From 3d04b3f8601d1285be96819e93904721ae2fa8e3 Mon Sep 17 00:00:00 2001 From: Jesse Weaver Date: Thu, 31 Aug 2017 17:02:42 -0600 Subject: [PATCH] Bug 15520: Add permission to restrict circ rules editing to own library Test plan: 1) Ensure that you have four users: a) A superlibrarian b) A user with all `parameters` permissions (the toplevel `parameters` box is checked). c) A user with the `manage_circ_rules` permission (and, of course, `catalogue`). d) A user with the `manage_circ_rules`, `manage_circ_rules_restricted` and `catalogue` permissions. 2) As all four users, load the "Circulation and fine rules" administration page (admin/smart-rules.pl). 3) The page should be unchanged for the first three users. It should be possible to view and edit the circ rules for all libraries. 4) The last (restricted) user should only be able to view and edit the circ rules for their own library. Followed test plan, patch worked as described Signed-off-by: Alex Buckley --- C4/Auth.pm | 12 ++++++--- admin/smart-rules.pl | 7 +++++ .../bug_15520-add_manage_circ_rules_restricted.sql | 1 + .../intranet-tmpl/prog/en/includes/permissions.inc | 3 ++- .../prog/en/modules/admin/smart-rules.tt | 30 ++++++++++++---------- 5 files changed, 34 insertions(+), 19 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql diff --git a/C4/Auth.pm b/C4/Auth.pm index c3ad351aa1..7fee0870a4 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -2026,17 +2026,20 @@ sub get_all_subpermissions { =head2 haspermission - $flags = ($userid, $flagsrequired); + $flags = ( $userid, $flagsrequired[, { no_inherit => 1 } ] ); C<$userid> the userid of the member C<$flags> is a hashref of required flags like C<$borrower-<{authflags}> +C, if true, means that this function will not return true if +$flagsrequired is { module => 'sub_perm' } and the user only has { module => 1 }. +This is useful for *_restricted permissions. Returns member's flags or 0 if a permission is not met. =cut sub haspermission { - my ( $userid, $flagsrequired ) = @_; + my ( $userid, $flagsrequired, $options ) = @_; my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); $sth->execute($userid); my $row = $sth->fetchrow(); @@ -2047,7 +2050,7 @@ sub haspermission { $flags->{'superlibrarian'} = 1; } - return $flags if $flags->{superlibrarian}; + return $flags if $flags->{superlibrarian} && !$options->{no_inherit}; foreach my $module ( keys %$flagsrequired ) { my $subperm = $flagsrequired->{$module}; @@ -2056,7 +2059,8 @@ sub haspermission { } else { return 0 unless ( ( defined $flags->{$module} and - $flags->{$module} == 1 ) + $flags->{$module} == 1 and + !$options->{no_inherit} ) or ( ref( $flags->{$module} ) and exists $flags->{$module}->{$subperm} and diff --git a/admin/smart-rules.pl b/admin/smart-rules.pl index 718b68235c..fb3254a74f 100755 --- a/admin/smart-rules.pl +++ b/admin/smart-rules.pl @@ -33,6 +33,7 @@ use Koha::RefundLostItemFeeRule; use Koha::RefundLostItemFeeRules; use Koha::Libraries; use Koha::Patron::Categories; +use Koha::Patrons; my $input = CGI->new; my $dbh = C4::Context->dbh; @@ -59,6 +60,12 @@ unless ( $branch ) { $branch = C4::Context::only_my_library() ? ( C4::Context::mybranch() || '*' ) : '*'; } } + +my $uid = Koha::Patrons->find( $loggedinuser )->userid; +my $restricted_to_own_library = $uid && haspermission( $uid, { parameters => 'manage_circ_rules_restricted' }, { no_inherit => 1 } ); +$template->param( restricted_to_own_library => $restricted_to_own_library ); +$branch = C4::Context::mybranch() if $restricted_to_own_library; + $branch = '*' if $branch eq 'NO_LIBRARY_SET'; my $op = $input->param('op') || q{}; diff --git a/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql b/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql new file mode 100644 index 0000000000..830f4fb0aa --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_15520-add_manage_circ_rules_restricted.sql @@ -0,0 +1 @@ +INSERT IGNORE INTO `permissions` (module_bit, code, description) VALUES(3, 'manage_circ_rules_restricted', 'Only manage circ rules for own library'); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index 7dde923c15..7a8a036b1a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -32,7 +32,8 @@ [%- CASE 'overdues_report' -%]Execute overdue items report [%- CASE 'override_renewals' -%]Override blocked renewals [%- CASE 'self_checkout' -%]Perform self checkout at the OPAC. It should be used for the patron matching the AutoSelfCheckID - [%- CASE 'manage_circ_rules' -%]manage circulation rules + [%- CASE 'manage_circ_rules' -%]Manage circulation rules + [%- CASE 'manage_circ_rules_restricted' -%]Limit circulation rules editing to the user's own library (please note that manage_circ_rules is still required) [%- CASE 'parameters_remaining_permissions' -%]Remaining system parameters permissions [%- CASE 'edit_borrowers' -%]Add, modify and view patron information [%- CASE 'view_borrower_infos_from_any_libraries' -%]View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt index e1a5839f8a..fa27da0eba 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt @@ -38,22 +38,24 @@

To modify a rule, create a new one with the same patron category and item type.

-
- Select a library : - -
- [% IF ( definedbranch ) %] -
- - - + + [% PROCESS options_for_libraries libraries => Branches.all( selected => current_branch, unfiltered => 1 ) %] -
+ [% IF ( definedbranch ) %] +
+ + + + +
+ [% END %] [% END %]
-- 2.15.1