@@ -, +, @@ module - circulation conditions (manage_circ_rules) - everything else (parameters_remaining_permissions) - Create different staff users: 1) One with parameters_remaining_permissions 2) One with parameters 3) One with catalogue and no parameters 4) One superlibrarian - Apply the patch - Run the database update - Check the staff users: 1) All subpermissions, but manage_circ_rules should be checked 2) Nothing should have changed 3) manage_item_serach_fields shoudl be checked (page had catalogue permission before) 4) Nothing should have changed - Try different settings of the permissions and verify that - Administration page behaves correctly - Administration menu behaves correctly ! You shoudl only see what you have permission for --- admin/audio_alerts.pl | 2 +- admin/auth_subfields_structure.pl | 2 +- admin/auth_tag_structure.pl | 2 +- admin/authorised_values.pl | 2 +- admin/authtypes.pl | 2 +- admin/biblio_framework.pl | 2 +- admin/branch_transfer_limits.pl | 2 +- admin/branches.pl | 2 +- admin/categories.pl | 2 +- admin/checkmarc.pl | 2 +- admin/cities.pl | 2 +- admin/classsources.pl | 2 +- admin/clone-rules.pl | 2 +- admin/columns_settings.pl | 2 +- admin/didyoumean.pl | 2 +- admin/fieldmapping.pl | 2 +- admin/import_export_framework.pl | 2 +- admin/item_circulation_alerts.pl | 2 +- admin/items_search_field.pl | 2 +- admin/items_search_fields.pl | 2 +- admin/itemtypes.pl | 2 +- admin/koha2marclinks.pl | 2 +- admin/library_groups.pl | 2 +- admin/localization.pl | 2 +- admin/marc_subfields_structure.pl | 2 +- admin/marctagstructure.pl | 2 +- admin/matching-rules.pl | 2 +- admin/oai_set_mappings.pl | 2 +- admin/oai_sets.pl | 2 +- admin/patron-attr-types.pl | 2 +- admin/preferences.pl | 2 +- admin/printers.pl | 2 +- admin/searchengine/elasticsearch/mappings.pl | 2 +- admin/sms_providers.pl | 2 +- admin/sru_modmapping.pl | 1 + admin/systempreferences.pl | 2 +- admin/transport-cost-matrix.pl | 2 +- admin/usage_statistics.pl | 2 +- admin/z3950servers.pl | 2 +- api/v1/swagger/paths/cities.json | 6 +- .../bug14391_granular_admin_permissions.sql | 82 +++++++++ installer/data/mysql/userpermissions.sql | 23 ++- .../intranet-tmpl/prog/en/includes/admin-menu.inc | 191 ++++++++++++-------- .../intranet-tmpl/prog/en/includes/permissions.inc | 25 ++- .../prog/en/modules/admin/admin-home.tt | 193 +++++++++++++-------- svc/config/systempreferences | 2 +- svc/localization | 2 +- 47 files changed, 414 insertions(+), 187 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql --- a/admin/audio_alerts.pl +++ a/admin/audio_alerts.pl @@ -40,7 +40,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_audio_alerts' }, debug => 1, } ); --- a/admin/auth_subfields_structure.pl +++ a/admin/auth_subfields_structure.pl @@ -62,7 +62,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/auth_tag_structure.pl +++ a/admin/auth_tag_structure.pl @@ -50,7 +50,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_marc_frameworks'}, debug => 1, }); --- a/admin/authorised_values.pl +++ a/admin/authorised_values.pl @@ -40,7 +40,7 @@ my @messages; our ($template, $borrowernumber, $cookie)= get_template_and_user({ template_name => "admin/authorised_values.tt", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_auth_values'}, query => $input, type => "intranet", debug => 1, --- a/admin/authtypes.pl +++ a/admin/authtypes.pl @@ -37,7 +37,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/biblio_framework.pl +++ a/admin/biblio_framework.pl @@ -39,7 +39,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/branch_transfer_limits.pl +++ a/admin/branch_transfer_limits.pl @@ -33,7 +33,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({template_name => "admin/branch_transfer_limits.tt", query => $input, type => "intranet", - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_transfers'}, debug => 1, }); --- a/admin/branches.pl +++ a/admin/branches.pl @@ -39,7 +39,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_libraries' }, debug => 1, } ); --- a/admin/categories.pl +++ a/admin/categories.pl @@ -43,7 +43,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_patron_categories' }, debug => 1, } ); --- a/admin/checkmarc.pl +++ a/admin/checkmarc.pl @@ -33,7 +33,7 @@ my ($template, $borrowernumber, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, }); --- a/admin/cities.pl +++ a/admin/cities.pl @@ -37,7 +37,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_cities' }, debug => 1, } ); --- a/admin/classsources.pl +++ a/admin/classsources.pl @@ -39,7 +39,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_classifications'}, debug => 1, }); --- a/admin/clone-rules.pl +++ a/admin/clone-rules.pl @@ -41,7 +41,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_circ_rules'}, debug => 1, }); --- a/admin/columns_settings.pl +++ a/admin/columns_settings.pl @@ -15,7 +15,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_column_config' }, debug => 1, } ); --- a/admin/didyoumean.pl +++ a/admin/didyoumean.pl @@ -16,7 +16,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => 'manage_didyoumean'}, debug => 1, }); --- a/admin/fieldmapping.pl +++ a/admin/fieldmapping.pl @@ -41,7 +41,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_keywords2marc_mappings' }, debug => 1, } ); --- a/admin/import_export_framework.pl +++ a/admin/import_export_framework.pl @@ -31,7 +31,7 @@ my ($auth_status, $sessionID); if (exists $cookies{'CGISESSID'}) { ($auth_status, $sessionID) = check_cookie_auth( $cookies{'CGISESSID'}->value, - { parameters => 'parameters_remaining_permissions' }, + { parameters => 'manage_marc_frameworks' }, ); } if ($auth_status eq 'ok') { --- a/admin/item_circulation_alerts.pl +++ a/admin/item_circulation_alerts.pl @@ -44,7 +44,7 @@ sub show { query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'item_circ_alerts' }, debug => defined($input->param('debug')), } ); --- a/admin/items_search_field.pl +++ a/admin/items_search_field.pl @@ -31,7 +31,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user({ query => $cgi, type => 'intranet', authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { parameters => 'manage_item_search_fields' }, }); my $op = $cgi->param('op') || ''; --- a/admin/items_search_fields.pl +++ a/admin/items_search_fields.pl @@ -31,7 +31,7 @@ my ($template, $borrowernumber, $cookie) = get_template_and_user({ query => $cgi, type => 'intranet', authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { parameters => 'manage_item_search_fields' }, }); my $op = $cgi->param('op') || ''; --- a/admin/itemtypes.pl +++ a/admin/itemtypes.pl @@ -46,7 +46,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_itemtypes' }, debug => 1, } ); --- a/admin/koha2marclinks.pl +++ a/admin/koha2marclinks.pl @@ -37,7 +37,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user ( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/library_groups.pl +++ a/admin/library_groups.pl @@ -35,7 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_libraries' }, debug => 1, } ); --- a/admin/localization.pl +++ a/admin/localization.pl @@ -31,7 +31,7 @@ my $query = new CGI; my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { template_name => "admin/localization.tt", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_itemtypes' }, query => $query, type => "intranet", debug => 1, --- a/admin/marc_subfields_structure.pl +++ a/admin/marc_subfields_structure.pl @@ -75,7 +75,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, } ); --- a/admin/marctagstructure.pl +++ a/admin/marctagstructure.pl @@ -53,7 +53,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_marc_frameworks' }, debug => 1, }); --- a/admin/matching-rules.pl +++ a/admin/matching-rules.pl @@ -38,7 +38,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_matching_rules' }, debug => 1, }); --- a/admin/oai_set_mappings.pl +++ a/admin/oai_set_mappings.pl @@ -45,7 +45,7 @@ my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( { query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { 'parameters' => 'parameters_remaining_permissions' }, + flagsrequired => { 'parameters' => 'manage_oai_sets' }, debug => 1, } ); --- a/admin/oai_sets.pl +++ a/admin/oai_sets.pl @@ -41,7 +41,7 @@ my ($template, $loggedinuser, $cookie, $flags) = get_template_and_user( { query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { 'parameters' => 'parameters_remaining_permissions' }, + flagsrequired => { 'parameters' => 'manage_oai_sets' }, debug => 1, } ); --- a/admin/patron-attr-types.pl +++ a/admin/patron-attr-types.pl @@ -45,7 +45,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' } + flagsrequired => { parameters => 'manage_patron_attributes' } } ); --- a/admin/preferences.pl +++ a/admin/preferences.pl @@ -300,7 +300,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sysprefs' }, debug => 1, } ); --- a/admin/printers.pl +++ a/admin/printers.pl @@ -70,7 +70,7 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => {parameters => '*'}, debug => 1, } ); --- a/admin/searchengine/elasticsearch/mappings.pl +++ a/admin/searchengine/elasticsearch/mappings.pl @@ -31,7 +31,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => 'intranet', authnotrequired => 0, - flagsrequired => { superlibrarian => 1 }, # Create a specific permission? + flagsrequired => { parameters => 'manage_search_engine_config' }, } ); --- a/admin/sms_providers.pl +++ a/admin/sms_providers.pl @@ -36,7 +36,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $cgi, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sms_providers' }, debug => 1, } ); --- a/admin/sru_modmapping.pl +++ a/admin/sru_modmapping.pl @@ -32,6 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { query => $input, type => "intranet", authnotrequired => 0, + flagsrequired => { parameters => 'manage_search_targets' }, }); # Main code: convert mapping string to hash structure and show template --- a/admin/systempreferences.pl +++ a/admin/systempreferences.pl @@ -216,7 +216,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => 'parameters_remaining_permissions' }, + flagsrequired => { parameters => 'manage_sysprefs' }, debug => 1, } ); --- a/admin/transport-cost-matrix.pl +++ a/admin/transport-cost-matrix.pl @@ -37,7 +37,7 @@ my ($template, $loggedinuser, $cookie) query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 1}, + flagsrequired => { parameters => 'manage_transfers' }, debug => 1, }); my $use_transport_cost_matrix = C4::Context->preference("UseTransportCostMatrix"); --- a/admin/usage_statistics.pl +++ a/admin/usage_statistics.pl @@ -30,7 +30,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { parameters => '*' }, + flagsrequired => { parameters => 'manage_usage_stats' }, debug => 1, } ); --- a/admin/z3950servers.pl +++ a/admin/z3950servers.pl @@ -44,7 +44,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { query => $input, type => "intranet", authnotrequired => 0, - flagsrequired => {parameters => 'parameters_remaining_permissions'}, + flagsrequired => { parameters => 'manage_search_targets' }, debug => 1, }); my $script_name = "/cgi-bin/koha/admin/z3950servers.pl"; --- a/api/v1/swagger/paths/cities.json +++ a/api/v1/swagger/paths/cities.json @@ -112,7 +112,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } } @@ -213,7 +213,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } }, @@ -267,7 +267,7 @@ }, "x-koha-authorization": { "permissions": { - "parameters": "parameters_remaining_permissions" + "parameters": "manage_cities" } } } --- a/installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql +++ a/installer/data/mysql/atomicupdate/bug14391_granular_admin_permissions.sql @@ -0,0 +1,82 @@ +INSERT INTO permissions (module_bit, code, description) VALUES + ( 3, 'manage_sysprefs', 'Manage global system preferences'), + ( 3, 'manage_libraries', 'Manage libraries and library groups'), + ( 3, 'manage_itemtypes', 'Manage item types'), + ( 3, 'manage_auth_values', 'Manage authorized values'), + ( 3, 'manage_patron_categories', 'Manage patron categories'), + ( 3, 'manage_patron_attributes', 'Manage extended patron attributes'), + ( 3, 'manage_transfers', 'Manage library transfer limits and transport cost matrix'), + ( 3, 'manage_item_circ_alerts', 'Manage item circulation alerts'), + ( 3, 'manage_cities', 'Manage cities and towns'), + ( 3, 'manage_marc_frameworks', 'Manage MARC bibliographic and authority frameworks'), + ( 3, 'manage_keywords2koha_mappings', 'Manage keywords to Koha mappings'), + ( 3, 'manage_classifications', 'Manage classification sources'), + ( 3, 'manage_matching_rules', 'Manage record matching rules'), + ( 3, 'manage_oai_sets', 'Manage OAI sets'), + ( 3, 'manage_item_search_fields', 'Manage item search fields'), + ( 3, 'manage_search_engine_config', 'Manage search engine configuration'), + ( 3, 'manage_search_targets', 'Manage Z39.50 and SRU server configuration'), + ( 3, 'manage_didyoumean', 'Manage Did you mean? configuration'), + ( 3, 'manage_column_config', 'Manage column configuration'), + ( 3, 'manage_sms_providers', 'Manage SMS cellular providers'), + ( 3, 'manage_audio_alerts', 'Manage audio alerts'), + ( 3, 'manage_usage_stats', 'Manage usage statistics settings'); + +/* User has parameters_remaining_permissions */ +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_sysprefs' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_libraries' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_itemtypes' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_auth_values' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_patron_categories' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_patron_attributes' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_transfers' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_circ_alerts' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_cities' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_marc_frameworks' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_keywords2koha_mappings' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_classifications' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_matching_rules' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_oai_sets' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_search_fields' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_search_engine_config' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_search_targets' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_didyoumean' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_column_config' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_sms_providers' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_audio_alerts' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_usage_stats' FROM borrowers WHERE borrowernumber IN (SELECT borrowernumber FROM user_permissions WHERE code = 'parameters_remaining_permissions'); + +/* User has catalogue permission */ +INSERT INTO user_permissions (borrowernumber, module_bit, code) + SELECT