From df0733f4e68891916b657362fb3b7a6fd7007fae Mon Sep 17 00:00:00 2001 From: Matthias Meusburger Date: Mon, 18 Mar 2013 16:11:44 +0100 Subject: [PATCH] Bug 9833: Refine shelves permissions. Content-Type: text/plain; charset=utf-8 - This patch adds two new permissions for shelves: - manage_shelves: allows to manage shelves - merge_from_shelves: allows to merge records from shelves Signed-off-by: Pierre Angot --- C4/Auth.pm | 4 ++++ C4/VirtualShelves.pm | 10 ++++++++-- C4/VirtualShelves/Page.pm | 2 ++ cataloguing/merge.pl | 7 ++++++- cataloguing/merge_ajax.pl | 2 +- installer/data/mysql/updatedatabase.pl | 14 ++++++++++++++ .../prog/en/modules/virtualshelves/shelves.tt | 2 +- 7 files changed, 36 insertions(+), 5 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index ca061b5..51e9234 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1137,6 +1137,10 @@ sub check_api_auth { # is deferred so as to not introduce bugs into the # regular authentication code for Koha 3.0. + # FIXME: check_cookie_auth happens to disconnect the + # user when authentication fails. Imho, it should not. + # It should just deny authentication. + # see if we have a valid session cookie already # however, if a userid parameter is present (i.e., from # a form submission, assume that any current cookie diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm index ed489f2..815f774 100644 --- a/C4/VirtualShelves.pm +++ b/C4/VirtualShelves.pm @@ -23,6 +23,7 @@ use warnings; use Carp; use C4::Context; use C4::Debug; +use C4::Members; use constant SHELVES_MASTHEAD_MAX => 10; #number under Lists button in masthead use constant SHELVES_COMBO_MAX => 10; #add to combo in search @@ -431,7 +432,7 @@ ShelfPossibleAction($loggedinuser, $shelfnumber, $action); C<$loggedinuser,$shelfnumber,$action> -$action can be "view", "add", "delete", "manage", "new_public", "new_private". +$action can be "view", "add", "delete", "manage", "new_public", "new_private" or "merge". Note that add/delete here refers to adding/deleting entries from the list. Deleting the list itself falls under manage. new_public and new_private refers to creating a new public or private list. The distinction between deleting your own entries from the list or entries from @@ -489,7 +490,12 @@ sub ShelfPossibleAction { return 1 if $user>0 && ($shelf->{allow_delete_own}==1 || $shelf->{allow_delete_other}==1); } elsif($action eq 'manage') { - return 1 if $user && $shelf->{owner}==$user; + my $borrower = GetMemberDetails($user); + return 1 if ($user && $shelf->{owner}==$user) || C4::Auth::haspermission($borrower->{'userid'}, {'editcatalogue' => 'manage_shelves'}); + } + elsif($action eq 'merge') { + my $borrower = GetMemberDetails($user); + return 1 if C4::Auth::haspermission($borrower->{'userid'}, {'editcatalogue' => 'merge_from_shelves'}); } return 0; } diff --git a/C4/VirtualShelves/Page.pm b/C4/VirtualShelves/Page.pm index f393cb1..297c1af 100644 --- a/C4/VirtualShelves/Page.pm +++ b/C4/VirtualShelves/Page.pm @@ -295,12 +295,14 @@ sub shelfpage { $showadd = 1; my $i = 0; my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' ); + my $mergefromshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'merge' ); $template->param( shelfname => $shelfname, shelfnumber => $shelfnumber, viewshelf => $shelfnumber, sortfield => $sortfield, manageshelf => $manageshelf, + merge_from_shelf => $mergefromshelf, allowremovingitems => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'), allowaddingitem => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'), "category$category" => 1, diff --git a/cataloguing/merge.pl b/cataloguing/merge.pl index 019b468..a433e76 100755 --- a/cataloguing/merge.pl +++ b/cataloguing/merge.pl @@ -43,7 +43,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { editcatalogue => 'edit_catalogue' }, + + # Important: if you plan to change this permission, do not forget + # to change the matching permission in merge_ajax.pl, otherwise + # you'll end up disconnected without knowing why... + flagsrequired => { editcatalogue => 'merge_from_shelves' } + } ); diff --git a/cataloguing/merge_ajax.pl b/cataloguing/merge_ajax.pl index 26f0800..41e250f 100755 --- a/cataloguing/merge_ajax.pl +++ b/cataloguing/merge_ajax.pl @@ -16,7 +16,7 @@ use CGI::Cookie; # need to check cookies before # having CGI parse the POST request my %cookies = fetch CGI::Cookie; -my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' }); +my ( $auth_status, $sessionID ) = check_cookie_auth( $cookies{'CGISESSID'}->value, { editcatalogue => 'merge_from_shelves' } ); if ($auth_status ne "ok") { my $reply = CGI->new(""); print $reply->header(-type => 'text/html'); diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl index fd6bd08..5cdeca7 100755 --- a/installer/data/mysql/updatedatabase.pl +++ b/installer/data/mysql/updatedatabase.pl @@ -6840,6 +6840,20 @@ if ( CheckVersion($DBversion) ) { SetVersion ($DBversion); } +$DBversion = '3.13.00.XXX'; +if ( CheckVersion($DBversion) ) { + $dbh->do(qq{ + INSERT INTO `permissions` (`module_bit`, `code`, `description`) VALUES ( + '9', 'manage_shelves', 'Allows to manage shelves'), ( + '9', 'merge_from_shelves', 'Allows to merge records from shelves' + ); + }); + print "Upgrade to $DBversion done (Adds new permissions for shelves)\n"; + SetVersion($DBversion); +} + + + =head1 FUNCTIONS =head2 TableExists($table) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt index 84fb29e..9533227 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt @@ -283,7 +283,7 @@ function placeHold () { [% IF ( itemsloop ) %] [% IF ( allowremovingitems ) %][% END %] - + [% IF ( merge_from_shelf ) %][% END %] [% END %] -- 1.7.7.6