From e546b194b7174806ce9f1db610b2d223a1b98a12 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Tue, 18 Dec 2018 12:05:10 +0000
Subject: [PATCH] Bug 15774: Add permission for managing additional fields

To test:
 1 - Have three borrowers, one with order_manage permission, one with
 edit_subscription permisson, andone with both
 2 - Apply patch, updatedatabase
 3 - Verify all three now have the manage_additional_fields permission
 4 - Visit the admin page with these users, they should all see the
 'Manage additional fields' link
 5 - Click the link
 6 - User with order_manage should see 'Order baskest'
 7 - User with edit_subscription should see 'Subscriptions'
 8 - User with both should see both
 9 - Remove the additional permissions from a user - they should see a
 note about needing additional permissions
---
 admin/additional-fields.pl                                | 15 ++++++++++++---
 .../Bug_15774_add_additional_fields_permissions.perl      | 14 ++++++++++++++
 koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc   |  4 ++--
 koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc  |  1 +
 .../prog/en/modules/admin/additional-fields.tt            | 12 ++++++++++--
 .../intranet-tmpl/prog/en/modules/admin/admin-home.tt     |  4 ++--
 6 files changed, 41 insertions(+), 9 deletions(-)
 create mode 100644 installer/data/mysql/atomicupdate/Bug_15774_add_additional_fields_permissions.perl

diff --git a/admin/additional-fields.pl b/admin/additional-fields.pl
index 5bc722c09d..1b306f1ad7 100755
--- a/admin/additional-fields.pl
+++ b/admin/additional-fields.pl
@@ -26,19 +26,28 @@ use Koha::AdditionalFields;
 
 my $input = new CGI;
 
+my %flagsrequired;
+$flagsrequired{parameters} = 'manage_additional_fields';
+
+my $tablename = $input->param('tablename');
+my $op = $input->param('op') // ( $tablename ? 'list' : 'list_tables' );
+
+if( $op ne 'list_tables' ){
+    $flagsrequired{acquisition} = 'order_manage' if $tablename eq 'aqbasket';
+    $flagsrequired{serials} = 'edit_subscription' if $tablename eq 'subscription';
+}
+
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
         template_name   => "admin/additional-fields.tt",
         query           => $input,
         type            => "intranet",
         authnotrequired => 0,
-        flagsrequired   => { parameters => 1 },
+        flagsrequired   => \%flagsrequired,
         debug           => 1,
     }
 );
 
-my $tablename = $input->param('tablename');
-my $op = $input->param('op') // ( $tablename ? 'list' : 'list_tables' );
 my $field_id = $input->param('field_id');
 my @messages;
 
diff --git a/installer/data/mysql/atomicupdate/Bug_15774_add_additional_fields_permissions.perl b/installer/data/mysql/atomicupdate/Bug_15774_add_additional_fields_permissions.perl
new file mode 100644
index 0000000000..948f0aad94
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/Bug_15774_add_additional_fields_permissions.perl
@@ -0,0 +1,14 @@
+$DBversion = 'XXX';
+if( CheckVersion( $DBversion ) ) {
+    $dbh->do( q{
+        INSERT IGNORE INTO permissions (module_bit,code,description)
+        VALUES
+        (3,'manage_additional_fields','Add, edit, or delete additional custom fields for baskets or subscriptions (also requires order_manage or edit_subscription permissions)')
+    });
+    $dbh->do( q{
+        INSERT INTO user_permissions (borrowernumber, module_bit, code)
+        SELECT borrowernumber, 3, 'manage_additional_fields' FROM borrowers WHERE borrowernumber IN (SELECT DISTINCT borrowernumber FROM user_permissions WHERE code = 'order_manage' OR code = 'edit_subscription');
+    });
+    SetVersion( $DBversion );
+    print "Upgrade to $DBversion done (Bug 15774 - Add permission for managing additional fields)\n";
+}
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc
index d9be812949..59463e7324 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc
@@ -110,7 +110,7 @@
         </ul>
     [% END %]
 
