View | Details | Raw Unified | Return to bug 14686
Collapse All | Expand All

(-)a/Koha/Schema/Result/UploadedFile.pm (-15 / +1 lines)
Lines 124-142 __PACKAGE__->set_primary_key("id"); Link Here
124
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:Cq/HSuTaBxZH2qSGEddoaQ
124
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:Cq/HSuTaBxZH2qSGEddoaQ
125
125
126
126
127
sub allows_add_by {
127
# You can replace this text with custom code or comments, and it will be preserved on regeneration
128
    my ( $self, $userid ) = @_; # do not confuse with borrowernumber
129
    my $flags = [
130
        { tools      => 'upload_general_files' },
131
        { circulate  => 'circulate_remaining_permissions' },
132
        { tools      => 'stage_marc_import' },
133
        { tools      => 'upload_local_cover_images' },
134
    ];
135
    require C4::Auth;
136
    foreach( @$flags ) {
137
        return 1 if C4::Auth::haspermission( $userid, $_ );
138
    }
139
    return;
140
}
141
142
1;
128
1;
(-)a/Koha/Upload.pm (+21 lines)
Lines 240-245 sub httpheaders { Link Here
240
    );
240
    );
241
}
241
}
242
242
243
=head2 allows_add_by
244
245
    allows_add_by checks if $userid has permission to add uploaded files
246
247
=cut
248
249
sub allows_add_by {
250
    my ( $class, $userid ) = @_; # do not confuse with borrowernumber
251
    my $flags = [
252
        { tools      => 'upload_general_files' },
253
        { circulate  => 'circulate_remaining_permissions' },
254
        { tools      => 'stage_marc_import' },
255
        { tools      => 'upload_local_cover_images' },
256
    ];
257
    require C4::Auth;
258
    foreach( @$flags ) {
259
        return 1 if C4::Auth::haspermission( $userid, $_ );
260
    }
261
    return;
262
}
263
243
=head1 INTERNAL ROUTINES
264
=head1 INTERNAL ROUTINES
244
265
245
=cut
266
=cut
(-)a/t/db_dependent/Upload.t (-6 / +6 lines)
Lines 84-90 subtest 'Test07' => sub { Link Here
84
    plan tests => 2;
84
    plan tests => 2;
85
    test07();
85
    test07();
86
};
86
};
87
subtest 'Test08: UploadedFile->allows_add_by' => sub {
87
subtest 'Test08: allows_add_by' => sub {
88
    plan tests => 4;
88
    plan tests => 4;
89
    test08();
89
    test08();
90
};
90
};
Lines 176-201 sub test07 { #simple test for httpheaders and getCategories Link Here
176
    is( @$cat >= 1, 1, 'getCategories returned at least one category' );
176
    is( @$cat >= 1, 1, 'getCategories returned at least one category' );
177
}
177
}
178
178
179
sub test08 { # UploadedFile->allows_add_by
179
sub test08 { # allows_add_by
180
    my $builder = t::lib::TestBuilder->new;
180
    my $builder = t::lib::TestBuilder->new;
181
    my $patron = $builder->build({
181
    my $patron = $builder->build({
182
        source => 'Borrower',
182
        source => 'Borrower',
183
        value  => { flags => 0 }, #no permissions
183
        value  => { flags => 0 }, #no permissions
184
    });
184
    });
185
    my $patronid = $patron->{borrowernumber};
185
    my $patronid = $patron->{borrowernumber};
186
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
186
    is( Koha::Upload->allows_add_by( $patron->{userid} ),
187
        undef, 'Patron is not allowed to do anything' );
187
        undef, 'Patron is not allowed to do anything' );
188
188
189
    # add some permissions: edit_catalogue
189
    # add some permissions: edit_catalogue
190
    my $fl = 2**9; # edit_catalogue
190
    my $fl = 2**9; # edit_catalogue
191
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
191
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
192
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
192
    is( Koha::Upload->allows_add_by( $patron->{userid} ),
193
        undef, 'Patron is still not allowed to add uploaded files' );
193
        undef, 'Patron is still not allowed to add uploaded files' );
194
194
195
    # replace flags by all tools
195
    # replace flags by all tools
196
    $fl = 2**13; # tools
196
    $fl = 2**13; # tools
197
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
197
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
198
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
198
    is( Koha::Upload->allows_add_by( $patron->{userid} ),
199
        1, 'Patron should be allowed now to add uploaded files' );
199
        1, 'Patron should be allowed now to add uploaded files' );
200
200
201
    # remove all tools and add upload_general_files only
201
    # remove all tools and add upload_general_files only
Lines 209-215 sub test08 { # UploadedFile->allows_add_by Link Here
209
            code           => 'upload_general_files',
209
            code           => 'upload_general_files',
210
        },
210
        },
211
    });
211
    });
212
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
212
    is( Koha::Upload->allows_add_by( $patron->{userid} ),
213
        1, 'Patron is still allowed to add uploaded files' );
213
        1, 'Patron is still allowed to add uploaded files' );
214
}
214
}
215
215
(-)a/tools/upload-file.pl (-3 / +1 lines)
Lines 28-34 use URI::Escape; Link Here
28
use C4::Context;
28
use C4::Context;
29
use C4::Auth qw/check_cookie_auth haspermission/;
29
use C4::Auth qw/check_cookie_auth haspermission/;
30
use Koha::Upload;
30
use Koha::Upload;
31
use Koha::Schema::Result::UploadedFile;
32
31
33
# upload-file.pl must authenticate the user
32
# upload-file.pl must authenticate the user
34
# before processing the POST request,
33
# before processing the POST request,
Lines 42-48 my %cookies = CGI::Cookie->fetch; Link Here
42
my $sid = $cookies{'CGISESSID'}->value;
41
my $sid = $cookies{'CGISESSID'}->value;
43
my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
42
my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
44
my $uid = C4::Auth::get_session($sid)->param('id');
43
my $uid = C4::Auth::get_session($sid)->param('id');
45
my $allowed = Koha::Schema::Result::UploadedFile->allows_add_by( $uid );
44
my $allowed = Koha::Upload->allows_add_by( $uid );
46
45
47
if( $auth_status ne 'ok' || !$allowed ) {
46
if( $auth_status ne 'ok' || !$allowed ) {
48
    send_reply( 'denied' );
47
    send_reply( 'denied' );
49
- 

Return to bug 14686