %] [%- END -%] - [%- END # IF SuspendHoldsIntranet -%] - [%- IF ( hold.found ) -%] - [% IF hold.intransit %]Revert transit status[% ELSE %]Revert waiting status[% END %] - [%- END -%] + [% END %] [% IF ( hold.intransit || hold.atdestination ) %] - + [% IF ( hold.can_be_managed ) %][% END %] [% ELSE %] [% END %] diff --git a/reserve/request.pl b/reserve/request.pl index c5e354aa7d..88846bc27c 100755 --- a/reserve/request.pl +++ b/reserve/request.pl @@ -671,6 +671,11 @@ if ( ( $findborrower && $borrowernumber_hold || $findclub && $club_hold ) $reserve{'change_hold_type_allowed'} = 1; } + my $can_manage_hold = $logged_in_patron->can_see_patron_infos( $res->borrower ); + if ($can_manage_hold) { + $reserve{'can_be_managed'} = 1; + } + push( @reserveloop, \%reserve ); } } -- 2.39.5