From a7fa28bc62bc961b595a755077ed5c4fdb48126a Mon Sep 17 00:00:00 2001 From: Emmi Takkinen Date: Wed, 17 Dec 2025 08:13:48 +0200 Subject: [PATCH 1/2] Bug 35953: Do not show Catalogue modal if patron only has permission to delete bibliographic records If patron has only delete_bibliographic_records permission the link to Catalogue modal is still displayed although patron has no permissions to use functions or tools to edit bibliographic record or items. This patch hides the modal link if patron has only delete_bibliographic_records permission. To test: 1. Add delete_bibliographic_records to patron, but to not add any other permissions for them from editcatalogue permissions. 2. Navigate to the main page. => Note that link to the Catalogue modal is displayed. 3. Apply this patch and refresh the main page. => Note that link to the Catalogue modal is no longer displayed. Sponsored-by: Koha-Suomi Oy --- .../prog/en/modules/intranet-main.tt | 2 +- mainpage.pl | 19 ++++++++++++++++--- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt index c50befa87f..7fbe20301c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt @@ -135,7 +135,7 @@ [% END %] - [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || ( fast_cataloging && CAN_user_editcatalogue_fast_cataloging || can_see_cataloguing_module ) ) %] + [% IF ( !only_delete_bibliographic_records_permission && ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || ( fast_cataloging && CAN_user_editcatalogue_fast_cataloging || can_see_cataloguing_module ) ) ) %]
  • Cataloging
  • diff --git a/mainpage.pl b/mainpage.pl index 21a1ad3c44..7c6d2731f7 100755 --- a/mainpage.pl +++ b/mainpage.pl @@ -20,9 +20,10 @@ # along with Koha; if not, see . use Modern::Perl; -use CGI qw ( -utf8 ); -use C4::Output qw( output_html_with_http_headers ); -use C4::Auth qw( get_template_and_user ); +use CGI qw ( -utf8 ); +use Scalar::Util qw( reftype ); +use C4::Output qw( output_html_with_http_headers ); +use C4::Auth qw( get_all_subpermissions get_template_and_user ); use C4::Koha; use C4::Tags qw( get_count_by_tag_status ); use Koha::AdditionalContents; @@ -79,6 +80,18 @@ my $branch = ? C4::Context->userenv()->{'branch'} : undef; +# Do not let patrons with only delete_bibliographic_records permission to access Catalogue modal +my $editcatalogue_flags = $flags->{'editcatalogue'}; +if ( reftype($editcatalogue_flags) + && reftype($editcatalogue_flags) eq "HASH" + && scalar( keys %$editcatalogue_flags ) == 1 + && $editcatalogue_flags->{'delete_bibliographic_records'} ) +{ + $template->param( + only_delete_bibliographic_records_permission => 1, + ); +} + my $pendingcomments = Koha::Reviews->search_limited( { approved => 0 } )->count; my $pendingtags = get_count_by_tag_status(0); -- 2.34.1