View | Details | Raw Unified | Return to bug 14540
Collapse All | Expand All

(-)a/C4/Auth.pm (-17 / +40 lines)
Lines 23-28 use Digest::MD5 qw(md5_base64); Link Here
23
use JSON qw/encode_json/;
23
use JSON qw/encode_json/;
24
use URI::Escape;
24
use URI::Escape;
25
use CGI::Session;
25
use CGI::Session;
26
use Scalar::Util qw(blessed);
27
use Try::Tiny;
26
28
27
require Exporter;
29
require Exporter;
28
use C4::Context;
30
use C4::Context;
Lines 226-232 sub get_template_and_user { Link Here
226
        # We are going to use the $flags returned by checkauth
228
        # We are going to use the $flags returned by checkauth
227
        # to create the template's parameters that will indicate
229
        # to create the template's parameters that will indicate
228
        # which menus the user can access.
230
        # which menus the user can access.
229
        if ( $flags && $flags->{superlibrarian} == 1 ) {
231
        if ( $flags && $flags->{superlibrarian} ) {
230
            $template->param( CAN_user_circulate        => 1 );
232
            $template->param( CAN_user_circulate        => 1 );
231
            $template->param( CAN_user_catalogue        => 1 );
233
            $template->param( CAN_user_catalogue        => 1 );
232
            $template->param( CAN_user_parameters       => 1 );
234
            $template->param( CAN_user_parameters       => 1 );
Lines 1801-1806 sub checkpw_hash { Link Here
1801
}
1803
}
1802
1804
1803
=head2 getuserflags
1805
=head2 getuserflags
1806
@DEPRECATED, USE THE Koha::Auth::PermissionManager
1804
1807
1805
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1808
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1806
1809
Lines 1813-1818 C<$authflags> is a hashref of permissions Link Here
1813
=cut
1816
=cut
1814
1817
1815
sub getuserflags {
1818
sub getuserflags {
1819
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1816
    my $flags  = shift;
1820
    my $flags  = shift;
1817
    my $userid = shift;
1821
    my $userid = shift;
1818
    my $dbh    = @_ ? shift : C4::Context->dbh;
1822
    my $dbh    = @_ ? shift : C4::Context->dbh;
Lines 1824-1829 sub getuserflags { Link Here
1824
        no warnings 'numeric';
1828
        no warnings 'numeric';
1825
        $flags += 0;
1829
        $flags += 0;
1826
    }
1830
    }
1831
    return get_user_subpermissions($userid);
1832
1833
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1827
    my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags");
1834
    my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags");
1828
    $sth->execute;
1835
    $sth->execute;
1829
1836
Lines 1847-1853 sub getuserflags { Link Here
1847
}
1854
}
1848
1855
1849
=head2 get_user_subpermissions
1856
=head2 get_user_subpermissions
1850
1857
@DEPRECATED, USE THE Koha::Auth::PermissionManager
1851
  $user_perm_hashref = get_user_subpermissions($userid);
1858
  $user_perm_hashref = get_user_subpermissions($userid);
1852
1859
1853
Given the userid (note, not the borrowernumber) of a staff user,
1860
Given the userid (note, not the borrowernumber) of a staff user,
Lines 1872-1896 necessary to check borrowers.flags. Link Here
1872
=cut
1879
=cut
1873
1880
1874
sub get_user_subpermissions {
1881
sub get_user_subpermissions {
1882
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1875
    my $userid = shift;
1883
    my $userid = shift;
1876
1884
1877
    my $dbh = C4::Context->dbh;
1885
    use Koha::Auth::PermissionManager;
1878
    my $sth = $dbh->prepare( "SELECT flag, user_permissions.code
1886
    my $permissionManager = Koha::Auth::PermissionManager->new();
1879
                             FROM user_permissions
1887
    my $borrowerPermissions = $permissionManager->getBorrowerPermissions($userid); #Prefetch all related tables.
1880
                             JOIN permissions USING (module_bit, code)
1881
                             JOIN userflags ON (module_bit = bit)
1882
                             JOIN borrowers USING (borrowernumber)
1883
                             WHERE userid = ?" );
1884
    $sth->execute($userid);
1885
1886
    my $user_perms = {};
1888
    my $user_perms = {};
1887
    while ( my $perm = $sth->fetchrow_hashref ) {
1889
    foreach my $perm ( @$borrowerPermissions ) {
1888
        $user_perms->{ $perm->{'flag'} }->{ $perm->{'code'} } = 1;
1890
        $user_perms->{ $perm->getPermissionModule->module }->{ $perm->getPermission->code } = 1;
1889
    }
1891
    }
1892
1890
    return $user_perms;
1893
    return $user_perms;
1891
}
1894
}
1892
1895
1893
=head2 get_all_subpermissions
1896
=head2 get_all_subpermissions
1897
@DEPRECATED, USE THE Koha::Auth::PermissionManager
1894
1898
1895
  my $perm_hashref = get_all_subpermissions();
1899
  my $perm_hashref = get_all_subpermissions();
1896
1900
Lines 1903-1908 of the subpermission. Link Here
1903
=cut
1907
=cut
1904
1908
1905
sub get_all_subpermissions {
1909
sub get_all_subpermissions {
1910
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1911
    use Koha::Auth::PermissionManager;
1912
    my $permissionManager = Koha::Auth::PermissionManager->new();
1913
    my $all_permissions = $permissionManager->listKohaPermissionsAsHASH();
1914
    foreach my $module ( keys %$all_permissions ) {
1915
        my $permissionModule = $all_permissions->{$module};
1916
        foreach my $code (keys %{$permissionModule->{permissions}}) {
1917
            my $permission = $permissionModule->{permissions}->{$code};
1918
            $all_permissions->{$module}->{$code} = $permission->{'description'};
1919
        }
1920
    }
1921
    return $all_permissions;
1922
1923
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1906
    my $dbh = C4::Context->dbh;
1924
    my $dbh = C4::Context->dbh;
1907
    my $sth = $dbh->prepare( "SELECT flag, code, description
1925
    my $sth = $dbh->prepare( "SELECT flag, code, description
1908
                             FROM permissions
1926
                             FROM permissions
Lines 1917-1922 sub get_all_subpermissions { Link Here
1917
}
1935
}
1918
1936
1919
=head2 haspermission
1937
=head2 haspermission
1938
@DEPRECATED, USE THE Koha::Auth::PermissionManager
1920
1939
1921
  $flags = ($userid, $flagsrequired);
1940
  $flags = ($userid, $flagsrequired);
1922
1941
Lines 1928-1938 Returns member's flags or 0 if a permission is not met. Link Here
1928
=cut
1947
=cut
1929
1948
1930
sub haspermission {
1949
sub haspermission {
1950
    #@DEPRECATED, USE THE Koha::Auth::PermissionManager
1931
    my ( $userid, $flagsrequired ) = @_;
1951
    my ( $userid, $flagsrequired ) = @_;
1932
    my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
1952
1933
    $sth->execute($userid);
1953
    my $flags = getuserflags( undef, $userid );
1934
    my $row = $sth->fetchrow();
1954
    #Sanitate 1 to * because we no longer have 1's from the koha.borrowers.flags.
1935
    my $flags = getuserflags( $row, $userid );
1955
    foreach my $module (%$flagsrequired) {
1956
        $flagsrequired->{$module} = '*' if $flagsrequired->{$module} && $flagsrequired->{$module} eq '1';
1957
    }
1958
1936
    if ( $userid eq C4::Context->config('user') ) {
1959
    if ( $userid eq C4::Context->config('user') ) {
1937
1960
1938
        # Super User Account from /etc/koha.conf
1961
        # Super User Account from /etc/koha.conf
(-)a/C4/Members.pm (-10 / +1 lines)
Lines 230-246 sub GetMemberDetails { Link Here
230
    $borrower->{'amountoutstanding'} = $amount;
230
    $borrower->{'amountoutstanding'} = $amount;
231
    # FIXME - patronflags calls GetMemberAccountRecords... just have patronflags return $amount
231
    # FIXME - patronflags calls GetMemberAccountRecords... just have patronflags return $amount
232
    my $flags = patronflags( $borrower);
232
    my $flags = patronflags( $borrower);
233
    my $accessflagshash;
234
233
235
    $sth = $dbh->prepare("select bit,flag from userflags");
234
    $borrower->{'flags'}     = $flags; #Is this the flags-column? @DEPRECATED!
236
    $sth->execute;
237
    while ( my ( $bit, $flag ) = $sth->fetchrow ) {
238
        if ( $borrower->{'flags'} && $borrower->{'flags'} & 2**$bit ) {
239
            $accessflagshash->{$flag} = 1;
240
        }
241
    }
242
    $borrower->{'flags'}     = $flags;
243
    $borrower->{'authflags'} = $accessflagshash;
244
235
245
    # For the purposes of making templates easier, we'll define a
236
    # For the purposes of making templates easier, we'll define a
246
    # 'showname' which is the alternate form the user's first name if 
237
    # 'showname' which is the alternate form the user's first name if 
(-)a/Koha/Auth/BorrowerPermission.pm (+221 lines)
Line 0 Link Here
1
package Koha::Auth::BorrowerPermission;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Scalar::Util qw(blessed);
22
23
use Koha::Auth::BorrowerPermissions;
24
use Koha::Auth::PermissionModules;
25
use Koha::Auth::Permissions;
26
use Koha::Borrowers;
27
28
use Koha::Exception::BadParameter;
29
30
use base qw(Koha::Object);
31
32
sub type {
33
    return 'BorrowerPermission';
34
}
35
sub object_class {
36
    return 'Koha::Auth::BorrowerPermission';
37
}
38
39
=head NAME
40
41
Koha::Auth::BorrowerPermission
42
43
=head SYNOPSIS
44
45
Object representation of a Permission given to a Borrower.
46
47
=head new
48
49
    my $borrowerPermission = Koha::Auth::BorrowerPermission->new({
50
                                borrowernumber => 12,
51
                                permission_module_id => 2,
52
                                permission => $Koha::Auth::Permission,
53
    });
54
    my $borrowerPermission = Koha::Auth::BorrowerPermission->new({
55
                                borrower => $Koha::Borrower,
56
                                permissionModule => $Koha::Auth::PermissionModule,
57
                                permission_id => 22,
58
    });
59
60
Remember to ->store() the returned object to persist it in the DB.
61
@PARAM1 HASHRef of constructor parameters:
62
            MANDATORY keys:
63
                borrower or borrowernumber
64
                permissionModule or permission_module_id
65
                permission or permission_id
66
            Values can be either Koha::Object derivatives or their respective DB primary keys
67
@RETURNS Koha::Auth::BorrowerPermission
68
=cut
69
70
sub new {
71
    my ($class, $params) = @_;
72
73
    _validateParams($params);
74
75
    #Check for duplicates, and update existing permission if available.
76
    my $self = Koha::Auth::BorrowerPermissions->find({borrowernumber => $params->{borrower}->borrowernumber,
77
                                                      permission_module_id => $params->{permissionModule}->permission_module_id,
78
                                                      permission_id => $params->{permission}->permission_id,
79
                                                    });
80
    $self = $class->SUPER::new() unless $self;
81
    $self->{params} = $params;
82
    $self->set({borrowernumber => $self->getBorrower()->borrowernumber,
83
                permission_id => $self->getPermission()->permission_id,
84
                permission_module_id => $self->getPermissionModule()->permission_module_id
85
                });
86
    return $self;
87
}
88
89
=head getBorrower
90
91
    my $borrower = $borrowerPermission->getBorrower();
92
93
@RETURNS Koha::Borrower
94
=cut
95
96
sub getBorrower {
97
    my ($self) = @_;
98
99
    unless ($self->{params}->{borrower}) {
100
        my $dbix_borrower = $self->_result()->borrower;
101
        my $borrower = Koha::Borrower->_new_from_dbic($dbix_borrower);
102
        $self->{params}->{borrower} = $borrower;
103
    }
104
    return $self->{params}->{borrower};
105
}
106
107
=head setBorrower
108
109
    my $borrowerPermission = $borrowerPermission->setBorrower( $borrower );
110
111
Set the Borrower.
112
When setting the DB is automatically updated as well.
113
@PARAM1 Koha::Borrower, set the given Borrower to this BorrowerPermission.
114
@RETURNS Koha::Auth::BorrowerPermission,
115
=cut
116
117
sub setBorrower {
118
    my ($self, $borrower) = @_;
119
120
    unless (blessed($borrower) && $borrower->isa('Koha::Borrower')) {
121
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."->setPermissionModule():> Given parameter '\\$borrower' is not a Koha::Borrower-object!");
122
    }
123
    $self->{params}->{borrower} = $borrower;
124
    $self->set({borrowernumber => $borrower->borrowernumber()});
125
    $self->store();
126
}
127
128
=head getPermissionModule
129
130
    my $permissionModule = $borrowerPermission->getPermissionModule();
131
132
@RETURNS Koha::Auth::PermissionModule
133
=cut
134
135
sub getPermissionModule {
136
    my ($self) = @_;
137
138
    unless ($self->{params}->{permissionModule}) {
139
        my $dbix_object = $self->_result()->permission_module;
140
        my $object = Koha::Auth::PermissionModule->_new_from_dbic($dbix_object);
141
        $self->{params}->{permissionModule} = $object;
142
    }
143
    return $self->{params}->{permissionModule};
144
}
145
146
=head setPermissionModule
147
148
    my $borrowerPermission = $borrowerPermission->setPermissionModule( $permissionModule );
149
150
Set the PermissionModule.
151
When setting the DB is automatically updated as well.
152
@PARAM1 Koha::Auth::PermissionModule, set the given PermissionModule as
153
                                      the PermissionModule of this BorrowePermission.