borrowernumber, 3, 'manage_item_search_fields' + FROM borrowers + WHERE borrowernumber IN + (SELECT borrowernumber FROM user_permissions WHERE code = 'catalogue'); + +/* Clean up now obsolete permission */ +DELETE FROM user_permissions WHERE module_bit = 3 and code = 'parameters_remaining_permissions'; +DELETE FROM permissions WHERE module_bit = 3 and code = 'parameters_remaining_permissions'; + +-- Bug 14391: Add granular permissions to the administration module --- a/installer/data/mysql/userpermissions.sql +++ a/installer/data/mysql/userpermissions.sql @@ -5,8 +5,29 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 1, 'force_checkout', 'Force checkout if a limitation exists'), ( 1, 'manage_restrictions', 'Manage restrictions for accounts'), ( 1, 'manage_checkout_notes', 'Mark checkout notes as seen/not seen'), - ( 3, 'parameters_remaining_permissions', 'Remaining system parameters permissions'), ( 3, 'manage_circ_rules', 'Manage circulation rules'), + ( 3, 'manage_sysprefs', 'Manage global system preferences'), + ( 3, 'manage_libraries', 'Manage libraries and library groups'), + ( 3, 'manage_itemtypes', 'Manage item types'), + ( 3, 'manage_auth_values', 'Manage authorized values'), + ( 3, 'manage_patron_categories', 'Manage patron categories'), + ( 3, 'manage_patron_attributes', 'Manage extended patron attributes'), + ( 3, 'manage_transfers', 'Manage library transfer limits and transport cost matrix'), + ( 3, 'manage_item_circ_alerts', 'Manage item circulation alerts'), + ( 3, 'manage_cities', 'Manage cities and towns'), + ( 3, 'manage_marc_frameworks', 'Manage MARC bibliographic and authority frameworks'), + ( 3, 'manage_keywords2koha_mappings', 'Manage keywords to Koha mappings'), + ( 3, 'manage_classifications', 'Manage classification sources'), + ( 3, 'manage_matching_rules', 'Manage record matching rules'), + ( 3, 'manage_oai_sets', 'Manage OAI sets'), + ( 3, 'manage_item_search_fields', 'Manage item search fields'), + ( 3, 'manage_search_engine_config', 'Manage search engine configuration'), + ( 3, 'manage_search_targets', 'Manage Z39.50 and SRU server configuration'), + ( 3, 'manage_didyouean', 'Manage Did you mean? configuration'), + ( 3, 'manage_column_config', 'Manage column configuration'), + ( 3, 'manage_sms_providers', 'Manage SMS cellular providers'), + ( 3, 'manage_audio_alerts', 'Manage audio alerts'), + ( 3, 'manage_usage_stats', 'Manage usage statistics settings'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), ( 6, 'place_holds', 'Place holds for patrons'), --- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc @@ -2,86 +2,137 @@ --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -32,8 +32,29 @@ [%- CASE 'overdues_report' -%]Execute overdue items report [%- CASE 'override_renewals' -%]Override blocked renewals [%- CASE 'manage_checkout_notes' %]Mark checkout notes as seen/not seen - [%- CASE 'manage_circ_rules' -%]manage circulation rules - [%- CASE 'parameters_remaining_permissions' -%]Remaining system parameters permissions + [%- CASE 'manage_circ_rules' -%]Manage circulation rules + [%- CASE 'manage_sysprefs' -%]Manage global system preferences + [%- CASE 'manage_libraries' -%]Manage libraries and library groups + [%- CASE 'manage_itemtypes' -%]Manage item types + [%- CASE 'manage_auth_values' -%]Manage authorized value categories and authorized values + [%- CASE 'manage_patron_categories' -%]Manage patron categories + [%- CASE 'manage_patron_attributes' -%]Manage extended patron attributes + [%- CASE 'manage_transfers' -%]Manage library transfer limits and transport cost matrix + [%- CASE 'manage_item_circ_alerts' -%]Manage item circulation alerts + [%- CASE 'manage_cities' -%]Manage cities and towns + [%- CASE 'manage_marc_frameworks' -%]Manage MARC bibliographic and authority frameworks and test them + [%- CASE 'manage_keywords2koha_mappings' -%]Manage keywords to Koha mappings + [%- CASE 'manage_classfications' -%]Manage classification sources and filing rules + [%- CASE 'manage_matching_rules' -%]Manage record matching rules + [%- CASE 'manage_oai_sets' -%]Manage OAI sets + [%- CASE 'manage_item_search_fields' -%]Manage item search fields + [%- CASE 'manage_search_engine_config' -%]Manage search enginge configuration + [%- CASE 'manage_search_targets' -%]Manage Z39.50 and SRU server confiugration + [%- CASE 'manage_didyoumean' -%]Manage Did you mean? configuration + [%- CASE 'manage_column_config' -%]Manage column configuation + [%- CASE 'manage_audio_alerts' -%]Manage audio alerts + [%- CASE 'manage_sms_providers' -%]Manage SMS cellular providers + [%- CASE 'manage_usage_stats' -%]Manage usage statistics settings [%- CASE 'edit_borrowers' -%]Add, modify and view patron information [%- CASE 'view_borrower_infos_from_any_libraries' -%]View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. [%- CASE 'modify_holds_priority' -%]Modify holds priority --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt @@ -17,7 +17,7 @@

