@@ -, +, @@ module - circulation conditions (manage_circ_rules) - everything else (parameters_remaining_permissions) - Create different staff users: 1) One with parameters_remaining_permissions 2) One with parameters 3) One with catalogue and no parameters 4) One superlibrarian - Apply the patch - Run the database update - Check the staff users: 1) All subpermissions, but manage_circ_rules should be checked 2) Nothing should have changed 3) manage_item_serach_fields shoudl be checked (page had catalogue permission before) 4) Nothing should have changed - Try different settings of the permissions and verify that - Administration page behaves correctly - Administration menu behaves correctly ! You shoudl only see what you have permission for --- admin/audio_alerts.pl | 2 +- admin/auth_subfields_structure.pl | 2 +- admin/auth_tag_structure.pl | 2 +- admin/authorised_values.pl | 2 +- admin/authtypes.pl | 2 +- admin/biblio_framework.pl | 2 +- admin/branch_transfer_limits.pl | 2 +- admin/branches.pl | 2 +- admin/categories.pl | 2 +- admin/checkmarc.pl | 2 +- admin/cities.pl | 2 +- admin/classsources.pl | 2 +- admin/clone-rules.pl | 2 +- admin/columns_settings.pl | 2 +- admin/didyoumean.pl | 2 +- admin/fieldmapping.pl | 2 +- admin/import_export_framework.pl | 2 +- admin/item_circulation_alerts.pl | 2 +- admin/items_search_field.pl | 2 +- admin/items_search_fields.pl | 2 +- admin/itemtypes.pl | 2 +- admin/koha2marclinks.pl | 2 +- admin/library_groups.pl | 2 +- admin/localization.pl | 2 +- admin/marc_subfields_structure.pl | 2 +- admin/marctagstructure.pl | 2 +- admin/matching-rules.pl | 2 +- admin/oai_set_mappings.pl | 2 +- admin/oai_sets.pl | 2 +- admin/patron-attr-types.pl | 2 +- admin/preferences.pl | 2 +- admin/printers.pl | 2 +- admin/searchengine/elasticsearch/mappings.pl | 2 +- admin/sms_providers.pl | 2 +- admin/sru_modmapping.pl | 1 + admin/systempreferences.pl | 2 +- admin/transport-cost-matrix.pl | 2 +- admin/usage_statistics.pl | 2 +- admin/z3950servers.pl | 2 +- api/v1/swagger/paths/cities.json | 6 +- .../bug14391_granular_admin_permissions.sql | 82 +++++++++ installer/data/mysql/userpermissions.sql | 23 ++- .../intranet-tmpl/prog/en/includes/admin-menu.inc | 191 ++++++++++++-------- .../intranet-tmpl/prog/en/includes/permissions.inc | 25 ++- .../prog/en/modules/admin/admin-home.tt | 193 +++++++++++++-------- svc/config/systempreferences | 2 +- svc/localization | 2 +- 47 files changed, 414 insertions(+), 187 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql --- a/admin/audio_alerts.pl +++ a/admin/audio_alerts.pl @@ -40,7 +40,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_audio_alerts' }, debug => 1, } ); --- a/admin/auth_subfields_structure.pl +++ a/admin/auth_subfields_structure.pl @@ -62,7 +62,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/auth_tag_structure.pl +++ a/admin/auth_tag_structure.pl @@ -50,7 +50,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_marc_frameworks'}, debug => 1, }); --- a/admin/authorised_values.pl +++ a/admin/authorised_values.pl @@ -40,7 +40,7 @@ my @messages; our ($template, $borrowernumber, $cookie)= get_template_and_user({ template_name => "admin/authorised_values.tt", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_auth_values'}, query => $input, type => "intranet", debug => 1, --- a/admin/authtypes.pl +++ a/admin/authtypes.pl @@ -37,7 +37,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/biblio_framework.pl +++ a/admin/biblio_framework.pl @@ -39,7 +39,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/branch_transfer_limits.pl +++ a/admin/branch_transfer_limits.pl @@ -33,7 +33,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({template_name => "admin/branch_transfer_limits.tt", query => $input, type => "intranet", - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_transfers'}, debug => 1, }); --- a/admin/branches.pl +++ a/admin/branches.pl @@ -39,7 +39,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_libraries' }, debug => 1, } ); --- a/admin/categories.pl +++ a/admin/categories.pl @@ -43,7 +43,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_patron_categories' }, debug => 1, } ); --- a/admin/checkmarc.pl +++ a/admin/checkmarc.pl @@ -33,7 +33,7 @@ my ($template, $borrowernumber, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, }); --- a/admin/cities.pl +++ a/admin/cities.pl @@ -37,7 +37,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_cities' }, debug => 1, } ); --- a/admin/classsources.pl +++ a/admin/classsources.pl @@ -39,7 +39,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_classifications'}, debug => 1, }); --- a/admin/clone-rules.pl +++ a/admin/clone-rules.pl @@ -41,7 +41,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_circ_rules'}, debug => 1, }); --- a/admin/columns_settings.pl +++ a/admin/columns_settings.pl @@ -15,7 +15,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_column_config' }, debug => 1, } ); --- a/admin/didyoumean.pl +++ a/admin/didyoumean.pl @@ -16,7 +16,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_didyoumean'}, debug => 1, }); --- a/admin/fieldmapping.pl +++ a/admin/fieldmapping.pl @@ -41,7 +41,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_keywords2marc_mappings' }, debug => 1, } ); --- a/admin/import_export_framework.pl +++ a/admin/import_export_framework.pl @@ -31,7 +31,7 @@ my ($auth_status, $sessionID); if (exists $cookies{'CGISESSID'}) { ($auth_status, $sessionID) = check_cookie_auth( $cookies{'CGISESSID'}->value, - { parameters => 'parameters_remaining_permissions' }, + { parameters => 'manage_marc_frameworks' }, ); } if ($auth_status eq 'ok') { --- a/admin/item_circulation_alerts.pl +++ a/admin/item_circulation_alerts.pl @@ -44,7 +44,7 @@ sub show { query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'item_circ_alerts' }, debug => defined($input->param('debug')), } ); --- a/admin/items_search_field.pl +++ a/admin/items_search_field.pl @@ -31,7 +31,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user({ query => $cgi, type => 'intranet', authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { parameters => 'manage_item_search_fields' }, }); my $op = $cgi->param('op') || ''; --- a/admin/items_search_fields.pl +++ a/admin/items_search_fields.pl @@ -31,7 +31,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user({ query => $cgi, type => 'intranet', authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { parameters => 'manage_item_search_fields' }, }); my $op = $cgi->param('op') || ''; --- a/admin/itemtypes.pl +++ a/admin/itemtypes.pl @@ -46,7 +46,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_itemtypes' }, debug => 1, } ); --- a/admin/koha2marclinks.pl +++ a/admin/koha2marclinks.pl @@ -37,7 +37,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user ( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/library_groups.pl +++ a/admin/library_groups.pl @@ -35,7 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_libraries' }, debug => 1, } ); --- a/admin/localization.pl +++ a/admin/localization.pl @@ -31,7 +31,7 @@ my $query = new CGI; my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { template_name => "admin/localization.tt", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_itemtypes' }, query => $query, type => "intranet", debug => 1, --- a/admin/marc_subfields_structure.pl +++ a/admin/marc_subfields_structure.pl @@ -75,7 +75,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/marctagstructure.pl +++ a/admin/marctagstructure.pl @@ -53,7 +53,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, }); --- a/admin/matching-rules.pl +++ a/admin/matching-rules.pl @@ -38,7 +38,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_matching_rules' }, debug => 1, }); --- a/admin/oai_set_mappings.pl +++ a/admin/oai_set_mappings.pl @@ -45,7 +45,7 @@ my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( { query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { 'parameters' => 'parameters_remaining_permissions' }, + flagsrequired => { 'parameters' => 'manage_oai_sets' }, debug => 1, } ); --- a/admin/oai_sets.pl +++ a/admin/oai_sets.pl @@ -41,7 +41,7 @@ my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( { query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { 'parameters' => 'parameters_remaining_permissions' }, + flagsrequired => { 'parameters' => 'manage_oai_sets' }, debug => 1, } ); --- a/admin/patron-attr-types.pl +++ a/admin/patron-attr-types.pl @@ -45,7 +45,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' } + flagsrequired => { parameters => 'manage_patron_attributes' } } ); --- a/admin/preferences.pl +++ a/admin/preferences.pl @@ -300,7 +300,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sysprefs' }, debug => 1, } ); --- a/admin/printers.pl +++ a/admin/printers.pl @@ -70,7 +70,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => '*'}, debug => 1, } ); --- a/admin/searchengine/elasticsearch/mappings.pl +++ a/admin/searchengine/elasticsearch/mappings.pl @@ -31,7 +31,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { superlibrarian => 1 }, # Create a specific permission? + flagsrequired => { parameters => 'manage_search_engine_config' }, } ); --- a/admin/sms_providers.pl +++ a/admin/sms_providers.pl @@ -36,7 +36,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sms_providers' }, debug => 1, } ); --- a/admin/sru_modmapping.pl +++ a/admin/sru_modmapping.pl @@ -32,6 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { query => $input, type => "intranet", authnotrequired => 0, + flagsrequired => { parameters => 'manage_search_targets' }, }); # Main code: convert mapping