154
@RETURNS Koha::Auth::BorrowerPermission,
155
=cut
156
157
sub setPermissionModule {
158
    my ($self, $permissionModule) = @_;
159
160
    unless (blessed($permissionModule) && $permissionModule->isa('Koha::Auth::PermissionModule')) {
161
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."->setPermissionModule():> Given parameter '\$permissionModule' is not a Koha::Auth::PermissionModule-object!");
162
    }
163
    $self->{params}->{permissionModule} = $permissionModule;
164
    $self->set({permission_module_id => $permissionModule->permission_module_id()});
165
    $self->store();
166
}
167
168
=head getPermission
169
170
    my $permission = $borrowerPermission->getPermission();
171
172
@RETURNS Koha::Auth::Permission
173
=cut
174
175
sub getPermission {
176
    my ($self) = @_;
177
178
    unless ($self->{params}->{permission}) {
179
        my $dbix_object = $self->_result()->permission;
180
        my $object = Koha::Auth::Permission->_new_from_dbic($dbix_object);
181
        $self->{params}->{permission} = $object;
182
    }
183
    return $self->{params}->{permission};
184
}
185
186
=head setPermission
187
188
    my $borrowerPermission = $borrowerPermission->setPermission( $permission );
189
190
Set the Permission.
191
When setting the DB is automatically updated as well.
192
@PARAM1 Koha::Auth::Permission, set the given Permission to this BorrowerPermission.
193
@RETURNS Koha::Auth::BorrowerPermission,
194
=cut
195
196
sub setPermission {
197
    my ($self, $permission) = @_;
198
199
    unless (blessed($permission) && $permission->isa('Koha::Auth::Permission')) {
200
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."->setPermission():> Given parameter '\$permission' is not a Koha::Auth::Permission-object!");
201
    }
202
    $self->{params}->{permission} = $permission;
203
    $self->set({permission_id => $permission->permission_id()});
204
    $self->store();
205
}
206
207
=head _validateParams
208
209
Validates the given constructor parameters and fetches the Koha::Objects when needed.
210
211
=cut
212
213
sub _validateParams {
214
    my ($params) = @_;
215
216
    $params->{permissionModule} = Koha::Auth::PermissionModules::castToPermissionModule( $params->{permission_module_id} || $params->{permissionModule} );
217
    $params->{permission} = Koha::Auth::Permissions::castToPermission( $params->{permission_id} || $params->{permission} );
218
    $params->{borrower} = Koha::Borrowers::castToBorrower(  $params->{borrowernumber} || $params->{borrower}  );
219
}
220
221
1;
(-)a/Koha/Auth/BorrowerPermissions.pm (+61 lines)
Line 0 Link Here
1
package Koha::Auth::BorrowerPermissions;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Scalar::Util qw(blessed);
22
23
use Koha::Auth::BorrowerPermission;
24
25
use base qw(Koha::Objects);
26
27
sub type {
28
    return 'BorrowerPermission';
29
}
30
sub object_class {
31
    return 'Koha::Auth::BorrowerPermission';
32
}
33
34
sub castToBorrowerPermission {
35
    my ($input) = @_;
36
37
    unless ($input) {
38
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToBorrowerPermission():> No parameter given!");
39
    }
40
    if (blessed($input) && $input->isa('Koha::Auth::BorrowerPermission')) {
41
        return $input;
42
    }
43
    if (blessed($input) && $input->isa('Koha::Schema::Result::BorrowerPermission')) {
44
        return Koha::Auth::BorrowerPermission->_new_from_dbic($input);
45
    }
46
47
    my $permission;
48
    if (not(ref($input))) { #We have a scalar
49
        $permission = Koha::Auth::BorrowerPermissions->find({borrower_permission_id => $input});
50
        unless ($permission) {
51
            Koha::Exception::UnknownObject->throw(error => __PACKAGE__."::castToBorrowerPermission():> Cannot find an existing BorrowerPermission with borrower_permission_id '$input'.");
52
        }
53
    }
54
    unless ($permission) {
55
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToBorrowerPermission():> Cannot cast \$input '$input' to a BorrowerPermission-object.");
56
    }
57
58
    return $permission;
59
}
60
61
1;
(-)a/Koha/Auth/Permission.pm (+60 lines)
Line 0 Link Here
1
package Koha::Auth::Permission;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use Koha::Auth::Permissions;
23
24
use Koha::Exception::BadParameter;
25
26
use base qw(Koha::Object);
27
28
sub type {
29
    return 'Permissions';
30
}
31
sub object_class {
32
    return 'Koha::Auth::Permission';
33
}
34
35
sub new {
36
    my ($class, $params) = @_;
37
38
    _validateParams($params);
39
40
    my $self = Koha::Auth::Permissions->find({code => $params->{code}, module => $params->{module}});
41
    $self = $class->SUPER::new() unless $self;
42
    $self->set($params);
43
    return $self;
44
}
45
46
sub _validateParams {
47
    my ($params) = @_;
48
49
    unless ($params->{description} && length $params->{description} > 0) {
50
        Koha::Exception::BadParameter->throw(error => "Koha::Auth::Permission->new():> Parameter 'description' isn't defined or is empty.");
51
    }
52
    unless ($params->{module} && length $params->{module} > 0) {
53
        Koha::Exception::BadParameter->throw(error => "Koha::Auth::Permission->new():> Parameter 'module' isn't defined or is empty.");
54
    }
55
    unless ($params->{code} && length $params->{code} > 0) {
56
        Koha::Exception::BadParameter->throw(error => "Koha::Auth::Permission->new():> Parameter 'code' isn't defined or is empty.");
57
    }
58
}
59
60
1;
(-)a/Koha/Auth/PermissionManager.pm (+451 lines)
Line 0 Link Here
1
package Koha::Auth::PermissionManager;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Scalar::Util qw(blessed);
22
use Try::Tiny;
23
24
use Koha::Database;
25
use Koha::Auth::Permission;
26
use Koha::Auth::PermissionModule;
27
use Koha::Auth::BorrowerPermission;
28
29
use Koha::Exception::BadParameter;
30
use Koha::Exception::NoPermission;
31
use Koha::Exception::UnknownProgramState;
32
33
=head NAME Koha::Auth::PermissionManager
34
35
=head SYNOPSIS
36
37
PermissionManager is a gateway to all Koha's permission operations. You shouldn't
38
need to touch individual Koha::Auth::Permission- or Koha::Auth::PermissionModule-objects.
39
40
=head new
41
42
=cut
43
44
sub new {
45
    my ($class, $self) = @_;
46
    $self = {} unless $self;
47
    bless($self, $class);
48
    return $self;
49
}
50
51
=head addPermission
52
53
    $permissionManager->addPermission($permission);
54
55
INSERTs or UPDATEs a Koha::Auth::Permission to the Koha DB.
56
Very handy when introducing new features that need new permissions.
57
58
@PARAM1 Koha::Auth::Permission
59
        or
60
        HASHRef of all the koha.permissions-table columns set.
61
=cut
62
63
sub addPermission {
64
    my ($self, $permission) = @_;
65
    if (blessed($permission) && not($permission->isa('Koha::Auth::Permission'))) {
66
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::addPermission():> Given permission is not a Koha::Auth::Permission-object.");
67
    }
68
    elsif (ref($permission) eq 'HASH') {
69
        $permission = Koha::Auth::Permission->new($permission);
70
    }
71
    unless (blessed($permission)) {
72
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::addPermission():> Given permission '$permission' is not of a recognized format.");
73
    }
74
75
    $permission->store();
76
}
77
78
sub getPermission {
79
    my ($self, $permissionId) = @_;
80
81
    try {
82
        return Koha::Auth::Permissions::castToPermission($permissionId);
83
    } catch {
84
        if (blessed($_) && $_->isa('Koha::Exception::UnknownObject')) {
85
            #We catch this type of exception, and simply return nothing, since there was no such Permission
86
        }
87
        else {
88
            die $_;
89
        }
90
    };
91
}
92
93
=head delPermission
94
95
@THROWS Koha::Exception::UnknownObject if no given object in DB to delete.
96
=cut
97
98
sub delPermission {
99
    my ($self, $permissionId) = @_;
100
101
    my $permission = Koha::Auth::Permissions::castToPermission($permissionId);
102
    $permission->delete();
103
}
104
105
=head addPermissionModule
106
107
    $permissionManager->addPermissionModule($permission);
108
109
INSERTs or UPDATEs a Koha::Auth::PermissionModule to the Koha DB.
110
Very handy when introducing new features that need new permissions.
111
112
@PARAM1 Koha::Auth::PermissionModule
113
        or
114
        HASHRef of all the koha.permission_modules-table columns set.
115
=cut
116
117
sub addPermissionModule {
118
    my ($self, $permissionModule) = @_;
119
    if (blessed($permissionModule) && not($permissionModule->isa('Koha::Auth::PermissionModule'))) {
120
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::addPermission():> Given permissionModule is not a Koha::Auth::PermissionModule-object.");
121
    }
122
    elsif (ref($permissionModule) eq 'HASH') {
123
        $permissionModule = Koha::Auth::PermissionModule->new($permissionModule);
124
    }
125
    unless (blessed($permissionModule)) {
126
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::addPermission():> Given permissionModule '$permissionModule' is not of a recognized format.");
127
    }
128
129
    $permissionModule->store();
130
}
131
132
sub getPermissionModule {
133
    my ($self, $permissionModuleId) = @_;
134
135
    try {
136
        return Koha::Auth::PermissionModules::castToPermissionModule($permissionModuleId);
137
    } catch {
138
        if (blessed($_) && $_->isa('Koha::Exception::UnknownObject')) {
139
            #We catch this type of exception, and simply return nothing, since there was no such PermissionModule
140
        }
141
        else {
142
            die $_;
143
        }
144
    };
145
}
146
147
=head delPermissionModule
148
149
@THROWS Koha::Exception::UnknownObject if no given object in DB to delete.
150
=cut
151
152
sub delPermissionModule {
153
    my ($self, $permissionModuleId) = @_;
154
155
    my $permissionModule = Koha::Auth::PermissionModules::castToPermissionModule($permissionModuleId);
156
    $permissionModule->delete();
157
}
158
159
=head getKohaPermissions
160
161
    my $kohaPermissions = $permissionManager->getKohaPermissions();
162
163
Gets all the PermissionModules and their related Permissions in one huge DB query.
164
@RETURNS ARRAYRef of Koha::Auth::PermissionModule-objects with related objects prefetched. 
165
=cut
166
167
sub getKohaPermissions {
168
    my ($self) = @_;
169
170
    my $schema = Koha::Database->new()->schema();
171
    my @permissionModules = $schema->resultset('PermissionModule')->search(
172
                                                            {},
173
                                                            {   join => ['permissions'],
174
                                                                prefetch => ['permissions'],
175
                                                                order_by => ['me.module', 'permissions.code'],
176
                                                            }
177
                                                        );
178
    #Cast DBIx to Koha::Object.
179
    for (my $i=0 ; $i<scalar(@permissionModules) ; $i++) {
180
        $permissionModules[$i] = Koha::Auth::PermissionModules::castToPermissionModule( $permissionModules[$i] );
181
    }
182
    return \@permissionModules;
183
}
184
185
=head listKohaPermissionsAsHASH
186
187
@RETURNS HASHRef, a easily extendable HASH-representation of all the permissions and permission modules
188
in Koha. Not including database numeric keys, but plain text human readable data. Eg:
189
                 {
190
                    acquisitions => {
191
                        description => "Yada yada",
192
                        permissions => {
193
                            budget_add_del => {
194
                                description => "More yada yada",
195
                            }
196
                            budget_manage => {
197
                                description => "Yaawn yadayawn",
198
                            }
199
                            ...
200
                        }
201
                    },
202
                    borrowers => {
203
                        ...
204
                    },
205
                    ...
206
                 }
207
=cut
208
209
sub listKohaPermissionsAsHASH {
210
    my ($self) = @_;
211
    my $permissionModules = $self->getKohaPermissions();
212
    my $hash = {};
213
214
    foreach my $permissionModule (sort {$a->module cmp $b->module} @$permissionModules) {
215
        my $module = $permissionModule->module;
216
217
        $hash->{$module} = $permissionModule->_result->{'_column_data'};
218
        $hash->{$module}->{permissions} = {};
219
220
        my $permissions = $permissionModule->getPermissions;
221
        foreach my $permission (sort {$a->code cmp $b->code} @$permissions) {
222
            my $code = $permission->code;
223
224
            $hash->{$module}->{permissions}->{$code} = $permission->_result->{'_column_data'};
225
        }
226
    }
227
    return $hash;
228
}
229
230
sub getBorrowerPermissions {
231
    my ($self, $borrower, $params) = @_;
232
    $borrower = Koha::Borrowers::castToBorrower($borrower);
233
    #Get params
234
    my $descriptions = $params->{descriptions} || undef;
235
236
    my $schema = Koha::Database->new()->schema();
237
    my $returnList = [];
238
239
    my @borrowerPermissions = $schema->resultset('BorrowerPermission')->search({borrowernumber => $borrower->borrowernumber},
240
                                                                               {join => ['permission','permission_module'],
241
                                                                                prefetch => ['permission','permission_module'],
242
                                                                                order_by => ['permission_module.module', 'permission.code']});
243
    foreach my $bp (@borrowerPermissions) {
244
        push @$returnList, Koha::Auth::BorrowerPermissions::castToBorrowerPermission($bp);
245
    }
246
    return $returnList;
247
}
248
249
=head grantPermissions
250
251
    $permissionManager->grantPermissions($borrower, {borrowers => 'view_borrowers',
252
                                                     reserveforothers => ['place_holds'],
253
                                                     tools => ['edit_news', 'edit_notices'],
254
                                                     acquisition => {
255
                                                       budger_add_del => 1,
256
                                                       budget_modify => 1,
257
                                                     },
258
                                                    }
259
                                        );
260
261
Adds a group of permissions to one user.