-    [% IF ( CAN_user_parameters_manage_search_targets || CAN_user_parameters_manage_didyoumean || CAN_user_parameters_manage_column_config || CAN_user_parameters_manage_audio_alerts || ( CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) || CAN_user_parameters_manage_usage_stats || CAN_user_parameters_manage_additional_fields_baskets || CAN_user_parameters_manage_additional_fields_subscriptions ) %]
+    [% IF ( CAN_user_parameters_manage_search_targets || CAN_user_parameters_manage_didyoumean || CAN_user_parameters_manage_column_config || CAN_user_parameters_manage_audio_alerts || ( CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) || CAN_user_parameters_manage_usage_stats || CAN_user_parameters_manage_additional_fields ) %]
         <h5>Additional parameters</h5>
         <ul>
             <!-- <li><a href="/cgi-bin/koha/admin/printers.pl">Network Printers</a></li> -->
@@ -132,7 +132,7 @@
             [% IF ( CAN_user_parameters_manage_usage_stats ) %]
                 <li><a href="/cgi-bin/koha/admin/usage_statistics.pl">Share usage statistics</a></li>
             [% END %]
-            [% IF ( CAN_user_parameters_manage_additional_fields_baskets || CAN_user_parameters_manage_additional_fields_subscriptions ) %]
+            [% IF ( CAN_user_parameters_manage_additional_fields ) %]
                 <li><a href="/cgi-bin/koha/admin/additional-fields.pl">Additional fields</a></li>
             [% END %]
         </ul>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
index ff2d8ee3c8..8538448463 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
@@ -57,6 +57,7 @@
     [%- CASE 'manage_didyoumean' -%]<span>Manage Did you mean? configuration</span>
     [%- CASE 'manage_column_config' -%]<span>Manage column configuration</span>
     [%- CASE 'manage_audio_alerts' -%]<span>Manage audio alerts</span>
+    [%- CASE 'manage_additional_fields' -%]<span>Manage additional fields for baskets or subscriptions (requires edit_subscription or order_manage permissions)</span>
     [%- CASE 'manage_sms_providers' -%]<span>Manage SMS cellular providers</span>
     [%- CASE 'manage_usage_stats' -%]<span>Manage usage statistics settings</span>
     [%- CASE 'edit_borrowers' -%]<span>Add, modify and view patron information</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
index 3b5309cfe4..ad1ebb718d 100755
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
@@ -64,15 +64,23 @@
     [% END %]
 
     [% IF op == 'list_tables' %]
+        [% IF CAN_user_acquisitions_order_manage || CAN_user_serials_edit_subscription %]
         <h3>Additional fields</h3>
         <p>Select a table:</p>
         [% BLOCK table_option %]
             <li><a href="?tablename=[% value | uri %]">[% content | html %] (<tt>[% value | html %]</tt>)</a></li>
         [% END %]
         <ul>
-            [% WRAPPER table_option value="aqbasket" %]Order baskets[% END %]
-            [% WRAPPER table_option value="subscription" %]Subscriptions[% END %]
+            [% IF CAN_user_acquisition_order_manage %]
+                [% WRAPPER table_option value="aqbasket" %]Order baskets[% END %]
+            [% END %]
+            [% IF CAN_user_serials_edit_subscription %]
+                [% WRAPPER table_option value="subscription" %]Subscriptions[% END %]
+            [% END %]
         </ul>
+        [% ELSE %]
+            Additional permissions in the acquisitions or serials modules are required for editing additional fields
+        [% END %]
     [% ELSIF op == 'list' %]
         <h3>Additional fields for '[% tablename | html %]'</h3>
         [% IF fields %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
index cbb5d741cd..5ca3a78f17 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
@@ -158,7 +158,7 @@
                 </dl>
             [% END %]
 
-            [% IF ( ( CAN_user_parameters_manage_search_targets || CAN_user_parameters_manage_didyoumean || CAN_user_parameters_manage_column_config || CAN_user_parameters_manage_audio_alerts || CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) || CAN_user_parameters_manage_usage_stats || CAN_user_parameters_manage_additional_fields_baskets || CAN_user_parameters_manage_additional_fields_subscriptions ) %]
+            [% IF ( ( CAN_user_parameters_manage_search_targets || CAN_user_parameters_manage_didyoumean || CAN_user_parameters_manage_column_config || CAN_user_parameters_manage_audio_alerts || CAN_user_parameters_manage_sms_providers && Koha.Preference('SMSSendDriver') == 'Email' ) || CAN_user_parameters_manage_usage_stats || CAN_user_parameters_manage_additional_fields ) %]
                 <h3>Additional parameters</h3>
                 <dl>
                         <!-- <dt><a href="/cgi-bin/koha/admin/printers.pl">Network Printers</a></dt>
@@ -187,7 +187,7 @@
                         <dt><a href="/cgi-bin/koha/admin/usage_statistics.pl">Share your usage statistics</a></dt>
                         <dd>Share with the Koha community the usage statistics of your Koha installation.</dd>
                     [% END %]
-                    [% IF ( CAN_user_parameters_manage_additional_fields_baskets || CAN_user_parameters_manage_additional_fields_subscriptions ) %]
+                    [% IF ( CAN_user_parameters_manage_additional_fields ) %]
                     <dt><a href="/cgi-bin/koha/admin/additional-fields.pl">Additional fields</a></dt>
                     <dd>Add additional fields to certain tables</dd>
                     [% END %]
-- 
2.11.0