View | Details | Raw Unified | Return to bug 7295
Collapse All | Expand All

(-)a/C4/Acquisition.pm (-5 / +18 lines)
Lines 697-709 C4::Acquisition::GetBasket. Link Here
697
The third parameter is optional. If given, it should be a hashref as returned
697
The third parameter is optional. If given, it should be a hashref as returned
698
by C4::Auth::getuserflags. If not, getuserflags is called.
698
by C4::Auth::getuserflags. If not, getuserflags is called.
699
699
700
Fourth parameter is a hash of options.
701
Avaiable options are:
702
703
=over 2
704
705
=item * B<assume_in_user_list>:
706
Assume the borrower is in the basket's users list. So don't check this. This
707
is useful to check if a borrower can be added to the users list.
708
709
=back
710
700
If user is authorised to manage basket, returns 1.
711
If user is authorised to manage basket, returns 1.
701
Otherwise returns 0.
712
Otherwise returns 0.
702
713
703
=cut
714
=cut
704
715
705
sub CanUserManageBasket {
716
sub CanUserManageBasket {
706
    my ($borrower, $basket, $userflags) = @_;
717
    my ($borrower, $basket, $userflags, %options) = @_;
707
718
708
    if (!ref $borrower) {
719
    if (!ref $borrower) {
709
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);
720
        $borrower = C4::Members::GetMember(borrowernumber => $borrower);
Lines 742-751 sub CanUserManageBasket { Link Here
742
            return 0;
753
            return 0;
743
        }
754
        }
744
755
745
        if ($AcqViewBaskets eq 'user'
756
        unless ($options{assume_in_user_list}) {
746
        && $basket->{authorisedby} != $borrowernumber
757
            if ($AcqViewBaskets eq 'user'
747
        && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
758
            && $basket->{authorisedby} != $borrowernumber
748
            return 0;
759
            && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
760
                return 0;
761
            }
749
        }
762
        }
750
763
751
        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
764
        if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
(-)a/acqui/aqbasketuser_search.pl (-14 / +16 lines)
Lines 25-30 use CGI; Link Here
25
use C4::Auth;
25
use C4::Auth;
26
use C4::Output;
26
use C4::Output;
27
use C4::Members;
27
use C4::Members;
28
use C4::Acquisition;
28
29
29
my $input = new CGI;
30
my $input = new CGI;
30
31
Lines 41-69 my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user( Link Here
41
42
42
my $q = $input->param('q') || '';
43
my $q = $input->param('q') || '';
43
my $op = $input->param('op') || '';
44
my $op = $input->param('op') || '';
45
my $basketno = $input->param('basketno');
46
my $basket = C4::Acquisition::GetBasket($basketno);
44
47
45
if( $op eq "do_search" ) {
48
if( $op eq "do_search" ) {
46
    my $results = C4::Members::Search( $q, "surname");
49
    my $results = C4::Members::Search( $q, "surname");
47
50
48
    my @users_loop;
51
    my @users_loop;
49
    my $nresults = 0;
52
    my $nresults = 0;
50
    foreach my $res (@$results) {
53
    foreach my $borrower (@$results) {
51
        my $perms = haspermission( $res->{userid} );
54
        if (C4::Acquisition::CanUserManageBasket(
52
        my $subperms = get_user_subpermissions( $res->{userid} );
55
                $borrower, $basket, undef, assume_in_user_list => 1))
53
56
        {
54
        if( $perms->{superlibrarian} == 1
55
         || $perms->{acquisition} == 1
56
         || $subperms->{acquisition}->{'order_manage'} ) {
57
            my %row = (
57
            my %row = (
58
                borrowernumber  => $res->{borrowernumber},
58
                borrowernumber => $borrower->{borrowernumber},
59
                cardnumber      => $res->{cardnumber},
59
                cardnumber     => $borrower->{cardnumber},
60
                surname         => $res->{surname},
60
                surname        => $borrower->{surname},
61
                firstname       => $res->{firstname},
61
                firstname      => $borrower->{firstname},
62
                categorycode    => $res->{categorycode},
62
                categorycode   => $borrower->{categorycode},
63
                branchcode      => $res->{branchcode},
63
                branchcode     => $borrower->{branchcode},
64
            );
64
            );
65
            push( @users_loop, \%row );
65
            push( @users_loop, \%row );
66
            $nresults ++;
66
            $nresults++;
67
        }
67
        }
68
    }
68
    }
69
69
Lines 74-77 if( $op eq "do_search" ) { Link Here
74
    );
74
    );
75
}
75
}
76
76
77
$template->param(basketno => $basketno);
78
77
output_html_with_http_headers( $input, $cookie, $template->output );
79
output_html_with_http_headers( $input, $cookie, $template->output );
(-)a/installer/data/mysql/updatedatabase.pl (+5 lines)
Lines 7055-7060 if ( CheckVersion($DBversion) ) { Link Here
7055
            ON UPDATE CASCADE ON DELETE SET NULL
7055
            ON UPDATE CASCADE ON DELETE SET NULL
7056
    ");
7056
    ");
7057
    $dbh->do("
7057
    $dbh->do("
7058
        UPDATE aqbasket, borrowers
7059
        SET aqbasket.branch = borrowers.branchcode
7060
        WHERE aqbasket.authorisedby = borrowers.borrowernumber
7061
    ");
7062
    $dbh->do("
7058
        DROP TABLE IF EXISTS aqbasketusers
7063
        DROP TABLE IF EXISTS aqbasketusers
7059
    ");
7064
    ");
7060
    $dbh->do("
7065
    $dbh->do("
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/aqbasketuser_search.tt (-1 / +3 lines)
Lines 34-43 Link Here
34
      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
34
      <form action="/cgi-bin/koha/acqui/aqbasketuser_search.pl" method="post">
35
        <fieldset>
35
        <fieldset>
36
          <input type="hidden" name="op" id="op" value="do_search" />
36
          <input type="hidden" name="op" id="op" value="do_search" />
37
          <input type="hidden" name="basketno" id="basketno" value="[% basketno %]" />
37
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
38
          <input type="text" name="q" id="q" value="[% q %]" class="focus" />
38
          <input type="submit" class="button" value="Search" />
39
          <input type="submit" class="button" value="Search" />
39
        </fieldset>
40
        </fieldset>
40
        <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
41
        <p class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results.</p>
42
        <p class="hint">Note that if system preference AcqViewBasket is set to "from staff member's library", only staff from the same branch than the basket will be returned.</p>
41
      </form>
43
      </form>
42
44
43
[% IF (q) %]
45
[% IF (q) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-2 / +1 lines)
Lines 117-123 Link Here
117
117
118
    function basketUserSearchPopup(f) {
118
    function basketUserSearchPopup(f) {
119
        window.open(
119
        window.open(
120
            "/cgi-bin/koha/acqui/aqbasketuser_search.pl",
120
            "/cgi-bin/koha/acqui/aqbasketuser_search.pl?basketno=[% basketno %]",
121
            'BasketUserSearchPopup',
121
            'BasketUserSearchPopup',
122
            'width=740,height=450,toolbar=no,'
122
            'width=740,height=450,toolbar=no,'
123
         );
123
         );
124
- 

Return to bug 7295