262
@RETURNS HASHRef of sorts, One of the various Koha's Borrower-representations
263
=cut
264
265
sub grantPermissions {
266
    my ($self, $borrower, $permissionsGroup) = @_;
267
268
    while (my ($module, $permissions) = each(%$permissionsGroup)) {
269
        if (ref($permissions) eq 'ARRAY') {
270
            foreach my $permission (@$permissions) {
271
                $self->grantPermission($borrower, $module, $permission);
272
            }
273
        }
274
        elsif (ref($permissions) eq 'HASH') {
275
            foreach my $permission (keys(%$permissions)) {
276
                $self->grantPermission($borrower, $module, $permission);
277
            }
278
        }
279
        else {
280
            $self->grantPermission($borrower, $module, $permissions);
281
        }
282
    }
283
}
284
285
=head grantPermission
286
287
    my $borrowerPermission = $permissionManager->grantPermission($borrower, $permissionModule, $permission);
288
289
@PARAM1 Koha::Borrower or
290
        Scalar koha.borrowers.borrowernumber or
291
        Scalar koha.borrowers.cardnumber or
292
        Scalar koha.borrowers.userid or
293
@PARAM2 Koha::Auth::PermissionModule-object
294
        Scalar koha.permission_modules.module or
295
        Scalar koha.permission_modules.permission_module_id
296
@PARAM3 Koha::Auth::Permission-object or
297
        Scalar koha.permissions.code or
298
        Scalar koha.permissions.permission_id
299
=cut
300
301
sub grantPermission {
302
    my ($self, $borrower, $permissionModule, $permission) = @_;
303
304
    my $borrowerPermission = Koha::Auth::BorrowerPermission->new({borrower => $borrower, permissionModule => $permissionModule, permission => $permission});
305
    $borrowerPermission->store();
306
    return $borrowerPermission;
307
}
308
309
=head
310
311
    $permissionManager->revokePermission($borrower, $permissionModule, $permission);
312
313
Revokes a Permission from a Borrower
314
same parameters as grantPermission()
315
316
=cut
317
318
sub revokePermission {
319
    my ($self, $borrower, $permissionModule, $permission) = @_;
320
321
    my $borrowerPermission = Koha::Auth::BorrowerPermission->new({borrower => $borrower, permissionModule => $permissionModule, permission => $permission});
322
    $borrowerPermission->delete();
323
    return $borrowerPermission;
324
}
325
326
=head revokeAllPermissions
327
328
    $permissionManager->revokeAllPermissions($borrower);
329
330
=cut
331
332
sub revokeAllPermissions {
333
    my ($self, $borrower) = @_;
334
    $borrower = Koha::Borrowers::castToBorrower($borrower);
335
336
    my $schema = Koha::Database->new()->schema();
337
    $schema->resultset('BorrowerPermission')->search({borrowernumber => $borrower->borrowernumber})->delete_all();
338
}
339
340
=head hasPermissions
341
342
See if the given Borrower has all of the given permissions
343
@PARAM1 Koha::Borrower, or any of the koha.borrowers-table's unique identifiers.
344
@PARAM2 HASHRef of needed permissions,
345
    {
346
        borrowers => 'view_borrowers',
347
        reserveforothers => ['place_holds'],
348
        tools => ['edit_news', 'edit_notices'],
349
        acquisition => {
350
            budger_add_del => 1,
351
            budget_modify => 1,
352
        },
353
        coursereserves => '*', #Means any Permission under this PermissionModule
354
   }
355
@RETURNS see hasPermission()
356
@THROWS Koha::Exception::NoPermission, from hasPermission() if permission is missing.
357
=cut
358
359
sub hasPermissions {
360
    my ($self, $borrower, $requiredPermissions) = @_;
361
362
    foreach my $module (keys(%$requiredPermissions)) {
363
        my $permissions = $requiredPermissions->{$module};
364
        if (ref($permissions) eq 'ARRAY') {
365
            foreach my $permission (@$permissions) {
366
                $self->hasPermission($borrower, $module, $permission);
367
            }
368
        }
369
        elsif (ref($permissions) eq 'HASH') {
370
            foreach my $permission (keys(%$permissions)) {
371
                $self->hasPermission($borrower, $module, $permission);
372
            }
373
        }
374
        else {
375
            $self->hasPermission($borrower, $module, $permissions);
376
        }
377
    }
378
    return 1;
379
}
380
381
=head hasPermission
382
383
See if the given Borrower has the given permission
384
@PARAM1 Koha::Borrower, or any of the koha.borrowers-table's unique identifiers.
385
@PARAM2 Koha::Auth::PermissionModule or koha.permission_modules.module or koha.permission_modules.permission_module_id
386
@PARAM3 Koha::Auth::Permission or koha.permissions.code or koha.permissions.permission_id or
387
                               '*' if we just need any permission for the given PermissionModule.
388
@RETURNS Boolean, true(1) if permission check succeeded. This is useful only when testing.
389
                  catch Exceptions if permission check fails.
390
@THROWS Koha::Exception::NoPermission, if Borrower is missing the permission.
391
                                       Exception tells which permission is missing.
392
=cut
393
394
sub hasPermission {
395
    my ($self, $borrower, $permissionModule, $permission) = @_;
396
397
    $borrower = Koha::Borrowers::castToBorrower($borrower);
398
    $permissionModule = Koha::Auth::PermissionModules::castToPermissionModule($permissionModule);
399
    $permission = Koha::Auth::Permissions::castToPermission($permission) unless $permission eq '*';
400
401
    my $error;
402
    if ($permission eq '*') {
403
        my $borrowerPermission = Koha::Auth::BorrowerPermissions->search({borrowernumber => $borrower->borrowernumber,
404
                                                 permission_module_id => $permissionModule->permission_module_id,
405
                                                })->next();
406
        return 1 if ($borrowerPermission);
407
        $error = "Borrower '".$borrower->borrowernumber."' lacks any permission under permission module '".$permissionModule->module."'.";
408
    }
409
    else {
410
        my $borrowerPermission = Koha::Auth::BorrowerPermissions->search({borrowernumber => $borrower->borrowernumber,
411
                                                 permission_module_id => $permissionModule->permission_module_id,
412
                                                 permission_id => $permission->permission_id,
413
                                                })->next();
414
        return 1 if ($borrowerPermission);
415
        $error = "Borrower '".$borrower->borrowernumber."' lacks permission module '".$permissionModule->module."' and permission '".$permission->code."'.";
416
    }
417
418
    return 2 if not($permissionModule->module eq 'superlibrarian') && $self->_isSuperuser($borrower);
419
    return 2 if not($permissionModule->module eq 'superlibrarian') && $self->_isSuperlibrarian($borrower);
420
    Koha::Exception::NoPermission->throw(error => $error);
421
}
422
423
sub _isSuperuser {
424
    my ($self, $borrower) = @_;
425
    $borrower = Koha::Borrowers::castToBorrower($borrower);
426
427
    if ( $borrower->userid eq C4::Context->config('user') ) {
428
        return 1;
429
    }
430
    elsif ( $borrower->userid eq 'demo' && C4::Context->config('demo') ) {
431
        return 1;
432
    }
433
    return 0;
434
}
435
436
sub _isSuperlibrarian {
437
    my ($self, $borrower) = @_;
438
439
    try {
440
        return $self->hasPermission($borrower, 'superlibrarian', 'superlibrarian');
441
    } catch {
442
        if (blessed($_) && $_->isa('Koha::Exception::NoPermission')) {
443
            return 0;
444
        }
445
        else {
446
            die $_;
447
        }
448
    };
449
}
450
451
1;
(-)a/Koha/Auth/PermissionModule.pm (+78 lines)
Line 0 Link Here
1
package Koha::Auth::PermissionModule;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use Koha::Auth::PermissionModules;
23
24
use Koha::Exception::BadParameter;
25
26
use base qw(Koha::Object);
27
28
sub type {
29
    return 'PermissionModule';
30
}
31
sub object_class {
32
    return 'Koha::Auth::PermissionModule';
33
}
34
35
sub new {
36
    my ($class, $params) = @_;
37
38
    _validateParams($params);
39
40
    my $self = Koha::Auth::PermissionModules->find({module => $params->{module}});
41
    $self = $class->SUPER::new() unless $self;
42
    $self->set($params);
43
    return $self;
44
}
45
46
sub _validateParams {
47
    my ($params) = @_;
48
49
    unless ($params->{description} && length $params->{description} > 0) {
50
        Koha::Exception::BadParameter->throw(error => "Koha::Auth::Permission->new():> Parameter 'description' isn't defined or is empty.");
51
    }
52
    unless ($params->{module} && length $params->{module} > 0) {
53
        Koha::Exception::BadParameter->throw(error => "Koha::Auth::Permission->new():> Parameter 'module' isn't defined or is empty.");
54
    }
55
}
56
57
=head getPermissions
58
59
    my $permissions = $permissionModule->getPermissions();
60
61
@RETURNS List of Koha::Auth::Permission-objects
62
=cut
63
64
sub getPermissions {
65
    my ($self) = @_;
66
67
    unless ($self->{params}->{permissions}) {
68
        $self->{params}->{permissions} = [];
69
        my @dbix_objects = $self->_result()->permissions;
70
        foreach my $dbix_object (@dbix_objects) {
71
            my $object = Koha::Auth::Permission->_new_from_dbic($dbix_object);
72
            push @{$self->{params}->{permissions}}, $object;
73
        }
74
    }
75
    return $self->{params}->{permissions};
76
}
77
78
1;
(-)a/Koha/Auth/PermissionModules.pm (+64 lines)
Line 0 Link Here
1
package Koha::Auth::PermissionModules;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Scalar::Util qw(blessed);
22
23
use Koha::Auth::PermissionModule;
24
25
use base qw(Koha::Objects);
26
27
sub type {
28
    return 'PermissionModule';
29
}
30
sub object_class {
31
    return 'Koha::Auth::PermissionModule';
32
}
33
34
sub castToPermissionModule {
35
    my ($input) = @_;
36
37
    unless ($input) {
38
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToPermissionModule():> No parameter given!");
39
    }
40
    if (blessed($input) && $input->isa('Koha::Auth::PermissionModule')) {
41
        return $input;
42
    }
43
    if (blessed($input) && $input->isa('Koha::Schema::Result::PermissionModule')) {
44
        return Koha::Auth::PermissionModule->_new_from_dbic($input);
45
    }
46
47
    my $permissionModule;
48
    if (not(ref($input))) { #We have a scalar
49
        $permissionModule = Koha::Auth::PermissionModules->search({'-or' => [{permission_module_id => $input},
50
                                                                           {module => $input},
51
                                                                          ]
52
                                                                })->next();
53
        unless ($permissionModule) {
54
            Koha::Exception::UnknownObject->throw(error => __PACKAGE__."::castToPermissionModule():> Cannot find an existing permissionModule with permission_module_id|module '$input'.");
55
        }
56
    }
57
    unless ($permissionModule) {
58
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToPermissionModule():> Cannot cast \$input '$input' to a PermissionModule-object.");
59
    }
60
61
    return $permissionModule;
62
}
63
64
1;
(-)a/Koha/Auth/Permissions.pm (+67 lines)
Line 0 Link Here
1
package Koha::Auth::Permissions;
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Scalar::Util qw(blessed);
22
23
use Koha::Auth::Permission;
24
25
use Koha::Exception::BadParameter;
26
use Koha::Exception::UnknownObject;
27
28
use base qw(Koha::Objects);
29
30
sub type {
31
    return 'Permissions';
32
}
33
sub object_class {
34
    return 'Koha::Auth::Permission';
35
}
36
37
sub castToPermission {
38
    my ($input) = @_;
39
40
    unless ($input) {
41
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToPermission():> No parameter given!");
42
    }
43
    if (blessed($input) && $input->isa('Koha::Auth::Permission')) {
44
        return $input;
45
    }
46
    if (blessed($input) && $input->isa('Koha::Schema::Result::Permission')) {
47
        return Koha::Auth::Permission->_new_from_dbic($input);
48
    }
49
50
    my $permission;
51
    if (not(ref($input))) { #We have a scalar
52
        $permission = Koha::Auth::Permissions->search({'-or' => [{permission_id => $input},
53
                                                                  {code => $input},
54
                                                                ]
55
                                                        })->next();
56
        unless ($permission) {
57
            Koha::Exception::UnknownObject->throw(error => __PACKAGE__."::castToPermission():> Cannot find an existing permission with permission_id|code '$input'.");
58
        }
59
    }
60
    unless ($permission) {
61
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::castToPermission():> Cannot cast \$input '$input' to a Permission-object.");
62
    }
63
64
    return $permission;
65
}
66
67
1;
(-)a/Koha/Schema/Result/Borrower.pm (-2 / +17 lines)
Lines 753-758 __PACKAGE__->has_many( Link Here
753
  { cascade_copy => 0, cascade_delete => 0 },
753
  { cascade_copy => 0, cascade_delete => 0 },
754
);
754
);
755
755
756
=head2 borrower_permissions
757
758
Type: has_many
759
760
Related object: L<Koha::Schema::Result::BorrowerPermission>
761
762
=cut
763
764
__PACKAGE__->has_many(
765
  "borrower_permissions",
766
  "Koha::Schema::Result::BorrowerPermission",
767
  { "foreign.borrowernumber" => "self.borrowernumber" },
768
  { cascade_copy => 0, cascade_delete => 0 },
769
);
770
756
=head2 borrower_syncs
771
=head2 borrower_syncs
757
772
758
Type: has_many
773
Type: has_many
