From bf642fa8d05dabace85cd3e971a5c060b61c9105 Mon Sep 17 00:00:00 2001 From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Date: Sat, 22 Jun 2019 19:29:42 -0500 Subject: [PATCH] Bug 22786: Prevent fund creation for locked budgets If a budget is locked, there is a "New fund for $budget" link that is disabled but clickable. We should ensure that the link is not clickable and prevent it at controller level (do we need it at module level, ie. Koha::Acquisition::Fund->store?) Test plan: - Create a budget, lock it - Go to /cgi-bin/koha/admin/aqbudgetperiods.pl - Click on the name of the budget you just created => The "New > New fund for $budget_name" button should be disabled - Click it anyway => Without this patch the form to add a new fund is displayed => With this patch applied nothing happens - Hit /cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_period_id=XXX With XXX the budget's id => Without this patch the form is displayed => With this patch applied you get a message: "The budget is locked, fund creation is not possible." And you are not able to create a new fund QA notes: 1. See description 2. The add_validate op can still be forced, let trust librarians with administration permissions for now. Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz> --- admin/aqbudgets.pl | 2 ++ koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc | 2 ++ koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc | 5 ++++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/admin/aqbudgets.pl b/admin/aqbudgets.pl index 44f0d7fd08a..684e0e2159a 100755 --- a/admin/aqbudgets.pl +++ b/admin/aqbudgets.pl @@ -115,6 +115,8 @@ if ($op eq 'add_form') { } $dropbox_disabled = BudgetHasChildren($budget_id); $budget->{budget_owner} = Koha::Patrons->find( $budget->{budget_owner_id} ); + } elsif ( $period->{budget_period_locked} ) { + output_and_exit( $input, $cookie, $template, 'budget_is_locked' ); } # build budget hierarchy diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc index 8db6e956db6..510d95fbc2a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc @@ -15,6 +15,8 @@ <div class="dialog message">Vendor not found.</div> [% CASE 'wrong_csrf_token' %] <div class="dialog message">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div> + [% CASE 'budget_is_locked' %] + <div class="dialog message">The budget is locked, fund creation is not possible.</div> [% CASE %][% blocking_error | html %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc index 2a2cd830ade..05b0961bc79 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc @@ -7,10 +7,13 @@ <li><a href="/cgi-bin/koha/admin/aqbudgetperiods.pl?op=add_form">New budget</a></li> [% IF ( budget_period_locked || !CAN_user_acquisition_budget_add_del ) %] <li class="disabled"> + <a data-toggle="tooltip" data-placement="left" title="The budget is locked" href="#">New fund for [% budget_period_description | html %]</a> + </li> [% ELSE %] <li> + <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_period_id=[% budget_period_id | uri %]">New fund for [% budget_period_description | html %]</a> + </li> [% END %] - <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_period_id=[% budget_period_id | uri %]">New fund for [% budget_period_description | html %]</a></li> </ul> </div> -- 2.11.0