From a6ddfd22a32a667b01693f62ba2acdf2c549b76b Mon Sep 17 00:00:00 2001 From: Hammat Wele Date: Mon, 28 Aug 2023 17:21:44 +0000 Subject: [PATCH] Bug 34631: Independentbranches - Non-superuser should not be able to write Additional contents for other branches When syspref Independentbranches is enabled Non-superuser should not be able to write Additional contents for other branches To reproduce: 1- Connect to staff interface as superlibrarian 2- Enable IndependentBranches preference 3- Go to Tools -> HTML customizations 4- Crete an additional content for all libraries 5- Create or edit a borrower 5-1- Set permission for the borrower - catalogue - edit_additional_contents 4- Log in to the staff interface with the non-superlibrarian staff user 5- Go to Tools -> HTML customizations --> you can delete or edit the additional contents created by superlibrarian for All libraries 6- Click on New entry --> you can add additional content for other branches 7- Apply the patch 8- Repeat step 5 --> you cannot delete or edit the additional contents create by superlibrarian for All libraries 9- Repeat step 6 --> you cannot add additional content for other branches 10- submit the form --> the branch of the created additional content is the current user branch Signed-off-by: Myka Kennedy Stephens Signed-off-by: David Nind --- .../en/modules/tools/additional-contents.tt | 6 ++++++ tools/additional-contents.pl | 18 ++++++++++++------ 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt index a5884db4bb6..4198ba19710 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt @@ -234,6 +234,7 @@ [% INCLUDE 'html-customization-help.inc' %] + [% UNLESS my_branch %]
  • + [% END %] [% UNLESS languages.size %]
  • [% IF category == 'news' %] @@ -400,7 +402,9 @@ [% SET default_localization = c.default_localization %] + [% UNLESS ( my_branch && my_branch != c.branchcode ) %] + [% END %] [% IF c.category == 'news' || c.category == 'pages' %] @@ -464,6 +468,7 @@ + [% UNLESS ( my_branch && my_branch != c.branchcode ) %]
    Edit @@ -482,6 +487,7 @@ + [% END %] [% END %] diff --git a/tools/additional-contents.pl b/tools/additional-contents.pl index 3ff53031a34..222b0c6af17 100755 --- a/tools/additional-contents.pl +++ b/tools/additional-contents.pl @@ -26,12 +26,12 @@ use Modern::Perl; use CGI qw ( -utf8 ); use Try::Tiny; use Array::Utils qw( array_minus ); -use C4::Auth qw(get_template_and_user); +use C4::Auth qw(get_template_and_user); use C4::Koha; use C4::Context; -use C4::Log qw( logaction ); -use C4::Output qw(output_html_with_http_headers output_and_exit_if_error); -use C4::Languages qw(getTranslatedLanguages); +use C4::Log qw( logaction ); +use C4::Output qw(output_html_with_http_headers output_and_exit_if_error); +use C4::Languages qw(getTranslatedLanguages); use Koha::DateUtils qw( dt_from_string output_pref ); use Koha::AdditionalContents; @@ -63,6 +63,11 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( ); my @messages; +my $my_branch = + C4::Context->preference("IndependentBranches") + && !C4::Context->IsSuperLibrarian() + ? C4::Context->userenv()->{'branch'} + : undef; if ( $op eq 'add_form' ) { my $additional_content = Koha::AdditionalContents->find($id); @@ -72,6 +77,7 @@ if ( $op eq 'add_form' ) { $category = $additional_content->category; } $template->param( + my_branch => $my_branch, additional_content => $additional_content, translated_contents => $translated_contents, opac_available_options => Koha::AdditionalContents::get_html_customizations_options('opac'), @@ -81,7 +87,7 @@ if ( $op eq 'add_form' ) { output_and_exit_if_error( $cgi, $cookie, $template, { check => 'csrf_token' } ); my $location = $cgi->param('location'); my $code = $cgi->param('code'); - my $branchcode = $cgi->param('branchcode') || undef; + my $branchcode = $my_branch ? $my_branch : $cgi->param('branchcode') || undef; my @lang = $cgi->multi_param('lang'); @@ -229,7 +235,7 @@ if ( $op eq 'list' ) { { category => $category, 'additional_contents_localizations.lang' => 'default' }, { order_by => { -desc => 'published_on' }, join => 'additional_contents_localizations' } ); - $template->param( additional_contents => $additional_contents ); + $template->param( additional_contents => $additional_contents, my_branch => $my_branch ); } my $translated_languages = C4::Languages::getTranslatedLanguages(); -- 2.34.1