Lines 1154-1161 Composing rels: L</aqorder_users> -> ordernumber Link Here
1154
__PACKAGE__->many_to_many("ordernumbers", "aqorder_users", "ordernumber");
1169
__PACKAGE__->many_to_many("ordernumbers", "aqorder_users", "ordernumber");
1155
1170
1156
1171
1157
# Created by DBIx::Class::Schema::Loader v0.07039 @ 2015-04-27 16:08:40
1172
# Created by DBIx::Class::Schema::Loader v0.07039 @ 2015-07-11 12:59:56
1158
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:Z50zYBD3Hqlv5/EnoLnyZw
1173
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:ZRxBjZb0KKxabonVI/2vjg
1159
1174
1160
1175
1161
# You can replace this text with custom content, and it will be preserved on regeneration
1176
# You can replace this text with custom content, and it will be preserved on regeneration
(-)a/installer/data/mysql/en/mandatory/userflags.sql (-20 / +20 lines)
Lines 1-21 Link Here
1
INSERT INTO userflags (bit, flag, flagdesc, defaulton) VALUES
1
INSERT INTO permission_modules (module, description) VALUES
2
(0,'superlibrarian','Access to all librarian functions',0),
2
('superlibrarian','Access to all librarian functions'),
3
(1,'circulate','Check out and check in items',0),
3
('circulate','Check out and check in items'),
4
(2,'catalogue','<b>Required for staff login.</b> Staff access, allows viewing of catalogue in staff client.',0),
4
('catalogue','<b>Required for staff login.</b> Staff access, allows viewing of catalogue in staff client.'),
5
(3,'parameters','Manage Koha system settings (Administration panel)',0),
5
('parameters','Manage Koha system settings (Administration panel)'),
6
(4,'borrowers','Add or modify patrons',0),
6
('borrowers','Add or modify patrons'),
7
(5,'permissions','Set user permissions',0),
7
('permissions','Set user permissions'),
8
(6,'reserveforothers','Place and modify holds for patrons',0),
8
('reserveforothers','Place and modify holds for patrons'),
9
(9,'editcatalogue','Edit catalog (Modify bibliographic/holdings data)',0),
9
('editcatalogue','Edit catalog (Modify bibliographic/holdings data)'),
10
(10,'updatecharges','Manage patrons fines and fees',0),
10
('updatecharges','Manage patrons fines and fees'),
11
(11,'acquisition','Acquisition and/or suggestion management',0),
11
('acquisition','Acquisition and/or suggestion management'),
12
(12,'management','Set library management parameters (deprecated)',0),
12
('management','Set library management parameters (deprecated)'),
13
(13,'tools','Use all tools (expand for granular tools permissions)',0),
13
('tools','Use all tools (expand for granular tools permissions)'),
14
(14,'editauthorities','Edit authorities',0),
14
('editauthorities','Edit authorities'),
15
(15,'serials','Manage serial subscriptions',0),
15
('serials','Manage serial subscriptions'),
16
(16,'reports','Allow access to the reports module',0),
16
('reports','Allow access to the reports module'),
17
(17,'staffaccess','Allow staff members to modify permissions for other staff members',0),
17
('staffaccess','Allow staff members to modify permissions for other staff members'),
18
(18,'coursereserves','Course reserves',0),
18
('coursereserves','Course reserves'),
19
(19, 'plugins', 'Koha plugins', '0'),
19
('plugins', 'Koha plugins'),
20
(20, 'lists', 'Lists', 0)
20
('lists', 'Lists')
21
;
21
;
(-)a/installer/data/mysql/en/mandatory/userpermissions.sql (-76 / +83 lines)
Lines 1-77 Link Here
1
INSERT INTO permissions (module_bit, code, description) VALUES
1
INSERT INTO permissions (module, code, description) VALUES
2
   ( 1, 'circulate_remaining_permissions', 'Remaining circulation permissions'),
2
   ( 'superlibrarian',  'superlibrarian', 'Access to all librarian functions'),
3
   ( 1, 'override_renewals', 'Override blocked renewals'),
3
   ( 'circulate',       'circulate_remaining_permissions', 'Remaining circulation permissions'),
4
   ( 1, 'overdues_report', 'Execute overdue items report'),
4
   ( 'circulate',       'override_renewals', 'Override blocked renewals'),
5
   ( 1, 'force_checkout', 'Force checkout if a limitation exists'),
5
   ( 'circulate',       'overdues_report', 'Execute overdue items report'),
6
   ( 1, 'manage_restrictions', 'Manage restrictions for accounts'),
6
   ( 'circulate',       'force_checkout', 'Force checkout if a limitation exists'),
7
   ( 3, 'parameters_remaining_permissions', 'Remaining system parameters permissions'),
7
   ( 'circulate',       'manage_restrictions', 'Manage restrictions for accounts'),
8
   ( 3, 'manage_circ_rules', 'manage circulation rules'),
8
   ( 'catalogue',       'staff_login', 'Allow staff login.'),
9
   ( 6, 'place_holds', 'Place holds for patrons'),
9
   ( 'parameters',      'parameters_remaining_permissions', 'Remaining system parameters permissions'),
10
   ( 6, 'modify_holds_priority', 'Modify holds priority'),
10
   ( 'parameters',      'manage_circ_rules', 'manage circulation rules'),
11
   ( 9, 'edit_catalogue', 'Edit catalog (Modify bibliographic/holdings data)'),
11
   ( 'borrowers',       'view_borrowers', 'Show borrower details and search for borrowers.'),
12
   ( 9, 'fast_cataloging', 'Fast cataloging'),
12
   ( 'permissions',     'set_permissions', 'Set user permissions'),
13
   ( 9, 'edit_items', 'Edit items'),
13
   ( 'reserveforothers','place_holds', 'Place holds for patrons'),
14
   ( 9, 'edit_items_restricted', 'Limit item modification to subfields defined in the SubfieldsToAllowForRestrictedEditing preference (please note that edit_item is still required)'),
14
   ( 'reserveforothers','modify_holds_priority', 'Modify holds priority'),
15
   ( 9, 'delete_all_items', 'Delete all items at once'),
15
   ( 'editcatalogue',   'edit_catalogue', 'Edit catalog (Modify bibliographic/holdings data)'),
16
   (10, 'writeoff', 'Write off fines and fees'),
16
   ( 'editcatalogue',   'fast_cataloging', 'Fast cataloging'),
17
   (10, 'remaining_permissions', 'Remaining permissions for managing fines and fees'),
17
   ( 'editcatalogue',   'edit_items', 'Edit items'),
18
   (11, 'vendors_manage', 'Manage vendors'),
18
   ( 'editcatalogue',   'edit_items_restricted', 'Limit item modification to subfields defined in the SubfieldsToAllowForRestrictedEditing preference (please note that edit_item is still required)'),
19
   (11, 'contracts_manage', 'Manage contracts'),
19
   ( 'editcatalogue',   'delete_all_items', 'Delete all items at once'),
20
   (11, 'period_manage', 'Manage periods'),
20
   ( 'updatecharges',   'writeoff', 'Write off fines and fees'),
21
   (11, 'budget_manage', 'Manage budgets'),
21
   ( 'updatecharges',   'remaining_permissions', 'Remaining permissions for managing fines and fees'),
22
   (11, 'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
22
   ( 'acquisition',     'vendors_manage', 'Manage vendors'),
23
   (11, 'planning_manage', 'Manage budget plannings'),
23
   ( 'acquisition',     'contracts_manage', 'Manage contracts'),
24
   (11, 'order_manage', 'Manage orders & basket'),
24
   ( 'acquisition',     'period_manage', 'Manage periods'),
25
   (11, 'order_manage_all', 'Manage all orders and baskets, regardless of restrictions on them'),
25
   ( 'acquisition',     'budget_manage', 'Manage budgets'),
26
   (11, 'group_manage', 'Manage orders & basketgroups'),
26
   ( 'acquisition',     'budget_modify', 'Modify budget (can''t create lines, but can modify existing ones)'),
27
   (11, 'order_receive', 'Manage orders & basket'),
27
   ( 'acquisition',     'planning_manage', 'Manage budget plannings'),
28
   (11, 'budget_add_del', 'Add and delete budgets (but can''t modify budgets)'),
28
   ( 'acquisition',     'order_manage', 'Manage orders & basket'),
29
   (11, 'budget_manage_all', 'Manage all budgets'),
29
   ( 'acquisition',     'order_manage_all', 'Manage all orders and baskets, regardless of restrictions on them'),
30
   (13, 'edit_news', 'Write news for the OPAC and staff interfaces'),
30
   ( 'acquisition',     'group_manage', 'Manage orders & basketgroups'),
31
   (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
31
   ( 'acquisition',     'order_receive', 'Manage orders & basket'),
32
   (13, 'edit_calendar', 'Define days when the library is closed'),
32
   ( 'acquisition',     'budget_add_del', 'Add and delete budgets (but can''t modify budgets)'),
33
   (13, 'moderate_comments', 'Moderate patron comments'),
33
   ( 'acquisition',     'budget_manage_all', 'Manage all budgets'),
34
   (13, 'edit_notices', 'Define notices'),
34
   ( 'management',      'management', 'Set library management parameters (deprecated)'),
35
   (13, 'edit_notice_status_triggers', 'Set notice/status triggers for overdue items'),
35
   ( 'tools',           'edit_news', 'Write news for the OPAC and staff interfaces'),
36
   (13, 'edit_quotes', 'Edit quotes for quote-of-the-day feature'),
36
   ( 'tools',           'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
37
   (13, 'view_system_logs', 'Browse the system logs'),
37
   ( 'tools',           'edit_calendar', 'Define days when the library is closed'),
38
   (13, 'inventory', 'Perform inventory (stocktaking) of your catalog'),
38
   ( 'tools',           'moderate_comments', 'Moderate patron comments'),
39
   (13, 'stage_marc_import', 'Stage MARC records into the reservoir'),
39
   ( 'tools',           'edit_notices', 'Define notices'),
40
   (13, 'manage_staged_marc', 'Managed staged MARC records, including completing and reversing imports'),
40
   ( 'tools',           'edit_notice_status_triggers', 'Set notice/status triggers for overdue items'),
41
   (13, 'export_catalog', 'Export bibliographic and holdings data'),
41
   ( 'tools',           'edit_quotes', 'Edit quotes for quote-of-the-day feature'),
42
   (13, 'import_patrons', 'Import patron data'),
42
   ( 'tools',           'view_system_logs', 'Browse the system logs'),
43
   (13, 'edit_patrons', 'Perform batch modification of patrons'),
43
   ( 'tools',           'inventory', 'Perform inventory (stocktaking) of your catalog'),
44
   (13, 'delete_anonymize_patrons', 'Delete old borrowers and anonymize circulation history (deletes borrower reading history)'),
44
   ( 'tools',           'stage_marc_import', 'Stage MARC records into the reservoir'),
45
   (13, 'batch_upload_patron_images', 'Upload patron images in a batch or one at a time'),
45
   ( 'tools',           'manage_staged_marc', 'Managed staged MARC records, including completing and reversing imports'),
46
   (13, 'schedule_tasks', 'Schedule tasks to run'),
46
   ( 'tools',           'export_catalog', 'Export bibliographic and holdings data'),
47
   (13, 'items_batchmod', 'Perform batch modification of items'),
47
   ( 'tools',           'import_patrons', 'Import patron data'),
48
   (13, 'items_batchmod_restricted', 'Limit batch item modification to subfields defined in the SubfieldsToAllowForRestrictedBatchmod preference (please note that items_batchmod is still required)'),
48
   ( 'tools',           'edit_patrons', 'Perform batch modification of patrons'),
49
   (13, 'items_batchdel', 'Perform batch deletion of items'),
49
   ( 'tools',           'delete_anonymize_patrons', 'Delete old borrowers and anonymize circulation history (deletes borrower reading history)'),
50
   (13, 'manage_csv_profiles', 'Manage CSV export profiles'),
50
   ( 'tools',           'batch_upload_patron_images', 'Upload patron images in a batch or one at a time'),
51
   (13, 'moderate_tags', 'Moderate patron tags'),
51
   ( 'tools',           'schedule_tasks', 'Schedule tasks to run'),
52
   (13, 'rotating_collections', 'Manage rotating collections'),
52
   ( 'tools',           'items_batchmod', 'Perform batch modification of items'),
53
   (13, 'upload_local_cover_images', 'Upload local cover images'),
53
   ( 'tools',           'items_batchmod_restricted', 'Limit batch item modification to subfields defined in the SubfieldsToAllowForRestrictedBatchmod preference (please note that items_batchmod is still required)'),
54
   (13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
54
   ( 'tools',           'items_batchdel', 'Perform batch deletion of items'),
55
   (13, 'records_batchmod', 'Perform batch modification of records (biblios or authorities)'),
55
   ( 'tools',           'manage_csv_profiles', 'Manage CSV export profiles'),
56
   (13, 'marc_modification_templates', 'Manage marc modification templates'),
56
   ( 'tools',           'moderate_tags', 'Moderate patron tags'),
57
   (13, 'records_batchdel', 'Perform batch deletion of records (bibliographic or authority)'),
57
   ( 'tools',           'rotating_collections', 'Manage rotating collections'),
58
   (15, 'check_expiration', 'Check the expiration of a serial'),
58
   ( 'tools',           'upload_local_cover_images', 'Upload local cover images'),
59
   (15, 'claim_serials', 'Claim missing serials'),
59
   ( 'tools',           'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
60
   (15, 'create_subscription', 'Create a new subscription'),
60
   ( 'tools',           'records_batchmod', 'Perform batch modification of records (biblios or authorities)'),
61
   (15, 'delete_subscription', 'Delete an existing subscription'),
61
   ( 'tools',           'marc_modification_templates', 'Manage marc modification templates'),
62
   (15, 'edit_subscription', 'Edit an existing subscription'),
62
   ( 'tools',           'records_batchdel', 'Perform batch deletion of records (bibliographic or authority)'),
63
   (15, 'receive_serials', 'Serials receiving'),
63
   ( 'editauthorities', 'edit_authorities', 'Edit authorities'),
64
   (15, 'renew_subscription', 'Renew a subscription'),
64
   ( 'serials',         'check_expiration', 'Check the expiration of a serial'),
65
   (15, 'routing', 'Routing'),
65
   ( 'serials',         'claim_serials', 'Claim missing serials'),
66
