From e36afcdff137f319bc750d1bb26ceb9d289b9caa Mon Sep 17 00:00:00 2001 From: Paul Poulain <paul.poulain@biblibre.com> Date: Tue, 5 Apr 2011 17:58:22 +0200 Subject: [PATCH] BZ6072: fixing permission inconsistencies MT5306 In large libraries, some librarian may have permission only to recieve shipments This patch fixes some permission : * booksellers page = accessible to anyone that has at least 1 acq permission * parcels = accessible to anyone with order_recieve * supplier detail = accessible to anyone that has at least 1 acq permission, but modifying accessible only if vendor_manage --- acqui/booksellers.pl | 2 +- acqui/parcels.pl | 2 +- acqui/supplier.pl | 2 +- .../prog/en/includes/acquisitions-toolbar.inc | 22 +++++++++++-------- .../prog/en/modules/acqui/booksellers.tmpl | 4 ++- 5 files changed, 19 insertions(+), 13 deletions(-) diff --git a/acqui/booksellers.pl b/acqui/booksellers.pl index 88dbaa9..cc5c084 100755 --- a/acqui/booksellers.pl +++ b/acqui/booksellers.pl @@ -66,7 +66,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => 'intranet', authnotrequired => 0, - flagsrequired => { acquisition => 'vendors_manage' }, + flagsrequired => { acquisition => '*' }, debug => 1, } ); diff --git a/acqui/parcels.pl b/acqui/parcels.pl index 1e8d44e..915b1e8 100755 --- a/acqui/parcels.pl +++ b/acqui/parcels.pl @@ -91,7 +91,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { acquisition => 1 }, + flagsrequired => { acquisition => 'order_receive' }, debug => 1, } ); diff --git a/acqui/supplier.pl b/acqui/supplier.pl index 52d940c..2a4078a 100755 --- a/acqui/supplier.pl +++ b/acqui/supplier.pl @@ -64,7 +64,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => 'intranet', authnotrequired => 0, - flagsrequired => { acquisition => 'vendors_manage' }, + flagsrequired => { acquisition => '*' }, debug => 1, } ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc index 9f7a8e5..a11417a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc @@ -21,9 +21,11 @@ new YAHOO.widget.Button("editcontracts"); var manageorders = [ - { text: _("New basket"), url: "/cgi-bin/koha/acqui/basketheader.pl?booksellerid=<!-- TMPL_VAR NAME="id" -->&op=add_form"}, - { text: _("Baskets"), url: "/cgi-bin/koha/acqui/booksellers.pl?supplierid=<!--TMPL_VAR Name="id"-->"}, - { text: _("Basket groups"), url: "/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=<!-- TMPL_VAR NAME="id" -->"}, + <!-- TMPL_IF name="CAN_user_acquisition_order_manage" --> + { text: _("New basket"), url: "/cgi-bin/koha/acqui/basketheader.pl?booksellerid=<!-- TMPL_VAR NAME="id" -->&op=add_form"}, + { text: _("Baskets"), url: "/cgi-bin/koha/acqui/booksellers.pl?supplierid=<!--TMPL_VAR Name="id"-->"}, + { text: _("Basket groups"), url: "/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=<!-- TMPL_VAR NAME="id" -->"}, + <!-- /TMPL_IF --> { text: _("Receive shipments"), url: "/cgi-bin/koha/acqui/parcels.pl?supplierid=<!--TMPL_VAR Name="id"-->" }, <!-- TMPL_IF name="basketno" --> { text: _("Uncertain prices"), url: "/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=<!-- TMPL_VAR NAME="id" -->&basketno=<!--TMPL_VAR name="basketno" -->&owner=1"} @@ -42,12 +44,14 @@ </script> <ul id="toolbar-list" class="toolbar"> <!-- TMPL_IF NAME="id" --> - <li><a id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?supplierid=<!--TMPL_VAR Name="id"-->&op=enter">Edit</a></li> - <li><a id="newcontract" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&booksellerid=<!-- TMPL_VAR name="id" -->">New Contract</a></li> - <li><a id="editcontracts" href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=<!-- TMPL_VAR name="id" -->">Contracts</a></li> - <!-- TMPL_UNLESS NAME="basketcount" --> - <li><a id="newbasket" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=<!-- TMPL_VAR name="id" -->&op=add_form">New Basket</a></li> - <!-- /TMPL_UNLESS --> + <!-- TMPL_IF name="CAN_user_acquisition_vendors_manage" --> + <li><a id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?supplierid=<!--TMPL_VAR Name="id"-->&op=enter">Edit</a></li> + <li><a id="newcontract" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&booksellerid=<!-- TMPL_VAR name="id" -->">New Contract</a></li> + <li><a id="editcontracts" href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=<!-- TMPL_VAR name="id" -->">Contracts</a></li> + <!-- TMPL_UNLESS NAME="basketcount" --> + <li><a id="newbasket" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=<!-- TMPL_VAR name="id" -->&op=add_form">New Basket</a></li> + <!-- /TMPL_UNLESS --> + <!-- /TMPL_IF --> <!-- TMPL_ELSE --> <li><a id="newbudget" href="/cgi-bin/koha/acqui/supplier.pl?op=enter">New Vendor</a></li> <!-- /TMPL_IF --> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tmpl index 50b3ea7..6d64251 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tmpl @@ -58,11 +58,13 @@ <!-- TMPL_ELSE --> <tr> <!-- /TMPL_UNLESS --> - <td> <!-- TMPL_IF name="active" --> + <td><!-- TMPL_IF name="CAN_user_acquisition_order_manage" --> + <!-- TMPL_IF name="active" --> <a href="basketheader.pl?booksellerid=<!-- TMPL_VAR name="supplierid" -->&op=add_form">New basket</a> <!-- TMPL_ELSE --> Inactive <!-- /TMPL_IF --> + <!-- /TMPL_IF --> </td> <td> <a href="parcels.pl?supplierid=<!-- TMPL_VAR name="supplierid" -->">Receive shipment</a> </td> -- 1.7.1