From f27a4a1a6c33291a70d9d1e6827d616cf1abe3d7 Mon Sep 17 00:00:00 2001
From: Blou <philippe.blouin@inlibro.com>
Date: Tue, 19 Apr 2016 11:17:43 -0400
Subject: [PATCH] Bug 11317 - Move file access under Tools and add specific
 permission

Moves the .pl and .tt under tools/ instead of reports/ and adds tools/access_files permission.

Testing
-1) Having done requirements of previous patches, like adding 'accessdir' to koha-conf...
0) apply patch, update database to add permission option.
1) Login as NON-superadmin.  Go under tools, see no Report/Log under the third column
2) Go to add tools/access_file permission to user
3) See new entry under tools third column.
4) validate link is ok.

Sponsored by : CCSR
---
 ...z11317-add-permission-for-tools-access-file.sql |   1 +
 installer/data/mysql/userpermissions.sql           |   1 +
 .../intranet-tmpl/prog/en/includes/permissions.inc |   1 +
 .../prog/en/modules/reports/report_files.tt        |  67 -------------
 .../prog/en/modules/tools/tools-home.tt            |   4 +-
 reports/report_files.pl                            | 107 ---------------------
 6 files changed, 6 insertions(+), 175 deletions(-)
 create mode 100644 installer/data/mysql/atomicupdate/bz11317-add-permission-for-tools-access-file.sql
 delete mode 100644 koha-tmpl/intranet-tmpl/prog/en/modules/reports/report_files.tt
 delete mode 100755 reports/report_files.pl

diff --git a/installer/data/mysql/atomicupdate/bz11317-add-permission-for-tools-access-file.sql b/installer/data/mysql/atomicupdate/bz11317-add-permission-for-tools-access-file.sql
new file mode 100644
index 0000000..dc49a78
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bz11317-add-permission-for-tools-access-file.sql
@@ -0,0 +1 @@
+INSERT INTO permissions (module_bit, code, description) VALUES (13, 'access_files', 'Access to the files stored on the server');
diff --git a/installer/data/mysql/userpermissions.sql b/installer/data/mysql/userpermissions.sql
index abeeb3a..181ba33 100644
--- a/installer/data/mysql/userpermissions.sql
+++ b/installer/data/mysql/userpermissions.sql
@@ -57,6 +57,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
    (13, 'records_batchmod', 'Perform batch modification of records (biblios or authorities)'),
    (13, 'marc_modification_templates', 'Manage marc modification templates'),
    (13, 'records_batchdel', 'Perform batch deletion of records (bibliographic or authority)'),
+   (13, 'access_files', 'Access to the files stored on the server'),
    (15, 'check_expiration', 'Check the expiration of a serial'),
    (15, 'claim_serials', 'Claim missing serials'),
    (15, 'create_subscription', 'Create a new subscription'),
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
index 4a262b9..4c91d28 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
@@ -100,5 +100,6 @@
     [%- CASE 'report' -%]<span>Use report plugins</span>
     [%- CASE 'tool' -%]<span>Use tool plugins</span>
     [%- CASE 'delete_public_lists' -%]<span>Delete public lists</span>
+    [%- CASE 'access_files' -%]<span>Access to the files stored on the server</span>
     [%- END -%]
 [%- END -%]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/report_files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/report_files.tt
deleted file mode 100644
index 06de9d1..0000000
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/report_files.tt
+++ /dev/null
@@ -1,67 +0,0 @@
-[% INCLUDE 'doc-head-open.inc' %]
-<title>Report/log files</title>
-[% INCLUDE 'doc-head-close.inc' %]
-<link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
-[% INCLUDE 'datatables.inc' %]
-[% INCLUDE 'datatables-strings.inc' %]
-<script type="text/JavaScript" language="JavaScript">
-    //<![CDATA[
-        $(document).ready(function() {
-            $("#files").dataTable($.extend(true, {}, dataTablesDefaults, {
-                "sDom": 't',
-                "aoColumnDefs": [
-                    { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false }
-                ],
-                "bPaginate": false
-            }));
-    });
-    //]]>
-</script>
-</head>
-<body>
-[% INCLUDE 'header.inc' %]
-[% INCLUDE 'cat-search.inc' %]
-
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a> &rsaquo; Report/log files</div>
-
-<div id="doc3" class="yui-t2">
-   <div id="bd">
-    <div id="yui-main">
-    <div class="yui-b">
-
-    <h1>Report/log files</h1>
-
-[% IF ( error_no_dir ) %]
-    <div class="dialog alert"><strong>Error : </strong>Report/log files could not be found because the "accessdir" option was not set in "koha-conf.xml". Contact your system administrator to add this option.</div>
-[% ELSE %]
-    [% IF ( files_loop ) %]
-        <table id="files">
-            <thead>
-                <tr>
-                    <th>Name</th>
-                    <th>Size (bytes)</th>
-                    <th>Date last modified</th>
-                </tr>
-            </thead>
-            <tbody>
-                [% FOREACH file IN files_loop %]
-                <tr>
-                    <td><a href="/cgi-bin/koha/reports/report_files.pl?id=[% file.id |url %]">[% file.name %]</a></td>
-                    <td align="right">[% file.size %]</td>
-                    <td>[% file.date %]</td>
-                </tr>
-                [% END %]
-            </tbody>
-        </table>
-    [% ELSE %]
-        No file found.
-    [% END %]
-[% END %]
-
-</div>
-</div>
-<div class="yui-b">
-[% INCLUDE 'reports-menu.inc' %]
-</div>
-</div>
-[% INCLUDE 'intranet-bottom.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt
index d9ed604..a81bfc7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt
@@ -109,8 +109,10 @@
     <dd>Manage EDIfact transmissions</dd>
     [% END %]
 