Koha administration

- + [% IF ( CAN_user_parameters_manage_sysprefs ) %]

Global system preferences

@@ -27,75 +27,114 @@
+ [% END %] + [% IF ( CAN_user_parameters_manage_libraries || CAN_user_parameters_manage_itemtypes || CAN_user_parameters_manage_auth_values ) %]

Hint:

Configure these parameters in the order they appear.

Basic parameters

-
Libraries
-
Define libraries.
-
Library groups
-
Define hierarchical library groups.
-
Item types
-
Define item types used for circulation rules.
-
Authorized values
-
Define categories and authorized values for them.
+ [% IF ( CAN_user_parameters_manage_libraries ) %] +
Libraries
+
Define libraries.
+
Library groups
+
Define hierarchical library groups.
+ [% END %] + [% IF ( CAN_user_parameters_manage_itemtypes ) %] +
Item types
+
Define item types used for circulation rules.
+ [% END %] + [% IF ( CAN_user_parameters_manage_auth_values ) %] +
Authorized values
+
Define categories and authorized values for them.
+ [% END %]
+ [% END %] + [% IF ( CAN_user_parameters_patron_categories || CAN_user_parameters_manage_circ_rules || CAN_user_parameters_manage_patron_attributes || CAN_user_parameters_manage_transfers || CAN_user_parameters_manage_item_circ_alerts || CAN_user_parameters_manage_cities ) %]