   (15, 'superserials', 'Manage subscriptions from any branch (only applies when IndependentBranches is used)'),
66
   ( 'serials',         'create_subscription', 'Create a new subscription'),
67
   (16, 'execute_reports', 'Execute SQL reports'),
67
   ( 'serials',         'delete_subscription', 'Delete an existing subscription'),
68
   (16, 'create_reports', 'Create SQL reports'),
68
   ( 'serials',         'edit_subscription', 'Edit an existing subscription'),
69
   (18, 'manage_courses', 'Add, edit and delete courses'),
69
   ( 'serials',         'receive_serials', 'Serials receiving'),
70
   (18, 'add_reserves', 'Add course reserves'),
70
   ( 'serials',         'renew_subscription', 'Renew a subscription'),
71
   (18, 'delete_reserves', 'Remove course reserves'),
71
   ( 'serials',         'routing', 'Routing'),
72
   (19, 'manage', 'Manage plugins ( install / uninstall )'),
72
   ( 'serials',         'superserials', 'Manage subscriptions from any branch (only applies when IndependentBranches is used)'),
73
   (19, 'tool', 'Use tool plugins'),
73
   ( 'reports',         'execute_reports', 'Execute SQL reports'),
74
   (19, 'report', 'Use report plugins'),
74
   ( 'reports',         'create_reports', 'Create SQL reports'),
75
   (19, 'configure', 'Configure plugins'),
75
   ( 'staffaccess',     'staff_access_permissions', 'Allow staff members to modify permissions for other staff members'),
76
   (20, 'delete_public_lists', 'Delete public lists')
76
   ( 'coursereserves',  'manage_courses', 'Add, edit and delete courses'),
77
   ( 'coursereserves',  'add_reserves', 'Add course reserves'),
78
   ( 'coursereserves',  'delete_reserves', 'Remove course reserves'),
79
   ( 'plugins',         'manage', 'Manage plugins ( install / uninstall )'),
80
   ( 'plugins',         'tool', 'Use tool plugins'),
81
   ( 'plugins',         'report', 'Use report plugins'),
82
   ( 'plugins',         'configure', 'Configure plugins'),
83
   ( 'lists',           'delete_public_lists', 'Delete public lists')
77
;
84
;
(-)a/installer/data/mysql/kohastructure.sql (-43 / +49 lines)
Lines 249-255 CREATE TABLE `borrowers` ( -- this table includes information about your patrons Link Here
249
  `ethnotes` varchar(255) default NULL, -- unused in Koha
249
  `ethnotes` varchar(255) default NULL, -- unused in Koha
250
  `sex` varchar(1) default NULL, -- patron/borrower's gender
250
  `sex` varchar(1) default NULL, -- patron/borrower's gender
251
  `password` varchar(60) default NULL, -- patron/borrower's encrypted password
251
  `password` varchar(60) default NULL, -- patron/borrower's encrypted password
252
  `flags` int(11) default NULL, -- will include a number associated with the staff member's permissions
253
  `userid` varchar(75) default NULL, -- patron/borrower's opac and/or staff client log in
252
  `userid` varchar(75) default NULL, -- patron/borrower's opac and/or staff client log in
254
  `opacnote` mediumtext, -- a note on the patron/borrower's account that is visible in the OPAC and staff client
253
  `opacnote` mediumtext, -- a note on the patron/borrower's account that is visible in the OPAC and staff client
255
  `contactnote` varchar(255) default NULL, -- a note related to the patron/borrower's alternate address
254
  `contactnote` varchar(255) default NULL, -- a note related to the patron/borrower's alternate address
Lines 2292-2310 CREATE TABLE `tags_index` ( -- a weighted list of all tags and where they are us Link Here
2292
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2291
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2293
2292
2294
--
2293
--
2295
-- Table structure for table `userflags`
2296
--
2297
2298
DROP TABLE IF EXISTS `userflags`;
2299
CREATE TABLE `userflags` (
2300
  `bit` int(11) NOT NULL default 0,
2301
  `flag` varchar(30) default NULL,
2302
  `flagdesc` varchar(255) default NULL,
2303
  `defaulton` int(11) default NULL,
2304
  PRIMARY KEY  (`bit`)
2305
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2306
2307
--
2308
-- Table structure for table `virtualshelves`
2294
-- Table structure for table `virtualshelves`
2309
--
2295
--
2310
2296
Lines 2485-2504 CREATE TABLE language_script_mapping ( Link Here
2485
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2471
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2486
2472
2487
--
2473
--
2488
-- Table structure for table `permissions`
2489
--
2490
2491
DROP TABLE IF EXISTS `permissions`;
2492
CREATE TABLE `permissions` (
2493
  `module_bit` int(11) NOT NULL DEFAULT 0,
2494
  `code` varchar(64) DEFAULT NULL,
2495
  `description` varchar(255) DEFAULT NULL,
2496
  PRIMARY KEY  (`module_bit`, `code`),
2497
  CONSTRAINT `permissions_ibfk_1` FOREIGN KEY (`module_bit`) REFERENCES `userflags` (`bit`)
2498
    ON DELETE CASCADE ON UPDATE CASCADE
2499
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2500
2501
--
2502
-- Table structure for table `serialitems`
2474
-- Table structure for table `serialitems`
2503
--
2475
--
2504
2476
Lines 2513-2533 CREATE TABLE `serialitems` ( Link Here
2513
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2485
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2514
2486
2515
--
2487
--
2516
-- Table structure for table `user_permissions`
2517
--
2518
2519
DROP TABLE IF EXISTS `user_permissions`;
2520
CREATE TABLE `user_permissions` (
2521
  `borrowernumber` int(11) NOT NULL DEFAULT 0,
2522
  `module_bit` int(11) NOT NULL DEFAULT 0,
2523
  `code` varchar(64) DEFAULT NULL,
2524
  CONSTRAINT `user_permissions_ibfk_1` FOREIGN KEY (`borrowernumber`) REFERENCES `borrowers` (`borrowernumber`)
2525
    ON DELETE CASCADE ON UPDATE CASCADE,
2526
  CONSTRAINT `user_permissions_ibfk_2` FOREIGN KEY (`module_bit`, `code`) REFERENCES `permissions` (`module_bit`, `code`)
2527
    ON DELETE CASCADE ON UPDATE CASCADE
2528
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2529
2530
--
2531
-- Table structure for table `tmp_holdsqueue`
2488
-- Table structure for table `tmp_holdsqueue`
2532
--
2489
--
2533
2490
Lines 3362-3367 CREATE TABLE IF NOT EXISTS `borrower_modifications` ( Link Here
3362
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
3319
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
3363
3320
3364
--
3321
--
3322
-- Table structure for table permissions
3323
--
3324
3325
DROP TABLE IF EXISTS permissions;
3326
CREATE TABLE permissions (
3327
  permission_id int(11) NOT NULL auto_increment,
3328
  module varchar(32) NOT NULL,
3329
  code varchar(64) NOT NULL,
3330
  description varchar(255) DEFAULT NULL,
3331
  PRIMARY KEY  (permission_id),
3332
  UNIQUE KEY (code),
3333
  CONSTRAINT permissions_to_modules_ibfk1 FOREIGN KEY (module) REFERENCES permission_modules (module)
3334
    ON DELETE CASCADE ON UPDATE CASCADE
3335
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
3336
3337
--
3338
-- Table structure for table permission_modules
3339
--
3340
3341
DROP TABLE IF EXISTS permission_modules;
3342
CREATE TABLE permission_modules (
3343
  permission_module_id int(11) NOT NULL auto_increment,
3344
  module varchar(32) NOT NULL,
3345
  description varchar(255) DEFAULT NULL,
3346
  PRIMARY KEY  (permission_module_id),
3347
  UNIQUE KEY (module)
3348
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
3349
3350
--
3351
-- Table structure for table borrower_permissions
3352
--
3353
3354
DROP TABLE IF EXISTS borrower_permissions;
3355
CREATE TABLE borrower_permissions (
3356
  borrower_permission_id int(11) NOT NULL auto_increment,
3357
  borrowernumber int(11) NOT NULL,
3358
  permission_module_id int(11) NOT NULL,
3359
  permission_id int(11) NOT NULL,
3360
  PRIMARY KEY  (borrower_permission_id),
3361
  UNIQUE KEY (borrowernumber, permission_module_id, permission_id),
3362
  CONSTRAINT borrower_permissions_ibfk_1 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber)
3363
    ON DELETE CASCADE ON UPDATE CASCADE,
3364
  CONSTRAINT borrower_permissions_ibfk_2 FOREIGN KEY (permission_id) REFERENCES permissions (permission_id)
3365
    ON DELETE CASCADE ON UPDATE CASCADE,
3366
  CONSTRAINT borrower_permissions_ibfk_3 FOREIGN KEY (permission_module_id) REFERENCES permission_modules (permission_module_id)
3367
    ON DELETE CASCADE ON UPDATE CASCADE
3368
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
3369
3370
--
3365
-- Table structure for table linktracker
3371
-- Table structure for table linktracker
3366
-- This stores clicks to external links
3372
-- This stores clicks to external links
3367
--
3373
--
(-)a/installer/data/mysql/updatedatabase.pl (+145 lines)
Lines 7823-7828 if ( CheckVersion($DBversion) ) { Link Here
7823
    SetVersion($DBversion);
7823
    SetVersion($DBversion);
7824
}
7824
}
7825
7825
7826
$DBversion = "3.15.00.XXX";
7827
if ( CheckVersion($DBversion) ) {
7828
    my @borrowerPermissions = $schema->resultset('BorrowerPermissions')->search({limit => 1});
7829
    if (scalar(@borrowerPermissions)) {
7830
        print "Upgrade to $DBversion ALREADY DONE?!? (Bug XXX: Permissions rewrite)\n";
7831
    }
7832
    else {
7833
        ##CREATE new TABLEs
7834
        ##CREATing instead of ALTERing existing tables because this way the changes are more easy to understand.
7835
        $dbh->do("CREATE TABLE permission_modules (
7836
                    permission_module_id int(11) NOT NULL auto_increment,
7837
                    module varchar(32) NOT NULL,
7838
                    description varchar(255) DEFAULT NULL,
7839
                    PRIMARY KEY  (permission_module_id),
7840
                    UNIQUE KEY (module)
7841
                  ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
7842
        $dbh->do("INSERT INTO permission_modules (permission_module_id, module, description) SELECT bit, flag, flagdesc FROM userflags WHERE bit != 0;"); #superlibrarian causes primary key conflict
7843
        $dbh->do("INSERT INTO permission_modules (permission_module_id, module, description) SELECT 21, flag, flagdesc FROM userflags WHERE bit = 0;");   #So add him by himself.
7844
7845
        $dbh->do("CREATE TABLE permissions2 (
7846
                    permission_id int(11) NOT NULL auto_increment,
7847
                    module varchar(32) NOT NULL,
7848
                    code varchar(64) NOT NULL,
7849
                    description varchar(255) DEFAULT NULL,
7850
                    PRIMARY KEY  (permission_id),
7851
                    UNIQUE KEY (code),
7852
                    CONSTRAINT permissions_to_modules_ibfk1 FOREIGN KEY (module) REFERENCES permission_modules (module)
7853
                      ON DELETE CASCADE ON UPDATE CASCADE
7854
                  ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
7855
        $dbh->do("INSERT INTO permissions2 (module, code, description)
7856
                    SELECT userflags.flag, code, description FROM permissions
7857
                      LEFT JOIN userflags ON permissions.module_bit = userflags.bit;");
7858
7859
        $dbh->do("CREATE TABLE borrower_permissions (
7860
                    borrower_permission_id int(11) NOT NULL auto_increment,
7861
                    borrowernumber int(11) NOT NULL,
7862
                    permission_module_id int(11) NOT NULL,
7863
                    permission_id int(11) NOT NULL,
7864
                    PRIMARY KEY  (borrower_permission_id),
7865
                    UNIQUE KEY (borrowernumber, permission_module_id, permission_id),
7866
                    CONSTRAINT borrower_permissions_ibfk_1 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber)
7867
                      ON DELETE CASCADE ON UPDATE CASCADE,
7868
                    CONSTRAINT borrower_permissions_ibfk_2 FOREIGN KEY (permission_id) REFERENCES permissions2 (permission_id)
7869
                      ON DELETE CASCADE ON UPDATE CASCADE,
7870
                    CONSTRAINT borrower_permissions_ibfk_3 FOREIGN KEY (permission_module_id) REFERENCES permission_modules (permission_module_id)
7871
                      ON DELETE CASCADE ON UPDATE CASCADE
7872
                  ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
7873
        $dbh->do("INSERT INTO borrower_permissions (borrowernumber, permission_module_id, permission_id)
7874
                    SELECT borrowernumber, user_permissions.module_bit, permissions2.permission_id FROM user_permissions
7875
                    LEFT JOIN permissions2 ON user_permissions.code = permissions2.code;");
7876
7877
        ##Add subpermissions to the stand-alone modules (modules with no subpermissions)
7878
        use Koha::Auth::PermissionManager;
7879
        my $permissionManager = Koha::Auth::PermissionManager->new();
7880
        $permissionManager->addPermission({module => 'superlibrarian', code => 'superlibrarian', description => 'Access to all librarian functions.'});
7881
        $permissionManager->addPermission({module => 'catalogue', code => 'staff_login', description => 'Allow staff login.'});
7882
        $permissionManager->addPermission({module => 'borrowers', code => 'view_borrowers', description => 'Show borrower details and search for borrowers.'});
7883
        $permissionManager->addPermission({module => 'permissions', code => 'set_permissions', description => 'Set user permissions.'});
7884
        $permissionManager->addPermission({module => 'management', code => 'management', description => 'Set library management parameters (deprecated).'});
7885
        $permissionManager->addPermission({module => 'editauthorities', code => 'edit_authorities', description => 'Edit authorities.'});
7886
        $permissionManager->addPermission({module => 'staffaccess', code => 'staff_access_permissions', description => 'Allow staff members to modify permissions for other staff members.'});
7887
7888
        ##Create borrower_permissions to replace singular userflags from borrowers.flags.
