From a806000c20e98ceb01c206c1b623dc1502e9ddc3 Mon Sep 17 00:00:00 2001
From: Hayley Mapley <hayleymapley@catalyst.net.nz>
Date: Wed, 8 May 2019 15:39:33 +1200
Subject: [PATCH] Bug 22724: Allow only users with correct permissions to
 'Write off selected'

Due to the addition of a 'Write off selected' button in 18.11, users without
writeoff permissions could mistakenly view and action the 'Write off
selected' option for a patron in Accounting > Make a payment (Fines > Pay fines).
The attached patch corrects this error.

Test plan:
1) Make sure that a staff user has '(writeoff) Write off fines and fees'
permission disabled
2) Bring up a patron with an unpaid fee, go to Accounting -> Make a
payment
3) Note that 'Write off selected' button is displayed.
4) Select a fee, click 'Write off selected'. Note that staff member has
access to 'Write off an amount toward selected fines'
5) Apply the patch
6) Repeat steps 1-2, and note that the button is no longer displayed
7) Bonus points, as a staff user with writeoff permissions enabled check
that all four buttons (Pay amount, Pay selected, Write off all, Write
off selected) are displayed

Sponsored-by: Catalyst IT

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
index 9d737bf614..10796dd9f0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
@@ -141,9 +141,9 @@
 </table>
 <fieldset class="action">
 <input type="submit" id="paycollect" name="paycollect"  value="Pay amount" class="submit" />
-[% IF CAN_user_updatecharges_writeoff %]<input type="submit" name="woall"  id="woall" value="Write off all" class="submit" />[% END %]
 <input type="submit" id="payselected" name="payselected"  value="Pay selected" class="submit" />
-<input type="submit" id="writeoff-selected" name="writeoff_selected"  value="Write off selected" class="submit" />
+[% IF CAN_user_updatecharges_writeoff %]<input type="submit" name="woall"  id="woall" value="Write off all" class="submit" />
+<input type="submit" id="writeoff-selected" name="writeoff_selected"  value="Write off selected" class="submit" />[% END %]
 <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
 </fieldset>
 </form>
-- 
2.11.0