-    <dt><a href="/cgi-bin/koha/reports/report_files.pl">Report/log files </a></dt>
+    [% IF CAN_user_tools_access_files %]
+    <dt><a href="/cgi-bin/koha/tools/access_files.pl">Report/log files</a></dt>
     <dd>Report/log files</dd>
+    [% END %]
 
 </dl>
 </div>
diff --git a/reports/report_files.pl b/reports/report_files.pl
deleted file mode 100755
index aea95a0..0000000
--- a/reports/report_files.pl
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/usr/bin/perl
-
-# Frédérick Capovilla, 2011 - Libéo
-#
-# Show a list of all the files in the directory specified by the option
-# "accessdir" in koha-conf.xml so they can be downloaded by users with the
-# "reports" permission.
-#
-# This file is part of Koha.
-#
-# Koha is free software; you can redistribute it and/or modify it under the
-# terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 3 of the License, or (at your option) any later
-# version.
-#
-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with Koha; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-use strict;
-use warnings;
-use C4::Auth;
-use CGI;
-use C4::Context;
-use C4::Output;
-use C4::Koha;
-use File::stat;
-use Digest::MD5 qw(md5_hex);
-
-my $input = new CGI;
-my $file_id = $input->param("id");
-my $accessdir = C4::Context->config('accessdir');
-my @directories = $accessdir ? (ref $accessdir ? @{$accessdir} : ($accessdir)) : ();
-
-my ($template, $borrowernumber, $cookie)
-    = get_template_and_user({template_name => "reports/report_files.tt",
-                query => $input,
-                type => "intranet",
-                authnotrequired => 0,
-                flagsrequired => {reports => '*'},
-                });
-
-unless(@directories) {
-    $template->param(error_no_dir => 1);
-}
-else {
-    #Get the files list
-    my @files_list;
-    foreach my $dir(@directories){
-        opendir(DIR, $dir);
-        foreach my $filename (readdir(DIR)) {
-        my $id = md5_hex($filename);
-            my $full_path = "$dir/$filename";
-            next if ($filename =~ /^\./ or -d $full_path);
-
-            my $st = stat($full_path);
-            my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) =localtime($st->mtime);
-            my $dt=DateTime->new(year      => $year + 1900,
-                                  month    => $mon + 1,
-                                  day      => $mday,
-                                  hour     => $hour,
-                                  minute   => $min,
-                            );
-            push(@files_list, {name => $filename,
-                               accessdir => $dir,
-                               date =>Koha::DateUtils::output_pref($dt),
-                               size => $st->size,
-                               id   => $id});
-        }
-        closedir(DIR);
-    }
-
-    my %files_hash = map { $_->{id} => $_ } @files_list;
-    # If we received a file_id and it is valid, send the file to the browser
-    if(defined $file_id and $file_id >= 0 and exists $files_hash{$file_id} ){
-        my $filename = $files_hash{$file_id}->{name};
-        my $dir = $files_hash{$file_id}->{accessdir};
-        binmode STDOUT;
-        # Open the selected file and send it to the browser
-        print $input->header(-type => 'application/x-download',
-                             -name => "$filename",
-                             -Content_length => -s "$dir/$filename",
-                             -attachment => "$filename");
-
-        my $fh;
-        open $fh, "<:encoding(UTF-8)", "$dir/$filename";
-        binmode $fh;
-
-        my $buf;
-        while(read($fh, $buf, 65536)) {
-            print $buf;
-        }
-        close $fh;
-
-        exit(1);
-    }
-    else{
-        # Send the file list to the template
-        $template->param(files_loop => \@files_list);
-    }
-}
-
-output_html_with_http_headers $input, $cookie, $template->output;
-- 
2.1.0