string to hash structure and show template --- a/admin/systempreferences.pl +++ a/admin/systempreferences.pl @@ -216,7 +216,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sysprefs' }, debug => 1, } ); --- a/admin/transport-cost-matrix.pl +++ a/admin/transport-cost-matrix.pl @@ -37,7 +37,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 1}, + flagsrequired => { parameters => 'manage_transfers' }, debug => 1, }); my $use_transport_cost_matrix = C4::Context->preference("UseTransportCostMatrix"); --- a/admin/usage_statistics.pl +++ a/admin/usage_statistics.pl @@ -30,7 +30,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => '*' }, + flagsrequired => { parameters => 'manage_usage_stats' }, debug => 1, } ); --- a/admin/z3950servers.pl +++ a/admin/z3950servers.pl @@ -44,7 +44,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_search_targets' }, debug => 1, }); my $script_name = "/cgi-bin/koha/admin/z3950servers.pl"; --- a/api/v1/swagger/paths/cities.json +++ a/api/v1/swagger/paths/cities.json @@ -112,7 +112,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } } @@ -213,7 +213,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } }, @@ -267,7 +267,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } } --- a/installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql +++ a/installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql @@ -0,0 +1,82 @@ +INSERT INTO permissions (module_bit, code, description) VALUES + ( 3, 'manage_sysprefs', 'Manage global system preferences'), + ( 3, 'manage_libraries', 'Manage libraries and library groups'), + ( 3, 'manage_itemtypes', 'Manage item types'), + ( 3, 'manage_auth_values', 'Manage authorized values'), + ( 3, 'manage_patron_categories', 'Manage patron categories'), + ( 3, 'manage_patron_attributes', 'Manage extended patron attributes'), + ( 3, 'manage_transfers', 'Manage library transfer limits and transport cost matrix'), + ( 3, 'manage_item_circ_alerts', 'Manage item circulation alerts'), + ( 3, 'manage_cities', 'Manage cities and towns'), + ( 3, 'manage_marc_frameworks', 'Manage MARC bibliographic and authority frameworks'), + ( 3, 'manage_keywords2koha_mappings', 'Manage keywords to Koha mappings'), + ( 3, 'manage_classifications', 'Manage classification sources'), + ( 3, 'manage_matching_rules', 'Manage record matching rules'), + ( 3, 'manage_oai_sets', 'Manage OAI sets'), + ( 3, 'manage_item_search_fields', 'Manage item search fields'), + ( 3, 'manage_search_engine_config', 'Manage search engine configuration'), + ( 3, 'manage_search_targets', 'Manage Z39.50 and SRU server configuration'), + ( 3, 'manage_didyoumean', 'Manage Did you mean? configuration'), + ( 3, 'manage_column_config', 'Manage column configuration'), + ( 3, 'manage_sms_providers', 'Manage SMS cellular providers'), + ( 3, 'manage_audio_alerts', 'Manage audio alerts'), + ( 3, 'manage_usage_stats', 'Manage usage statistics settings'); + +/* User has parameters_remaining_permissions */ +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_sysprefs' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_libraries' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_itemtypes' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_auth_values' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_patron_categories' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_patron_attributes' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_transfers' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_circ_alerts' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_cities' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_marc_frameworks' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_keywords2koha_mappings' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_classifications' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_matching_rules' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_oai_sets' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_search_fields' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_search_engine_config' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_search_targets' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_didyoumean' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_column_config' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_sms_providers' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_audio_alerts' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_usage_stats' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); + +/* User has catalogue permission */ +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_search_fields' + FROM borrowers + WHERE borrowernumber IN + (SELECT borrowernumber FROM user_permissions WHERE code = 'catalogue'); + +/* Clean up now obsolete permission */ +DELETE FROM