7889
        use Koha::Borrowers;
7890
        my @borrowers = Koha::Borrowers->search({});
7891
        foreach my $b (@borrowers) {
7892
            next unless $b->flags;
7893
            if ( ( $b->flags & ( 2**0 ) ) ) {
7894
                $permissionManager->grantPermission($b, 'superlibrarian', 'superlibrarian');
7895
            }
7896
            if ( ( $b->flags & ( 2**2 ) ) ) {
7897
                $permissionManager->grantPermission($b, 'catalogue', 'staff_login');
7898
            }
7899
            if ( ( $b->flags & ( 2**4 ) ) ) {
7900
                $permissionManager->grantPermission($b, 'borrowers', 'view_borrowers');
7901
            }
7902
            if ( ( $b->flags & ( 2**5 ) ) ) {
7903
                $permissionManager->grantPermission($b, 'permissions', 'set_permissions');
7904
            }
7905
            if ( ( $b->flags & ( 2**12 ) ) ) {
7906
                $permissionManager->grantPermission($b, 'management', 'management');
7907
            }
7908
            if ( ( $b->flags & ( 2**14 ) ) ) {
7909
                $permissionManager->grantPermission($b, 'editauthorities', 'edit_authorities');
7910
            }
7911
            if ( ( $b->flags & ( 2**17 ) ) ) {
7912
                $permissionManager->grantPermission($b, 'staffaccess', 'staff_access_permissions');
7913
            }
7914
        }
7915
7916
        ##Cleanup redundant tables.
7917
        $dbh->do("DELETE FROM userflags"); #Cascades to other tables.
7918
        $dbh->do("DROP TABLE user_permissions");
7919
        $dbh->do("DROP TABLE permissions");
7920
        $dbh->do("DROP TABLE userflags");
7921
        $dbh->do("ALTER TABLE permissions2 RENAME TO permissions");
7922
7923
        print "Upgrade to $DBversion done (Bug XXX: Permissions rewrite)\n";
7924
        SetVersion($DBversion);
7925
    }
7926
}
7927
7826
$DBversion = "3.15.00.002";
7928
$DBversion = "3.15.00.002";
7827
if(CheckVersion($DBversion)) {
7929
if(CheckVersion($DBversion)) {
7828
    $dbh->do("ALTER TABLE deleteditems MODIFY materials text;");
7930
    $dbh->do("ALTER TABLE deleteditems MODIFY materials text;");
Lines 10585-10590 if ( CheckVersion($DBversion) ) { Link Here
10585
    SetVersion ($DBversion);
10687
    SetVersion ($DBversion);
10586
}
10688
}
10587
10689
10690
$DBversion = "XXX";
10691
if(CheckVersion($DBversion)) {
10692
    $dbh->do(q{
10693
        DROP TABLE IF EXISTS api_keys;
10694
    });
10695
    $dbh->do(q{
10696
        CREATE TABLE api_keys (
10697
            borrowernumber int(11) NOT NULL,
10698
            api_key VARCHAR(255) NOT NULL,
10699
            active int(1) DEFAULT 1,
10700
            PRIMARY KEY (borrowernumber, api_key),
10701
            CONSTRAINT api_keys_fk_borrowernumber
10702
              FOREIGN KEY (borrowernumber)
10703
              REFERENCES borrowers (borrowernumber)
10704
              ON DELETE CASCADE ON UPDATE CASCADE
10705
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
10706
    });
10707
10708
    print "Upgrade to $DBversion done (Bug 13920: Add API keys table)\n";
10709
    SetVersion($DBversion);
10710
}
10711
10712
$DBversion = "XXX";
10713
if(CheckVersion($DBversion)) {
10714
    $dbh->do(q{
10715
        DROP TABLE IF EXISTS api_timestamps;
10716
    });
10717
    $dbh->do(q{
10718
        CREATE TABLE api_timestamps (
10719
            borrowernumber int(11) NOT NULL,
10720
            timestamp bigint,
10721
            PRIMARY KEY (borrowernumber),
10722
            CONSTRAINT api_timestamps_fk_borrowernumber
10723
              FOREIGN KEY (borrowernumber)
10724
              REFERENCES borrowers (borrowernumber)
10725
              ON DELETE CASCADE ON UPDATE CASCADE
10726
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
10727
    });
10728
10729
    print "Upgrade to $DBversion done (Bug 13920: Add API timestamps table)\n";
10730
    SetVersion($DBversion);
10731
}
10732
10588
$DBversion = "3.21.00.008";
10733
$DBversion = "3.21.00.008";
10589
if ( CheckVersion($DBversion) ) {
10734
if ( CheckVersion($DBversion) ) {
10590
    $dbh->do(q{
10735
    $dbh->do(q{
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt (-5 / +5 lines)
Lines 9-31 Link Here
9
        $("#permissionstree").treeview({animated: "fast", collapsed: true});
9
        $("#permissionstree").treeview({animated: "fast", collapsed: true});
10
10
11
        // Enforce Superlibrarian Privilege Mutual Exclusivity
11
        // Enforce Superlibrarian Privilege Mutual Exclusivity
12
        if($('input[id="flag-0"]:checked').length){
12
        if($('input[id="flag-superlibrarian"]:checked').length){
13
            if ($('input[name="flag"]:checked').length > 1){
13
            if ($('input[name="flag"]:checked').length > 1){
14
                alert('Inconsistency Detected!\n\nThe superlibrarian privilege is mutually exclusive of other privileges, as it includes them all.\n\nThis patron\'s privileges will now be reset to include only superlibrarian.');
14
                alert('Inconsistency Detected!\n\nThe superlibrarian privilege is mutually exclusive of other privileges, as it includes them all.\n\nThis patron\'s privileges will now be reset to include only superlibrarian.');
15
            }
15
            }
16
16
17
            $('input[name="flag"]').each(function() {
17
            $('input[name="flag"]').each(function() {
18
                if($(this).attr('id') != "flag-0"){
18
                if($(this).attr('id') != "flag-superlibrarian"){
19
                    $(this).attr('disabled', 'disabled');
19
                    $(this).attr('disabled', 'disabled');
20
                    $(this).removeAttr('checked', 'checked');
20
                    $(this).removeAttr('checked', 'checked');
21
                }
21
                }
22
            });
22
            });
23
        }
23
        }
24
24
25
        $('input#flag-0').click(function() {
25
        $('input#flag-superlibrarian').click(function() {
26
            if($('input[id="flag-0"]:checked').length){
26
            if($('input[id="flag-superlibrarian"]:checked').length){
27
                $('input[name="flag"]').each(function() {
27
                $('input[name="flag"]').each(function() {
28
                    if($(this).attr('id') != "flag-0"){
28
                    if($(this).attr('id') != "flag-superlibrarian"){
29
                        $(this).attr('disabled', 'disabled');
29
                        $(this).attr('disabled', 'disabled');
30
                        $(this).removeAttr('checked', 'checked');
30
                        $(this).removeAttr('checked', 'checked');
31
                    }
31
                    }
(-)a/members/member-flags.pl (-99 / +95 lines)
Lines 14-20 use C4::Context; Link Here
14
use C4::Members;
14
use C4::Members;
15
use C4::Branch;
15
use C4::Branch;
16
use C4::Members::Attributes qw(GetBorrowerAttributes);
16
use C4::Members::Attributes qw(GetBorrowerAttributes);
17
#use C4::Acquisitions;
17
use Koha::Auth::PermissionManager;
18
19
use Koha::Exception::BadParameter;
18
20
19
use C4::Output;
21
use C4::Output;
20
22
Lines 35-155 my ($template, $loggedinuser, $cookie) = get_template_and_user({ Link Here
35
        debug           => 1,
37
        debug           => 1,
36
});
38
});
37
39
38
40
my $permissionManager = Koha::Auth::PermissionManager->new();
39
my %member2;
41
my %member2;
40
$member2{'borrowernumber'}=$member;
42
$member2{'borrowernumber'}=$member;
41
43
42
if ($input->param('newflags')) {
44
if ($input->param('newflags')) {
43
    my $dbh=C4::Context->dbh();
45
    my $dbh=C4::Context->dbh();
44
46
47
	#Cast CGI-params into a permissions HASH.
45
    my @perms = $input->param('flag');
48
    my @perms = $input->param('flag');
46
    my %all_module_perms = ();
47
    my %sub_perms = ();
49
    my %sub_perms = ();
48
    foreach my $perm (@perms) {
50
    foreach my $perm (@perms) {
49
        if ($perm !~ /:/) {
51
		if ($perm eq 'superlibrarian') {
50
            $all_module_perms{$perm} = 1;
52
			$sub_perms{superlibrarian}->{superlibrarian} = 1;
53
		}
54
        elsif ($perm !~ /:/) {
55
            #DEPRECATED, GUI still sends the module flags here even though they have been removed from the DB.
51
        } else {
56
        } else {
52
            my ($module, $sub_perm) = split /:/, $perm, 2;
57
            my ($module, $sub_perm) = split /:/, $perm, 2;
53
            push @{ $sub_perms{$module} }, $sub_perm;
58
            $sub_perms{$module}->{$sub_perm} = 1;
54
        }
59
        }
55
    }
60
    }
56
61
57
    # construct flags
62
	$permissionManager->revokeAllPermissions($member);
58
    my $module_flags = 0;
63
	$permissionManager->grantPermissions($member, \%sub_perms);
59
    my $sth=$dbh->prepare("SELECT bit,flag FROM userflags ORDER BY bit");
64
60
    $sth->execute();
61
    while (my ($bit, $flag) = $sth->fetchrow_array) {
62
        if (exists $all_module_perms{$flag}) {
63
            $module_flags += 2**$bit;
64
        }
65
    }
66
    
67
    $sth = $dbh->prepare("UPDATE borrowers SET flags=? WHERE borrowernumber=?");
68
    $sth->execute($module_flags, $member);
69
    
70
    # deal with subpermissions
71
    $sth = $dbh->prepare("DELETE FROM user_permissions WHERE borrowernumber = ?");
72
    $sth->execute($member); 
73
    $sth = $dbh->prepare("INSERT INTO user_permissions (borrowernumber, module_bit, code)
74
                        SELECT ?, bit, ?
75
                        FROM userflags
76
                        WHERE flag = ?");
77
    foreach my $module (keys %sub_perms) {
78
        next if exists $all_module_perms{$module};
79
        foreach my $sub_perm (@{ $sub_perms{$module} }) {
80
            $sth->execute($member, $sub_perm, $module);
81
        }
82
    }
83
    
84
    print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member");
65
    print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member");
85
} else {
66
} else {
86
#     my ($bor,$flags,$accessflags)=GetMemberDetails($member,'');
67
    my $all_perms  = $permissionManager->listKohaPermissionsAsHASH();
87
    my $flags = $bor->{'flags'};
68
    my $user_perms = $permissionManager->getBorrowerPermissions($member);
88
    my $accessflags = $bor->{'authflags'};
69
89
    my $dbh=C4::Context->dbh();
70
	$all_perms = markBorrowerGrantedPermissions($all_perms, $user_perms);
90
    my $all_perms  = get_all_subpermissions();
71
91
    my $user_perms = get_user_subpermissions($bor->{'userid'});
92
    my $sth=$dbh->prepare("SELECT bit,flag,flagdesc FROM userflags ORDER BY bit");
93
    $sth->execute;
94
    my @loop;
72
    my @loop;
95
    while (my ($bit, $flag, $flagdesc) = $sth->fetchrow) {
73
	#Make sure the superlibrarian module is always on top.
96
	    my $checked='';
74
	push @loop, preparePermissionModuleForDisplay($all_perms, 'superlibrarian');
97
	    if ($accessflags->{$flag}) {
75
    foreach my $module (sort(keys(%$all_perms))) {
98
	        $checked= 1;
76
		push @loop, preparePermissionModuleForDisplay($all_perms, $module) unless $module eq 'superlibrarian';
99
	    }
100
101
	    my %row = ( bit => $bit,
102
		    flag => $flag,
103
		    checked => $checked,
104
		    flagdesc => $flagdesc );
105
106
        my @sub_perm_loop = ();
107
        my $expand_parent = 0;
108
        if ($checked) {
109
            if (exists $all_perms->{$flag}) {
110
                $expand_parent = 1;
111
                foreach my $sub_perm (sort keys %{ $all_perms->{$flag} }) {
112
                    push @sub_perm_loop, {
113
                        id => "${flag}_$sub_perm",
114
                        perm => "$flag:$sub_perm",
115
                        code => $sub_perm,
116
                        description => $all_perms->{$flag}->{$sub_perm},
117
                        checked => 1
118
                    };
119
                }
120
            }
121
        } else {
122
            if (exists $user_perms->{$flag}) {
123
                $expand_parent = 1;
124
                # put selected ones first
125
                foreach my $sub_perm (sort keys %{ $user_perms->{$flag} }) {
126
                    push @sub_perm_loop, {
127
                        id => "${flag}_$sub_perm",
128
                        perm => "$flag:$sub_perm",
129
                        code => $sub_perm,
130
                        description => $all_perms->{$flag}->{$sub_perm},
131
                        checked => 1
132
                    };
133
                }
134
            }
135
            # then ones not selected
136
            if (exists $all_perms->{$flag}) {
137
                foreach my $sub_perm (sort keys %{ $all_perms->{$flag} }) {
138
                    push @sub_perm_loop, {
139
                        id => "${flag}_$sub_perm",
140
                        perm => "$flag:$sub_perm",
141
                        code => $sub_perm,
142
                        description => $all_perms->{$flag}->{$sub_perm},
143
                        checked => 0
144
                    } unless exists $user_perms->{$flag} and exists $user_perms->{$flag}->{$sub_perm};
145
                }
146
            }
147
        }
148
        $row{expand} = $expand_parent;
149
        if ($#sub_perm_loop > -1) {
150
            $row{sub_perm_loop} = \@sub_perm_loop;
151
        }
152
	    push @loop, \%row;
153
    }
77
    }
154
78
155
    if ( $bor->{'category_type'} eq 'C') {
79
    if ( $bor->{'category_type'} eq 'C') {
Lines 206-208 $template->param( Link Here
206
    output_html_with_http_headers $input, $cookie, $template->output;
130
    output_html_with_http_headers $input, $cookie, $template->output;
207
131
208
}
132
}
133
134
=head markBorrowerGrantedPermissions
135
136
Adds a 'checked'-value for all subpermissions in the all-Koha-Permissions-list
137
that the current borrower has been granted.
