From 5ca368519fb7aaa858ee922a3360cc6bfac6c197 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 26 Mar 2025 01:26:04 +0000 Subject: [PATCH] Bug 38040: [alternate] Restrict hold management if cannot see patron data This patch leverages the Koha::Patron->can_see_patron_infos() function to determine whether or not the UI will display hold management functions. If the logged in user cannot see the patron info, it seems to follow that they should not be able to manage the hold either. NOTE: This should work for both IndependentBranches and Library Group functionality. This is only the front-end modification. To be coded: a back-end modification that throws a 403 for stateful actions to holds the logged in user is not allowed to manage. Signed-off-by: Magnus Enger --- .../prog/en/includes/holds_table.inc | 521 +++++++++--------- reserve/request.pl | 5 + 2 files changed, 275 insertions(+), 251 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc index 732677977f..ae5f0a5ad9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc @@ -49,248 +49,263 @@ [%- END -%] [% SET tr_class = hold.suspend ? 'suspend' : '' %] - + [% IF ( hold.can_be_managed ) %][% END %] - - - - [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %] - [% IF Koha.Preference('HoldsSplitQueue') == "nothing" && !hold.found %] - + + + [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %] + [% IF Koha.Preference('HoldsSplitQueue') == "nothing" && !hold.found %] + - [% ELSE %] - - + [% ELSE %] + + + + [% END %] + [% ELSE %] + + [% hold.priority | html %] [% END %] - [% ELSE %] - - [% hold.priority | html %] [% END %] [%- IF ( CAN_user_reserveforothers_modify_holds_priority ) -%] - [%- UNLESS hold.found -%] - [%- SET prev_priority = loop.prev.priority -%] - [%- SET next_priority = loop.next.priority -%] - - - - + [% IF ( hold.can_be_managed ) %] + [%- UNLESS hold.found -%] + [%- SET prev_priority = loop.prev.priority -%] + [%- SET next_priority = loop.next.priority -%] + + + + - - - + + + - - - + + + - - - - + + + + + [% END %] [%- ELSE -%] [%- END -%] [%- END -%] [% INCLUDE 'patron-title.inc' patron=hold.patron hide_patron_infos_if_needed=1 %] - [% hold.notes | html | html_line_break %] + [% IF ( hold.can_be_managed ) %][% hold.notes | html | html_line_break %][% END %] - [% IF Koha.Preference('AllowHoldDateInFuture') %] - - [% ELSE %] - [% hold.date | $KohaDates %] + [% IF ( hold.can_be_managed ) %] + [% IF Koha.Preference('AllowHoldDateInFuture') %] + + [% ELSE %] + [% hold.date | $KohaDates %] + [% END %] [% END %] - + [% IF ( hold.can_be_managed ) %] + + [% END %] - [%- IF ( hold.found ) -%] - - [%- IF ( hold.atdestination ) -%] - Item waiting at [% hold.wbrname | html %][% IF hold.desk_name %], [% hold.desk_name | html %],[% END %] since [% hold.waiting_date | $KohaDates %] - [%- ELSIF (hold.intransit) -%] - Item being transferred to [% hold.wbrname | html %] - [%- ELSIF (hold.inprocessing) -%] - Item being processed at [% hold.wbrname | html %] - [%- ELSE -%] - Hold expected at [% hold.wbrname | html %], please checkin to verify status - [%- END -%] - [%- ELSE -%] - [%- IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 -%] - [% Branches.GetName(hold.branchcode) | html %] + [% IF ( hold.can_be_managed ) %] + [%- IF ( hold.found ) -%] + + [%- IF ( hold.atdestination ) -%] + Item waiting at [% hold.wbrname | html %][% IF hold.desk_name %], [% hold.desk_name | html %],[% END %] since [% hold.waiting_date | $KohaDates %] + [%- ELSIF (hold.intransit) -%] + Item being transferred to [% hold.wbrname | html %] + [%- ELSIF (hold.inprocessing) -%] + Item being processed at [% hold.wbrname | html %] + [%- ELSE -%] + Hold expected at [% hold.wbrname | html %], please checkin to verify status + [%- END -%] [%- ELSE -%] - - + [%- IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 -%] + [% Branches.GetName(hold.branchcode) | html %] + [%- ELSE -%] + + + [%- END -%] [%- END -%] - [%- END -%] + [% END %] - [%- IF ( hold.found ) -%] - - [%- IF ( hold.barcodenumber ) -%] - [%- hold.barcodenumber | html -%] - [%- ELSE -%] - No barcode - [%- END -%] - - - [%- ELSE -%] - [%- IF ( hold.item_level_hold ) -%] - - [%- IF ! hold.change_hold_type_allowed -%] - Only item - - [%- IF ( hold.barcodenumber ) -%] - [%- hold.barcodenumber | html -%] - [%- ELSE -%] - No barcode - [%- END -%] - - + [% IF ( hold.can_be_managed ) %] + [%- IF ( hold.found ) -%] + + [%- IF ( hold.barcodenumber ) -%] + [%- hold.barcodenumber | html -%] [%- ELSE -%] - + + [%- ELSE -%] + [%- IF ( hold.item_level_hold ) -%] + + [%- IF ! hold.change_hold_type_allowed -%] + Only item + [%- IF ( hold.barcodenumber ) -%] [% tx("Only item {barcode}", {barcode = hold.barcodenumber}) | html %] [%- ELSE -%] - [% t("Only item [No barcode]") | html %] + No barcode [%- END -%] - - - - [%- IF ( hold.itemnumber ) -%] - - [%- END -%] - [%- IF hold.itemtype -%] - Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + + [%- ELSE -%] - Next available + + [%- IF ( hold.itemnumber ) -%] + + [%- END -%] + [%- IF hold.itemtype -%] + Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + [%- ELSE -%] + Next available + [%- END -%] [%- END -%] - [%- END -%] - - [%- ELSE -%] - [%- IF hold.itemtype -%] - Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item - [%- ELSIF hold.object.item_group -%] - Next available item from group [% hold.object.item_group.description | html %] + [%- ELSE -%] - Next available - [%- END -%] + [%- IF hold.itemtype -%] + Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item + [%- ELSIF hold.object.item_group -%] + Next available item from group [% hold.object.item_group.description | html %] + [%- ELSE -%] + Next available + [%- END -%] - + + [%- END -%] [%- END -%] - [%- END -%] - [%- IF hold.non_priority -%] -
Non priority hold - [%- END -%] + [%- IF hold.non_priority -%] +
Non priority hold + [%- END -%] + [% END %] [%- IF ( CAN_user_reserveforothers_modify_holds_priority ) -%] [%- UNLESS hold.found -%] - [% IF ( hold.lowestPriority ) %] - - - - [% ELSE %] - - - + [% IF ( hold.can_be_managed ) %] + [% IF ( hold.lowestPriority ) %] + + + + [% ELSE %] + + + + [% END %] [% END %] [%- ELSE -%] @@ -298,63 +313,67 @@ [%- END -%] [%- END -%] - - - + [% IF ( hold.can_be_managed ) %] + + + + [% END %] - [% IF Koha.Preference('SuspendHoldsIntranet') %] - [% UNLESS ( hold.found ) %] - [% IF ( hold.suspend ) %] - - [% ELSE %] - - [% END %] + [% IF ( hold.can_be_managed ) %] + [% IF Koha.Preference('SuspendHoldsIntranet') %] + [% UNLESS ( hold.found ) %] + [% IF ( hold.suspend ) %] + + [% ELSE %] + + [% END %] - [% IF Koha.Preference('AutoResumeSuspendedHolds') %] - - - [%- ELSE -%] - + [% IF Koha.Preference('AutoResumeSuspendedHolds') %] + + + [%- ELSE -%] + + [%- END -%] [%- END -%] + [%- END # IF SuspendHoldsIntranet -%] + [%- IF ( hold.found ) -%] + [% IF hold.intransit %]Revert transit status[% ELSE %]Revert waiting status[% END %] [%- END -%] - [%- END # IF SuspendHoldsIntranet -%] - [%- IF ( hold.found ) -%] - [% IF hold.intransit %]Revert transit status[% ELSE %]Revert waiting status[% END %] - [%- END -%] + [% END %] [% IF ( hold.intransit || hold.atdestination ) %] - + [% IF ( hold.can_be_managed ) %][% END %] [% ELSE %] [% END %] diff --git a/reserve/request.pl b/reserve/request.pl index 5908ab692b..2ab8634fbf 100755 --- a/reserve/request.pl +++ b/reserve/request.pl @@ -671,6 +671,11 @@ if ( ( $findborrower && $borrowernumber_hold || $findclub && $club_hold ) $reserve{'change_hold_type_allowed'} = 1; } + my $can_manage_hold = $logged_in_patron->can_see_patron_infos( $res->borrower ); + if ($can_manage_hold) { + $reserve{'can_be_managed'} = 1; + } + push( @reserveloop, \%reserve ); } } -- 2.43.0