user_permissions WHERE module_bit = 3 and code = 'parameters_remaining_permissions'; +DELETE FROM permissions WHERE module_bit = 3 and code = 'parameters_remaining_permissions'; + +-- Bug 14391: Add granular permissions to the administration module --- a/installer/data/mysql/userpermissions.sql +++ a/installer/data/mysql/userpermissions.sql @@ -5,8 +5,29 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 1, 'force_checkout', 'Force checkout if a limitation exists'), ( 1, 'manage_restrictions', 'Manage restrictions for accounts'), ( 1, 'manage_checkout_notes', 'Mark checkout notes as seen/not seen'), - ( 3, 'parameters_remaining_permissions', 'Remaining system parameters permissions'), ( 3, 'manage_circ_rules', 'Manage circulation rules'), + ( 3, 'manage_sysprefs', 'Manage global system preferences'), + ( 3, 'manage_libraries', 'Manage libraries and library groups'), + ( 3, 'manage_itemtypes', 'Manage item types'), + ( 3, 'manage_auth_values', 'Manage authorized values'), + ( 3, 'manage_patron_categories', 'Manage patron categories'), + ( 3, 'manage_patron_attributes', 'Manage extended patron attributes'), + ( 3, 'manage_transfers', 'Manage library transfer limits and transport cost matrix'), + ( 3, 'manage_item_circ_alerts', 'Manage item circulation alerts'), + ( 3, 'manage_cities', 'Manage cities and towns'), + ( 3, 'manage_marc_frameworks', 'Manage MARC bibliographic and authority frameworks'), + ( 3, 'manage_keywords2koha_mappings', 'Manage keywords to Koha mappings'), + ( 3, 'manage_classifications', 'Manage classification sources'), + ( 3, 'manage_matching_rules', 'Manage record matching rules'), + ( 3, 'manage_oai_sets', 'Manage OAI sets'), + ( 3, 'manage_item_search_fields', 'Manage item search fields'), + ( 3, 'manage_search_engine_config', 'Manage search engine configuration'), + ( 3, 'manage_search_targets', 'Manage Z39.50 and SRU server configuration'), + ( 3, 'manage_didyouean', 'Manage Did you mean? configuration'), + ( 3, 'manage_column_config', 'Manage column configuration'), + ( 3, 'manage_sms_providers', 'Manage SMS cellular providers'), + ( 3, 'manage_audio_alerts', 'Manage audio alerts'), + ( 3, 'manage_usage_stats', 'Manage usage statistics settings'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), ( 6, 'place_holds', 'Place holds for patrons'), --- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc @@ -2,86 +2,137 @@
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -32,8 +32,29 @@ [%- CASE 'overdues_report' -%]Execute overdue items report [%- CASE 'override_renewals' -%]Override blocked renewals [%- CASE 'manage_checkout_notes' %]Mark checkout notes as seen/not seen - [%- CASE 'manage_circ_rules' -%]manage circulation rules - [%- CASE 'parameters_remaining_permissions' -%]Remaining system parameters permissions + [%- CASE 'manage_circ_rules' -%]Manage circulation rules + [%- CASE 'manage_sysprefs' -%]Manage global system preferences + [%- CASE 'manage_libraries' -%]Manage libraries and library groups + [%- CASE 'manage_itemtypes' -%]Manage item types + [%- CASE 'manage_auth_values' -%]Manage authorized value categories and authorized values + [%- CASE 'manage_patron_categories' -%]Manage patron categories + [%- CASE 'manage_patron_attributes' -%]Manage extended patron attributes + [%- CASE 'manage_transfers' -%]Manage library transfer limits and transport cost matrix + [%- CASE 'manage_item_circ_alerts' -%]Manage item circulation alerts + [%- CASE 'manage_cities' -%]Manage cities and towns + [%- CASE 'manage_marc_frameworks' -%]Manage MARC bibliographic and authority frameworks and test them + [%- CASE 'manage_keywords2koha_mappings' -%]Manage keywords to Koha mappings + [%- CASE 'manage_classfications' -%]Manage classification sources and filing rules + [%- CASE 'manage_matching_rules' -%]Manage record matching rules + [%- CASE 'manage_oai_sets' -%]Manage OAI sets + [%- CASE 'manage_item_search_fields' -%]Manage item search fields + [%- CASE 'manage_search_engine_config' -%]Manage search enginge configuration + [%- CASE 'manage_search_targets' -%]Manage Z39.50 and SRU server confiugration + [%- CASE 'manage_didyoumean' -%]Manage Did you mean? configuration + [%- CASE 'manage_column_config' -%]Manage column configuation + [%- CASE 'manage_audio_alerts' -%]Manage audio alerts + [%- CASE 'manage_sms_providers' -%]Manage SMS cellular providers + [%- CASE 'manage_usage_stats' -%]Manage usage statistics settings [%- CASE 'edit_borrowers' -%]Add, modify and view patron information [%- CASE 'view_borrower_infos_from_any_libraries' -%]View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. [%- CASE 'modify_holds_priority' -%]Modify holds priority --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt @@ -17,7 +17,7 @@Configure these parameters in the order they appear.