138
@PARAM1 HASHRef of all Koha permissions and modules.
139
@PARAM1 ARRAYRef of all the granted Koha::Auth::BorrowerPermission-objects.
140
@RETURNS @PARAM1, slightly checked.
141
=cut
142
143
sub markBorrowerGrantedPermissions {
144
	my ($all_perms, $user_perms) = @_;
145
146
	foreach my $borrowerPermission (@$user_perms) {
147
		my $module = $borrowerPermission->getPermissionModule->module;
148
		my $code   = $borrowerPermission->getPermission->code;
149
		$all_perms->{$module}->{permissions}->{$code}->{checked} = 1;
150
	}
151
	return $all_perms;
152
}
153
154
=head checkIfAllModulePermissionsGranted
155
156
@RETURNS Boolean, 1 if all permissions granted.
157
=cut
158
159
sub checkIfAllModulePermissionsGranted {
160
	my ($moduleHash) = @_;
161
	foreach my $code (keys(%{$moduleHash->{permissions}})) {
162
		unless ($moduleHash->{permissions}->{$code}->{checked}) {
163
			return 0;
164
		}
165
	}
166
	return 1;
167
}
168
169
sub preparePermissionModuleForDisplay {
170
	my ($all_perms, $module) = @_;
171
172
	my $moduleHash = $all_perms->{$module};
173
	my $checked = checkIfAllModulePermissionsGranted($moduleHash);
174
175
	my %row = (
176
		bit => $module,
177
		flag => $module,
178
		checked => $checked,
179
		flagdesc => $moduleHash->{description} );
180
181
	my @sub_perm_loop = ();
182
	my $expand_parent = 0;
183
184
	if ($module ne 'superlibrarian') {
185
		foreach my $sub_perm (sort keys %{ $all_perms->{$module}->{permissions} }) {
186
			my $sub_perm_checked = $all_perms->{$module}->{permissions}->{$sub_perm}->{checked};
187
			$expand_parent = 1 if $sub_perm_checked;
188
189
			push @sub_perm_loop, {
190
				id => "${module}_$sub_perm",
191
				perm => "$module:$sub_perm",
192
				code => $sub_perm,
193
				description => $all_perms->{$module}->{permissions}->{$sub_perm}->{description},
194
				checked => $sub_perm_checked || 0,
195
			};
196
		}
197
198
		$row{expand} = $expand_parent;
199
		if ($#sub_perm_loop > -1) {
200
			$row{sub_perm_loop} = \@sub_perm_loop;
201
		}
202
	}
203
	return \%row;
204
}
(-)a/t/db_dependent/Koha/Auth/BorrowerPermission.t (+102 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Test::More;
22
23
use Koha::Auth::BorrowerPermission;
24
use Koha::Auth::BorrowerPermissions;
25
26
use t::db_dependent::TestObjects::ObjectFactory;
27
use t::db_dependent::TestObjects::Borrowers::BorrowerFactory;
28
29
##Setting up the test context
30
my $testContext = {};
31
32
my $borrowerFactory = t::db_dependent::TestObjects::Borrowers::BorrowerFactory->new();
33
my $borrowers = $borrowerFactory->createTestGroup([
34
            {firstname  => 'Olli-Antti',
35
             surname    => 'Kivi',
36
             cardnumber => '1A01',
37
             branchcode => 'CPL',
38
            },
39
            {firstname  => 'Alli-Ontti',
40
             surname    => 'Ivik',
41
             cardnumber => '1A02',
42
             branchcode => 'CPL',
43
            },
44
        ], undef, $testContext);
45
46
##Test context set, starting testing:
47
eval { #run in a eval-block so we don't die without tearing down the test context
48
    ##Basic id-based creation.
49
    my $borrowerPermissionById = Koha::Auth::BorrowerPermission->new({borrowernumber => $borrowers->{'1A01'}->{borrowernumber}, permission_module_id => 1, permission_id => 1});
50
    $borrowerPermissionById->store();
51
    my @borrowerPermissionById = Koha::Auth::BorrowerPermissions->search({borrowernumber => $borrowers->{'1A01'}->{borrowernumber}});
52
    is(scalar(@borrowerPermissionById), 1, "BorrowerPermissions, id-based creation:> Borrower has only one permission");
53
    is($borrowerPermissionById[0]->permission_module_id, 1, "BorrowerPermissions, id-based creation:> Same permission_module_id");
54
    is($borrowerPermissionById[0]->permission_id, 1, "BorrowerPermissions, id-based creation:> Same permission_id");
55
56
    ##Basic name-based creation.
57
    my $borrowerPermissionByName = Koha::Auth::BorrowerPermission->new({borrowernumber => $borrowers->{'1A02'}->{borrowernumber}, permissionModule => 'circulate', permission => 'manage_restrictions'});
58
    $borrowerPermissionByName->store();
59
    my @borrowerPermissionByName = Koha::Auth::BorrowerPermissions->search({borrowernumber => $borrowers->{'1A02'}->{borrowernumber}});
60
    is(scalar(@borrowerPermissionByName), 1, "BorrowerPermissions, name-based creation:> Borrower has only one permission");
61
    is($borrowerPermissionByName[0]->getPermissionModule->module, 'circulate', "BorrowerPermissions, name-based creation:> Same permission_module");
62
    is($borrowerPermissionByName[0]->getPermission->code, 'manage_restrictions', "BorrowerPermissions, name-based creation:> Same permission");
63
64
    ##Testing setter/getter for Borrower
65
    my $borrower1A01 = $borrowerPermissionById->getBorrower();
66
    is($borrower1A01->cardnumber, "1A01", "BorrowerPermissions, setter/getter:> getBorrower() 1A01");
67
    my $borrower1A02 = $borrowerPermissionByName->getBorrower();
68
    is($borrower1A02->cardnumber, "1A02", "BorrowerPermissions, setter/getter:> getBorrower() 1A02");
69
70
    $borrowerPermissionById->setBorrower($borrower1A02);
71
    is($borrowerPermissionById->getBorrower()->cardnumber, "1A02", "BorrowerPermissions, setter/getter:> setBorrower() 1A02");
72
    $borrowerPermissionByName->setBorrower($borrower1A01);
73
    is($borrowerPermissionByName->getBorrower()->cardnumber, "1A01", "BorrowerPermissions, setter/getter:> setBorrower() 1A01");
74
75
    ##Testing getter for PermissionModule
76
    my $permissionModule1 = $borrowerPermissionById->getPermissionModule();
77
    is($permissionModule1->permission_module_id, 1, "BorrowerPermissions, setter/getter:> getPermissionModule() 1");
78
    my $permissionModuleCirculate = $borrowerPermissionByName->getPermissionModule();
79
    is($permissionModuleCirculate->module, "circulate", "BorrowerPermissions, setter/getter:> getPermissionModule() circulate");
80
81
    #Not testing setters because changing the module might not make any sense.
82
    #Then we would need to make sure we dont end up with bad permissionModule->permission combinations.
83
84
    ##Testing getter for Permission
85
    my $permission1 = $borrowerPermissionById->getPermission();
86
    is($permission1->permission_id, 1, "BorrowerPermissions, setter/getter:> getPermission() 1");
87
    my $permissionManage_restrictions = $borrowerPermissionByName->getPermission();
88
    is($permissionManage_restrictions->code, "manage_restrictions", "BorrowerPermissions, setter/getter:> getPermission() manage_restrictions");
89
};
90
if ($@) { #Catch all leaking errors and gracefully terminate.
91
    warn $@;
92
    tearDown();
93
    exit 1;
94
}
95
96
##All tests done, tear down test context
97
$borrowerFactory->tearDownTestContext($testContext);
98
done_testing;
99
100
sub tearDown {
101
    t::db_dependent::TestObjects::ObjectFactory->tearDownTestContext($testContext);
102
}
(-)a/t/db_dependent/Koha/Auth/PermissionManager.t (+221 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2015 Vaara-kirjastot
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
use Test::More;
22
use Try::Tiny;
23
use Scalar::Util qw(blessed);
24
25
use Koha::Auth::PermissionManager;
26
27
use t::db_dependent::TestObjects::ObjectFactory;
28
use t::db_dependent::TestObjects::Borrowers::BorrowerFactory;
29
30
31
##Setting up the test context
32
my $testContext = {};
33
34
my $borrowerFactory = t::db_dependent::TestObjects::Borrowers::BorrowerFactory->new();
35
my $borrowers = $borrowerFactory->createTestGroup([
36
            {firstname  => 'Olli-Antti',
37
             surname    => 'Kivi',
38
             cardnumber => '1A01',
39
             branchcode => 'CPL',
40
            },
41
            {firstname  => 'Alli-Ontti',
42
             surname    => 'Ivik',
43
             cardnumber => '1A02',
44
             branchcode => 'CPL',
45
            },
46
        ], undef, $testContext);
47
48
##Test context set, starting testing:
49
eval { #run in a eval-block so we don't die without tearing down the test context
50
    my $permissionManager = Koha::Auth::PermissionManager->new();
51
    my ($permissionModule, $permission, $failureCaughtFlag, $permissionsList);
52
53
    ##Test getBorrowerPermissions
54
    $permissionManager->grantPermission($borrowers->{'1A01'}, 'circulate', 'force_checkout');
55
    $permissionManager->grantPermission($borrowers->{'1A01'}, 'circulate', 'manage_restrictions');
56
    $permissionsList = $permissionManager->getBorrowerPermissions($borrowers->{'1A01'});
57
    is($permissionsList->[0]->getPermission->code, 'force_checkout', "PermissionManager, getBorrowerPermissions:> Check 1.");
58
    is($permissionsList->[1]->getPermission->code, 'manage_restrictions', "PermissionManager, getBorrowerPermissions:> Check 2.");
59
    $permissionManager->revokePermission($borrowers->{'1A01'}, 'circulate', 'force_checkout');
60
    $permissionManager->revokePermission($borrowers->{'1A01'}, 'circulate', 'manage_restrictions');
61
62
    ##Test grantPermissions && revokeAllPermissions
63
    $permissionManager->grantPermissions($borrowers->{'1A01'},
64
                                         {  borrowers => 'view_borrowers',
65
                                            reserveforothers => ['place_holds'],
66
                                            tools => ['edit_news', 'edit_notices'],
67
                                            acquisition => {
68
                                              budget_add_del => 1,
69
                                              budget_modify => 1,
70
                                            },
71
                                        });
72
    $permissionManager->hasPermission($borrowers->{'1A01'}, 'borrowers', 'view_borrowers');
73
    $permissionManager->hasPermission($borrowers->{'1A01'}, 'tools', 'edit_notices');
74
    $permissionManager->hasPermission($borrowers->{'1A01'}, 'acquisition', 'budget_modify');
75
    $permissionsList = $permissionManager->getBorrowerPermissions($borrowers->{'1A01'});
76
    is(scalar(@$permissionsList), 6, "PermissionManager, grantPermissions:> Permissions as HASH, ARRAY and Scalar.");
77
78
    $permissionManager->revokeAllPermissions($borrowers->{'1A01'});
79
    $permissionsList = $permissionManager->getBorrowerPermissions($borrowers->{'1A01'});
80
    is(scalar(@$permissionsList), 0, "PermissionManager, revokeAllPermissions:> No permissions left.");
81
82
    ##Test listKohaPermissionsAsHASH
83
    my $listedPermissions = $permissionManager->listKohaPermissionsAsHASH();
84
    ok(ref($listedPermissions->{circulate}->{permissions}->{force_checkout}) eq 'HASH', "PermissionManager, listKohaPermissionsAsHASH:> Check 1.");
85
    ok(ref($listedPermissions->{editcatalogue}->{permissions}->{edit_catalogue}) eq 'HASH', "PermissionManager, listKohaPermissionsAsHASH:> Check 2.");
86
    ok(defined($listedPermissions->{reports}->{permissions}->{create_reports}->{description}), "PermissionManager, listKohaPermissionsAsHASH:> Check 3.");
87
    ok(defined($listedPermissions->{permissions}->{description}), "PermissionManager, listKohaPermissionsAsHASH:> Check 4.");
88
89
90
91
    ###   TESTING WITH unique keys, instead of the recommended Koha::Objects. ###
92
    #Arguably this makes for more clear tests cases :)
93
    ##Add/get PermissionModule
94
    $permissionModule = $permissionManager->addPermissionModule({module => 'test', description => 'Just testing this module.'});
95
    is($permissionModule->module, "test", "PermissionManager from names, add/getPermissionModule:> Module added.");
96
    $permissionModule = $permissionManager->getPermissionModule('test');
97
    is($permissionModule->module, "test", "PermissionManager from names, add/getPermissionModule:> Module got.");
98
99
    ##Add/get Permission
100
    $permission = $permissionManager->addPermission({module => 'test', code => 'testperm', description => 'Just testing this permission.'});
101
    is($permission->code, "testperm", "PermissionManager from names, add/getPermission:> Permission added.");
102
    $permission = $permissionManager->getPermission('testperm');
103
    is($permission->code, "testperm", "PermissionManager from names, add/getPermission:> Permission got.");
104
105
    ##Grant permission
106
    $permissionManager->grantPermission($borrowers->{'1A01'}, 'test', 'testperm');
107
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, 'test', 'testperm'), "PermissionManager from names, grant/hasPermission:> Borrower granted permission.");
108
109
    ##hasPermission with wildcard
110
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, 'test', '*'), "PermissionManager from names, hasPermission:> Wildcard permission.");
111
112
    ##hasPermissions with wildcard
113
    ok($permissionManager->hasPermissions($borrowers->{'1A01'}, {test => ['*']}), "PermissionManager from names, hasPermission:> Wildcard permissions from array.");
114
115
    ##Revoke permission
116
    $permissionManager->revokePermission($borrowers->{'1A01'}, 'test', 'testperm');
117
    $failureCaughtFlag = 0;
118
    try {
119
        $permissionManager->hasPermission($borrowers->{'1A01'}, 'test', 'testperm');
120
    } catch {
121
        if (blessed($_) && $_->isa('Koha::Exception::NoPermission')) {
122
            $failureCaughtFlag = 1;
123
        }
124
        else {
125
            die $_; #Somekind of another problem arised and rethrow it.
