From e73a3a7ecdfd9b61110173a0e768c241ea30dca5 Mon Sep 17 00:00:00 2001 From: Julian Maurice Date: Thu, 6 Feb 2014 15:28:44 +0100 Subject: [PATCH] Bug 7292: More granular permissions for claiming orders Add a new permission order_claim_for_all. Without this permission, user can only claim for orders in baskets he's authorised to manage Signed-off-by: Paola Rossi --- acqui/lateorders.pl | 75 +++++++++++++++----- .../prog/en/modules/acqui/lateorders.tt | 15 ++++ 2 files changed, 74 insertions(+), 16 deletions(-) diff --git a/acqui/lateorders.pl b/acqui/lateorders.pl index d43dbbe..9952d8b 100755 --- a/acqui/lateorders.pl +++ b/acqui/lateorders.pl @@ -56,7 +56,7 @@ use C4::Branch; # GetBranches use Koha::DateUtils; my $input = new CGI; -my ($template, $loggedinuser, $cookie) = get_template_and_user( +my ($template, $loggedinuser, $cookie, $userflags) = get_template_and_user( { template_name => "acqui/lateorders.tt", query => $input, @@ -67,6 +67,27 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user( } ); +# Check if user has rights to access this page +my $can_claim_for_all = 0; +if ($userflags->{superlibrarian} + or (!ref $userflags->{acquisition} and $userflags->{acquisition}) + or (ref $userflags->{acquisition} + and $userflags->{acquisition}->{order_claim_for_all} + ) +) { + $can_claim_for_all = 1; +} + +if ( !$can_claim_for_all + and ( + ref $userflags->{acquisition} + and not $userflags->{acquisition}->{order_receive} + ) +) { + # Will fail to authenticate, so redirect to login screen + checkauth($input, 0, { acquisition => 'order_receive' }, "intranet"); +} + my $booksellerid = $input->param('booksellerid') || undef; # we don't want "" or 0 my $delay = $input->param('delay') // 0; @@ -103,22 +124,39 @@ if ( $delay and not $delay =~ /^\d{1,3}$/ ) { } if ($op and $op eq "send_alert"){ - my @ordernums = $input->param("ordernumber");# FIXME: Fallback values? - my $err; - eval { - $err = SendAlerts( 'claimacquisition', \@ordernums, $input->param("letter_code") ); # FIXME: Fallback value? - if ( not ref $err or not exists $err->{error} ) { - AddClaim ( $_ ) for @ordernums; + my @claim_for = $input->param('claim_for'); # FIXME: Fallback values? + my (@ordernums, @not_claimed); + if (not $can_claim_for_all) { + foreach my $ordernumber (@claim_for) { + my $order = GetOrder($ordernumber); + if (CanUserManageBasket($loggedinuser, $order->{basketno}, $userflags)) { + push @ordernums, $ordernumber; + } else { + push @not_claimed, $ordernumber; + } } - }; - - if ( $@ ) { - $template->param(error_claim => $@); - } elsif ( ref $err and exists $err->{error} and $err->{error} eq "no_email" ) { - $template->{VARS}->{'error_claim'} = "no_email"; } else { - $template->{VARS}->{'info_claim'} = 1; + @ordernums = @claim_for; + } + if (scalar @ordernums > 0) { + my $err; + eval { + $err = SendAlerts( 'claimacquisition', \@ordernums, $input->param("letter_code") ); # FIXME: Fallback value? + if ( not ref $err or not exists $err->{error} ) { + foreach my $ordernumber (@ordernums) { + AddClaim($ordernumber); + } + } + }; + if ( $@ ) { + $template->param(error_claim => $@); + } elsif ( ref $err and exists $err->{error} and $err->{error} eq "no_email" ) { + $template->param(error_claim => "no_email"); + } else { + $template->param(info_claim => 1); + } } + $template->param(not_claimed => \@not_claimed); } my @parameters = ( $delay ); @@ -157,8 +195,13 @@ if ($estimateddeliverydateto_dt) { my @lateorders = GetLateOrders( @parameters ); my $total; -foreach (@lateorders){ - $total += $_->{subtotal}; +foreach my $order (@lateorders){ + if ( (not $can_claim_for_all) + and (not CanUserManageBasket($loggedinuser, $order->{basketno}, $userflags)) + ) { + $order->{cannot_claim} = 1; + } + $total += $order->{subtotal}; } my $letters = GetLetters({ module => "claimacquisition" }); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt index efa0db6..594f14e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt @@ -87,6 +87,19 @@ $(document).ready(function() {
[% error_claim %]
[% END %] [% END %] +[% IF not_claimed.size %] +
+

+ The following orders were not claimed because you are not + authorised to claim for them: +

+
    + [% FOREACH ordernumber IN not_claimed %] +
  • [% ordernumber %]
  • + [% END %] +
+
+[% END %] [% IF info_claim %]
Email has been sent.
[% END %] @@ -129,7 +142,9 @@ $(document).ready(function() { [% UNLESS ( loop.odd ) %] [% ELSE %][% END %] + [% UNLESS lateorder.cannot_claim %] + [% END %] [% lateorder.orderdate | $KohaDates %] ([% lateorder.latesince %] days) -- 1.7.10.4