Patrons and circulation

-
Patron categories
-
Define patron categories.
- [% IF CAN_user_parameters_manage_circ_rules %] -
Circulation and fines rules
-
Define circulation and fines rules for combinations of libraries, patron categories, and item types
- [% END %] -
Patron attribute types
-
Define extended attributes (identifiers and statistical categories) for patron records
-
Library transfer limits
-
Limit the ability to transfer items between libraries based on the library sending, the library receiving, and the item type involved. These rules only go into effect if the preference UseBranchTransferLimits is set to ON.
-
Transport cost matrix
-
Define transport costs between branches
-
Item circulation alerts
-
Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types
-
Cities and towns
-
Define cities and towns that your patrons live in.
+ [% IF ( CAN_user_parameters_patron_categories ) %] +
Patron categories
+
Define patron categories.
+ [% END %] + [% IF ( CAN_user_parameters_manage_circ_rules ) %] +
Circulation and fines rules
+
Define circulation and fines rules for combinations of libraries, patron categories, and item types
+ [% END %] + [% IF ( CAN_user_parameters_manage_patron_attributes ) %] +
Patron attribute types
+
Define extended attributes (identifiers and statistical categories) for patron records
+ [% END %] + [% IF ( CAN_user_parameters_manage_transfers ) %] +
Library transfer limits
+
Limit the ability to transfer items between libraries based on the library sending, the library receiving, and the item type involved. These rules only go into effect if the preference UseBranchTransferLimits is set to ON.
+
Transport cost matrix
+
Define transport costs between branches
+ [% END %] + [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %] +
Item circulation alerts
+
Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types
+ [% END %] + [% IF ( CAN_user_parameters_manage_cities ) %] +
Cities and towns
+
Define cities and towns that your patrons live in.
+ [% END %]
- [% IF CAN_user_plugins && plugins_enabled %] -

Plugins

-
-
Manage plugins
-
View, manage, configure and run plugins.
-
- [% END %] -
-
+ [% END %] + + [% IF CAN_user_plugins && plugins_enabled %] +

Plugins

+
+
Manage plugins
+
View, manage, configure and run plugins.
+
+ [% END %] +
+ +
+ [% IF ( CAN_user_parameters_manage_keywords2koha_mappings || CAN_user_parameters_manage_marc_frameworks || CAN_user_parameters_manage_classifications || CAN_user_parameters_manage_matching_rules || CAN_user_parameters_manage_oai_sets || CAN_user_parameters_manage_item_search_fields || (Koha.Preference('SearchEngine') == 'Elasticsearch' && CAN_user_parameters_search_engine_config) ) %]

Catalog

-
MARC bibliographic framework
-
Create and manage Bibliographic frameworks that define the characteristics of your MARC Records (field and subfield definitions) as well as templates for the MARC editor.
-
Koha to MARC mapping
-
Define the mapping between the Koha transactional database (SQL) and the MARC Bibliographic records.
-
Keywords to MARC mapping
-
Define the mapping between keywords and MARC fields. The keywords are used to find some data independently of the framework.
-
MARC Bibliographic framework test
-
Checks the MARC structure. If you change your MARC Bibliographic framework it's recommended that you run this tool to test for errors in your definition.
-
Authority types
-
Create and manage Authorities frameworks that define the characteristics of your MARC Records (field and subfield definitions).
-
Classification sources
-
Define classification sources (i.e., call number schemes) used by your collection. Also define filing rules used for sorting call numbers.
-
Record matching rules
-
Manage rules for automatically matching MARC records during record imports.
-
OAI sets configuration
-
Manage OAI Sets
-
Item search fields
-
Manage custom fields for item search.
- [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %] + [% IF ( CAN_user_parameters_manage_marc_frameworks ) %] +
MARC bibliographic framework
+
Create and manage Bibliographic frameworks that define the characteristics of your MARC Records (field and subfield definitions) as well as templates for the MARC editor.
+
Koha to MARC mapping
+
Define the mapping between the Koha transactional database (SQL) and the MARC Bibliographic records.
+ [% END %] + [% IF ( CAN_user_parameters_manage_keywords2koha_mappings ) %] +
Keywords to MARC mapping
+
Define the mapping between keywords and MARC fields. The keywords are used to find some data independently of the framework.
+ [% END %] + [% IF ( CAN_user_parameters_manage_marc_frameworks ) %] +
MARC Bibliographic framework test
+
Checks the MARC structure. If you change your MARC Bibliographic framework it's recommended that you run this tool to test for errors in your definition.
+
Authority types
+
Create and manage Authorities frameworks that define the characteristics of your MARC Records (field and subfield definitions).
+ [% END %] + [% IF ( CAN_user_parameters_manage_classifications ) %] +
Classification sources
+
Define classification sources (i.e., call number schemes) used by your collection. Also define filing rules used for sorting call numbers.
+ [% END %] + [% IF ( CAN_user_parameters_manage_matching_rules ) %] +
Record matching rules
+
Manage rules for automatically matching MARC records during record imports.
+ [% END %] + [% IF ( CAN_user_parameters_manage_oai_sets ) %] +
OAI sets configuration
+
Manage OAI Sets
+ [% END %] + [% IF ( CAN_user_parameters_manage_item_search_fields ) %] +
Item search fields
+
Manage custom fields for item search.
+ [% END %] + [% IF ( Koha.Preference('SearchEngine') == 'Elasticsearch' && CAN_user_parameters_search_engine_config ) %]
Search engine configuration
Manage indexes, facets, and their mappings to MARC fields and subfields.
[% END %]
+ [% END %] - [% IF ( CAN_user_acquisition_currencies_manage || CAN_user_acquisition_period_manage || CAN_user_acquisition_budget_manage || CAN_user_acquisition_edi_manage ) %] + [% IF ( CAN_user_acquisition_currencies_manage || CAN_user_acquisition_period_manage || CAN_user_acquisition_budget_manage || CAN_user_acquisition_edi_manage ) %]