126
        }
127
    };
128
    ok($failureCaughtFlag, "PermissionManager from names, revoke/hasPermission:> Borrower revoked permission.");
129
130
    ##Delete permissions and modules we just made. When we delete the module first, the permissions is ON CASCADE DELETEd
131
    $permissionManager->delPermissionModule('test');
132
    $permissionModule = $permissionManager->getPermissionModule('test');
133
    ok(not(defined($permissionModule)), "PermissionManager from names, delPermissionModule:> Module deleted.");
134
135
    $failureCaughtFlag = 0;
136
    try {
137
        #This subpermission is now deleted due to cascading delete of the parent permissionModule
138
        #We catch the exception gracefully and report test success
139
        $permissionManager->delPermission('testperm');
140
    } catch {
141
        if (blessed($_) && $_->isa('Koha::Exception::UnknownObject')) {
142
            $failureCaughtFlag = 1;
143
        }
144
        else {
145
            die $_; #Somekind of another problem arised and rethrow it.
146
        }
147
    };
148
    ok($failureCaughtFlag, "PermissionManager from names, delPermission:> Permission already deleted, exception caught.");
149
    $permission = $permissionManager->getPermission('testperm');
150
    ok(not(defined($permission)), "PermissionManager from names, delPermission:> Permission deleted.");
151
152
153
154
    ###  TESTING WITH Koha::Object parameters instead.  ###
155
    ##Add/get PermissionModule
156
    $permissionModule = $permissionManager->addPermissionModule({module => 'test', description => 'Just testing this module.'});
157
    is($permissionModule->module, "test", "PermissionManager from objects, add/getPermissionModule:> Module added.");
158
    $permissionModule = $permissionManager->getPermissionModule($permissionModule);
159
    is($permissionModule->module, "test", "PermissionManager from objects, add/getPermissionModule:> Module got.");
160
161
    ##Add/get Permission
162
    $permission = $permissionManager->addPermission({module => 'test', code => 'testperm', description => 'Just testing this permission.'});
163
    is($permission->code, "testperm", "PermissionManager from objects, add/getPermission:> Permission added.");
164
    $permission = $permissionManager->getPermission($permission);
165
    is($permission->code, "testperm", "PermissionManager from objects, add/getPermission:> Permission got.");
166
167
    ##Grant permission
168
    $permissionManager->grantPermission($borrowers->{'1A01'}, $permissionModule, $permission);
169
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, $permissionModule, $permission), "PermissionManager from objects, grant/hasPermission:> Borrower granted permission.");
170
171
    ##hasPermission with wildcard
172
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, $permissionModule, '*'), "PermissionManager from objects, hasPermission:> Wildcard permission.");
173
174
    ##hasPermissions with wildcard, we quite cannot use a blessed Object as a HASH key
175
    #ok($permissionManager->hasPermissions($borrowers->{'1A01'}, {$permissionModule->module() => ['*']}), "PermissionManager from objects, hasPermission:> Wildcard permissions from array.");
176
177
    ##Revoke permission
178
    $permissionManager->revokePermission($borrowers->{'1A01'}, $permissionModule, $permission);
179
    $failureCaughtFlag = 0;
180
    try {
181
        $permissionManager->hasPermission($borrowers->{'1A01'}, $permissionModule, $permission);
182
    } catch {
183
        if (blessed($_) && $_->isa('Koha::Exception::NoPermission')) {
184
            $failureCaughtFlag = 1;
185
        }
186
        else {
187
            die $_; #Somekind of another problem arised and rethrow it.
188
        }
189
    };
190
    ok($failureCaughtFlag, "PermissionManager from objects, revoke/hasPermission:> Borrower revoked permission.");
191
192
    ##Delete permissions and modules we just made
193
    $permissionManager->delPermission($permission);
194
    $permission = $permissionManager->getPermission('testperm');
195
    ok(not(defined($permission)), "PermissionManager from objects, delPermission:> Permission deleted.");
196
197
    $permissionManager->delPermissionModule($permissionModule);
198
    $permissionModule = $permissionManager->getPermissionModule('test');
199
    ok(not(defined($permissionModule)), "PermissionManager from objects, delPermissionModule:> Module deleted.");
200
201
202
203
    ##Testing superlibrarian permission
204
    $permissionManager->revokeAllPermissions($borrowers->{'1A01'});
205
    $permissionManager->grantPermission($borrowers->{'1A01'}, 'superlibrarian', 'superlibrarian');
206
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, 'staffaccess', 'staff_access_permissions'), "PermissionManager, superuser permission:> Superuser has all permissions 1.");
207
    ok($permissionManager->hasPermission($borrowers->{'1A01'}, 'tools', 'batch_upload_patron_images'), "PermissionManager, superuser permission:> Superuser has all permissions 2.");
208
};
209
if ($@) { #Catch all leaking errors and gracefully terminate.
210
    warn $@;
211
    tearDown();
212
    exit 1;
213
}
214
215
##All tests done, tear down test context
216
tearDown();
217
done_testing;
218
219
sub tearDown {
220
    t::db_dependent::TestObjects::ObjectFactory->tearDownTestContext($testContext);
221
}
(-)a/t/db_dependent/Members/member-flags.t (+100 lines)
Line 0 Link Here
1
#!/usr/bin/env perl
2
3
# Copyright 2015 Open Source Freedom Fighters
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use Test::More; #Please don't set the test count here. It is nothing but trouble when rebasing against master
23
                #and is of dubious help, especially since we are running dynamic tests here which are triggered
24
                #based on the reported test infrastucture capabilities.
25
use Try::Tiny; #Even Selenium::Remote::Driver uses Try::Tiny :)
26
27
use t::lib::Page::Members::MemberFlags;
28
use t::db_dependent::TestObjects::Borrowers::BorrowerFactory;
29
use Koha::Auth::PermissionManager;
30
31
32
##Setting up the test context
33
my $testContext = {};
34
35
my $password = '1234';
36
my $borrowerFactory = t::db_dependent::TestObjects::Borrowers::BorrowerFactory->new();
37
my $borrowers = $borrowerFactory->createTestGroup([
38
            {firstname  => 'Olli-Antti',
39
             surname    => 'Kivi',
40
             cardnumber => '1A01',
41
             branchcode => 'CPL',
42
             userid     => 'mini_admin',
43
             password   => $password,
44
            },
45
        ], undef, $testContext);
46
47
##Test context set, starting testing:
48
eval { #run in a eval-block so we don't die without tearing down the test context
49
50
    testGrantRevokePermissions();
51
52
};
53
if ($@) { #Catch all leaking errors and gracefully terminate.
54
    warn $@;
55
    tearDown();
56
    exit 1;
57
}
58
59
##All tests done, tear down test context
60
tearDown();
61
done_testing;
62
63
sub tearDown {
64
    t::db_dependent::TestObjects::ObjectFactory->tearDownTestContext($testContext);
65
}
66
67
sub testGrantRevokePermissions {
68
    my $permissionManager = Koha::Auth::PermissionManager->new();
69
    $permissionManager->grantPermissions($borrowers->{'1A01'}, {permissions => 'set_permissions',
70
                                                            catalogue => 'staff_login',
71
                                                            staffaccess => 'staff_access_permissions',
72
                                                            circulate => 'override_renewals',
73
                                                          });
74
75
    my $memberflags = t::lib::Page::Members::MemberFlags->new({borrowernumber => $borrowers->{'1A01'}->{borrowernumber}});
76
77
    $memberflags->isPasswordLoginAvailable()->doPasswordLogin($borrowers->{'1A01'}->{userid}, $password)
78
                ->togglePermission('editcatalogue', 'delete_all_items') #Add this
79
                ->togglePermission('editcatalogue', 'edit_items') #Add this
80
                ->togglePermission('circulate', 'override_renewals') #Remove this permission
81
                ->submitPermissionTree();
82
83
    ok($permissionManager->hasPermissions($borrowers->{'1A01'},{editcatalogue => ['delete_all_items', 'edit_items']}),
84
    "member-flags.pl:> Granting new permissions succeeded.");
85
86
    my $failureCaughtFlag = 0;
87
    try {
88
        $permissionManager->hasPermission($borrowers->{'1A01'}, 'circulate', 'override_renewals');
89
    } catch {
90
        if (blessed($_) && $_->isa('Koha::Exception::NoPermission')) {
91
            $failureCaughtFlag = 1;
92
        }
93
        else {
94
            die $_; #Somekind of another problem arised and rethrow it.
95
        }
96
    };
97
    ok($failureCaughtFlag, "member-flags.pl:> Revoking permissions succeeded.");
98
99
    $permissionManager->revokePermissions($borrowers->{'1A01'});
100
}
(-)a/t/lib/Page/Members/MemberFlags.pm (-1 / +111 lines)
Line 0 Link Here
0
- 
1
package t::lib::Page::Members::MemberFlags;
2
3
# Copyright 2015 Open Source Freedom Fighters
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use t::lib::Page::Members::Moremember;
23
24
use base qw(t::lib::Page);
25
26
=head NAME t::lib::Page::Members::MemberFlags
27
28
=head SYNOPSIS
29
30
member-flags.pl PageObject providing page functionality as a service!
31
32
=cut
33
34
=head new
35
36
    my $memberflags = t::lib::Page::Members::MemberFlags->new({borrowernumber => "1"});
37
38
Instantiates a WebDriver and loads the members/member-flags.pl.
39
@PARAM1 HASHRef of optional and MANDATORY parameters
40
MANDATORY extra parameters:
41
    borrowernumber => loads the page to display Borrower matching the given borrowernumber
42
43
@RETURNS t::lib::Page::Members::MemberFlags, ready for user actions!
44
=cut
45
46
sub new {
47
    my ($class, $params) = @_;
48
    unless (ref($params) eq 'HASH') {
49
        $params = {};
50
    }
51
    $params->{resource} = '/cgi-bin/koha/members/member-flags.pl';
52
    $params->{type}     = 'staff';
53
54
    $params->{getParams} = [];
55
    #Handle MANDATORY parameters
56
    if ($params->{borrowernumber}) {
57
        push @{$params->{getParams}}, "member=".$params->{borrowernumber};
58
    }
59
    else {
60
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."->new():> Parameter 'borrowernumber' is missing.");
61
    }
62
63
    my $self = $class->SUPER::new($params);
64
65
    return $self;
66
}
67
68
sub togglePermission {
69
    my ($self, $permissionModule, $permissionCode) = @_;
70
    my $d = $self->getDriver();
71
$self->debugOutput();
72
    my ($moduleCheckbox, $permissionCheckbox) = _getPermissionTreePermissionElements($d, $permissionModule, $permissionCode);
73
#    $moduleCheckbox->click();
74
    $permissionCheckbox->click();
75
76
    return $self;
77
}
78
79
sub submitPermissionTree {
80
    my $self = shift;
81
    my $d = $self->getDriver();
82
83
    my ($submitButton, $cancelButton) = _getPermissionTreeControlElements($d);
84
    $submitButton->click();
85
86
    ok(($d->get_title() =~ /Patron details for/), "Permissions set");
87
88
    return t::lib::Page::Members::Moremember->new($self);
89
}
90
91
sub _getPermissionTreeControlElements {
92
    my $d = shift;
93
    my $saveButton   = $d->find_element('input[value="Save"]');
94
    my $cancelButton = $d->find_element('a.cancel');
95
    return ($saveButton, $cancelButton);
96
}
97
98
=head _getPermissionTreePermissionElements
99
100
@PARAM1 Selenium::Remote::Driver implementation
101
@PARAM2 Scalar, Koha::Auth::PermissionModule's module
102
@PARAM3 Scalar, Koha::Auth::Permission's code
103
=cut
104
105
sub _getPermissionTreePermissionElements {
106
    my ($d, $module, $code) = @_;
107
    my $moduleCheckbox   = $d->find_element("input#flag-$module");
108
    my $permissionCheckbox = $d->find_element('input#'.$module.'_'.$code);
109
    return ($moduleCheckbox, $permissionCheckbox);
110
}
111
1; #Make the compiler happy!

Return to bug 14540