From 76f43ee499d9c1a9d14266c5b9513b299963caa2 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 17 Dec 2014 16:27:11 +0100 Subject: [PATCH] Bug 13417: Limit the permission to delete It's preferable to limit the permission to delete shelves. Apply both patches before testing, then follow this test plan Currently a public list can only be deleted by its owner. This means lists can exist infinitely. This will introduce a new permission for list. With this permission, a staff member will be allow to delete any public lists. Test plan: 1/ Add the manage_shelves permission to a patron. 2/ Login with this patron 3/ Go on the public list view 4/ You should be able to delete all public lists Signed-off-by: Chris Cormack --- C4/VirtualShelves.pm | 6 +++--- C4/VirtualShelves/Page.pm | 10 ++++++++-- installer/data/mysql/en/mandatory/userpermissions.sql | 2 +- installer/data/mysql/updatedatabase.pl | 4 ++-- .../intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt | 4 +++- 5 files changed, 17 insertions(+), 9 deletions(-) diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm index ed46a83..e9815ee 100644 --- a/C4/VirtualShelves.pm +++ b/C4/VirtualShelves.pm @@ -468,10 +468,10 @@ sub ShelfPossibleAction { return 0 unless defined($shelfnumber); - if ( $user > 0 ) { + if ( $user > 0 and $action eq 'delete_shelf' ) { my $borrower = C4::Members::GetMember( borrowernumber => $user ); return 1 - if C4::Auth::haspermission( $borrower->{userid}, { shelves => 'manage_shelves' } ); + if C4::Auth::haspermission( $borrower->{userid}, { shelves => 'delete_shelves' } ); } my $dbh = C4::Context->dbh; @@ -525,7 +525,7 @@ sub ShelfPossibleAction { return (0, 5); # code 5: should be private list } } - elsif($action eq 'manage') { + elsif($action eq 'manage' or $action eq 'delete_shelf') { return 1 if $user && $shelf->{owner}==$user; } return 0; diff --git a/C4/VirtualShelves/Page.pm b/C4/VirtualShelves/Page.pm index 56518c2..cbf3e4a 100644 --- a/C4/VirtualShelves/Page.pm +++ b/C4/VirtualShelves/Page.pm @@ -312,6 +312,7 @@ sub shelfpage { $showadd = 1; my $i = 0; my $manageshelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'manage' ); + my $can_delete_shelf = ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete_shelf' ); $template->param( shelfname => $shelfname, shelfnumber => $shelfnumber, @@ -320,6 +321,7 @@ sub shelfpage { manageshelf => $manageshelf, allowremovingitems => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'delete'), allowaddingitem => ShelfPossibleAction( $loggedinuser, $shelfnumber, 'add'), + allowdeletingshelf => $can_delete_shelf, "category$category" => 1, category => $category, itemsloop => $items, @@ -377,8 +379,10 @@ sub shelfpage { $stay=0; next; } - # - unless ( ShelfPossibleAction( $loggedinuser, $number, 'manage' ) ) { + + my $can_manage = ShelfPossibleAction( $loggedinuser, $number, 'manage' ); + my $can_delete = ShelfPossibleAction( $loggedinuser, $number, 'delete_shelf' ); + unless ( $can_manage or $can_delete ) { push( @paramsloop, { nopermission => $shelfnumber } ); last; } @@ -436,8 +440,10 @@ sub shelfpage { my $category = $shelflist->{$element}->{'category'}; my $owner = $shelflist->{$element}->{'owner'}||0; my $canmanage = ShelfPossibleAction( $loggedinuser, $element, 'manage' ); + my $candelete = ShelfPossibleAction( $loggedinuser, $element, 'delete_shelf' ); $shelflist->{$element}->{"viewcategory$category"} = 1; $shelflist->{$element}->{manageshelf} = $canmanage; + $shelflist->{$element}->{allowdeletingshelf} = $candelete; if($canmanage || ($loggedinuser && $owner==$loggedinuser)) { $shelflist->{$element}->{'mine'} = 1; } diff --git a/installer/data/mysql/en/mandatory/userpermissions.sql b/installer/data/mysql/en/mandatory/userpermissions.sql index 12768b7..a5f574f 100644 --- a/installer/data/mysql/en/mandatory/userpermissions.sql +++ b/installer/data/mysql/en/mandatory/userpermissions.sql @@ -72,5 +72,5 @@ INSERT INTO permissions (module_bit, code, description) VALUES (19, 'tool', 'Use tool plugins'), (19, 'report', 'Use report plugins'), (19, 'configure', 'Configure plugins'), - (20, 'manage_shelves', 'Manage shelves') + (20, 'delete_shelves', 'Delete shelves') ; diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl index 051d7c0..1e0bf05 100755 --- a/installer/data/mysql/updatedatabase.pl +++ b/installer/data/mysql/updatedatabase.pl @@ -9616,9 +9616,9 @@ if ( CheckVersion($DBversion) ) { |); $dbh->do(q| INSERT INTO permissions (module_bit, code, description) VALUES - (20, 'manage_shelves', 'Manage shelves') + (20, 'delete_shelves', 'Delete shelves') |); - print "Upgrade to $DBversion done (Bug 13417: Add permission to manage shelves)\n"; + print "Upgrade to $DBversion done (Bug 13417: Add permission to delete shelves)\n"; SetVersion ($DBversion); } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt index 97e47a7..bba00b3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt @@ -600,12 +600,14 @@ function placeHold () { [% IF ( shelvesloo.viewcategory2 ) %]Public[% END %] - [% IF ( shelvesloo.manageshelf ) %] + [% IF shelvesloo.manageshelf %]
+ [% END %] + [% IF shelvesloo.manageshelf OR shelvesloo.allowdeletingshelf %]
-- 2.1.0