Acquisition parameters

[% IF ( CAN_user_acquisition_currencies_manage ) %] @@ -117,27 +156,39 @@
Manage library EDI EANs
[% END %]
- [% END %] + [% END %] + [% IF ( ( CAN_user_parameters_manage_search_targets || CAN_user_parameters_manage_didyoumean || CAN_user_parameters_manage_column_config || CAN_user_parameters_manage_audio_alerts || CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) || CAN_user_parameters_manage_usage_stats ) %]

Additional parameters

- -
Z39.50/SRU servers
-
Define which external servers to query for MARC data.
-
Did you mean?
-
Choose which plugins to use to suggest searches to patrons and staff.
-
Configure columns
-
Hide or show columns for tables.
-
Audio alerts
-
Define which events trigger which sounds
- [% IF Koha.Preference('SMSSendDriver') == 'Email' %] -
SMS cellular providers
-
Define a list of cellular providers for sending SMS messages via email.
- [% END %] -
Share your usage statistics
-
Share with the Koha community the usage statistics of your Koha installation.
+ + [% IF ( CAN_user_parameters_manage_search_targets ) %] +
Z39.50/SRU servers
+
Define which external servers to query for MARC data.
+ [% END %] + [% IF ( CAN_user_parameters_manage_didyoumean ) %] +
Did you mean?
+
Choose which plugins to use to suggest searches to patrons and staff.
+ [% END %] + [% IF ( CAN_user_parameters_manage_column_config ) %] +
Configure columns
+
Hide or show columns for tables.
+ [% END %] + [% IF ( CAN_user_parameters_manage_audio_alerts ) %] +
Audio alerts
+
Define which events trigger which sounds
+ [% END %] + [% IF ( CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) %] +
SMS cellular providers
+
Define a list of cellular providers for sending SMS messages via email.
+ [% END %] + [% IF ( CAN_user_parameters_manage_usage_stats ) %] +
Share your usage statistics
+
Share with the Koha community the usage statistics of your Koha installation.
+ [% END %]
+ [% END %]
--- a/svc/config/systempreferences +++ a/svc/config/systempreferences @@ -41,7 +41,7 @@ batches. =cut -our ( $query, $response ) = C4::Service->init( parameters => 'parameters_remaining_permissions' ); +our ( $query, $response ) = C4::Service->init( parameters => 'manage_sysprefs' ); =head2 set_preference --- a/svc/localization +++ a/svc/localization @@ -6,7 +6,7 @@ use Encode qw( encode ); use C4::Service; use Koha::Localizations; -our ( $query, $response ) = C4::Service->init( parameters => 'parameters_remaining_permissions' ); +our ( $query, $response ) = C4::Service->init( parameters => 'manage_itemtypes' ); sub get_translations { my $rs = Koha::Localizations->search({ entity => $query->param('entity'), code => $query->param('code') }); --