From fd8bf8602682d85027ba08f087c2f7cbb5b1d276 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 11 Dec 2019 16:37:46 +0100
Subject: [PATCH] Bug 24157: New permission - delete_invoices

Add a new permission to delete invoices

Test plan:
- Remove the new permission "delete_invoices" for a given patron,
use it to log in into Koha
- Create an invoice, try to delete it
=> There is no way to delete it
- Add the permission
=> Now you can delete the invoice

Sponsored-by: Galway-Mayo Institute of Technology
---
 acqui/invoice.pl                                          | 4 ++++
 installer/data/mysql/atomicupdate/bug_24157.perl          | 7 ++++++-
 installer/data/mysql/userpermissions.sql                  | 1 +
 koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc  | 5 +++++
 koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt | 2 +-
 5 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/acqui/invoice.pl b/acqui/invoice.pl
index f784b3e4d0..a65b6d8939 100755
--- a/acqui/invoice.pl
+++ b/acqui/invoice.pl
@@ -110,6 +110,10 @@ elsif ( $op && $op eq 'mod' ) {
     $template->param( modified => 1 );
 }
 elsif ( $op && $op eq 'delete' ) {
+
+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
+        unless $logged_in_patron->has_permission( { acquisition => 'delete_invoices' } );
+
     DelInvoice($invoiceid);
     defined($invoice_files) && $invoice_files->DelAllFiles();
     my $referer = $input->param('referer') || 'invoices.pl';
diff --git a/installer/data/mysql/atomicupdate/bug_24157.perl b/installer/data/mysql/atomicupdate/bug_24157.perl
index f03c3a37de..031b7a0a39 100644
--- a/installer/data/mysql/atomicupdate/bug_24157.perl
+++ b/installer/data/mysql/atomicupdate/bug_24157.perl
@@ -11,6 +11,11 @@ if( CheckVersion( $DBversion ) ) {
     |);
 
 
+    $dbh->do(q|
+        INSERT IGNORE INTO permissions (module_bit, code, description) VALUES
+        (11, 'delete_invoices', 'Delete invoices')
+    |);
+
     SetVersion( $DBversion );
-    print "Upgrade to $DBversion done (Bug 24157: Add new permissions reopen_closed_invoices, edit_invoices)\n";
+    print "Upgrade to $DBversion done (Bug 24157: Add new permissions reopen_closed_invoices, edit_invoices delete_invoices)\n";
 }
diff --git a/installer/data/mysql/userpermissions.sql b/installer/data/mysql/userpermissions.sql
index df114d2311..98efb6f04c 100644
--- a/installer/data/mysql/userpermissions.sql
+++ b/installer/data/mysql/userpermissions.sql
@@ -62,6 +62,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
    (11, 'edi_manage', 'Manage EDIFACT transmissions'),
    (11, 'reopen_closed_invoices', 'Reopen closed invoices'),
    (11, 'edit_invoices', 'Edit invoices'),
+   (11, 'delete_invoices', 'Delete invoices'),
    (13, 'edit_news', 'Write news for the OPAC and staff interfaces'),
    (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
    (13, 'edit_calendar', 'Define days when the library is closed'),
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
index 267abc3208..b5be0aa932 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
@@ -659,6 +659,11 @@
             Edit invoices
         </span>
         <span class="permissioncode">([% name | html %])</span>
+    [%- CASE 'delete_invoices' -%]
+        <span class="sub_permission delete_invoices_subpermission">
+            Delete invoices
+        </span>
+        <span class="permissioncode">([% name | html %])</span>
   [%# self_check %]
     [%- CASE 'self_checkin_module' -%]
         <span class="sub_permission self_checkin_module_subpermission">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 6704fb1f25..d58a40593f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -90,7 +90,7 @@
                                 [% END %]
                             [% END %]
                             [% UNLESS invoice.receivedbiblios || invoice.receiveditems %]
-                                [% IF CAN_user_acquisition_edit_invoices %]
+                                [% IF CAN_user_acquisition_delete_invoices %]
                                     <li><a href="invoice.pl?op=delete&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]" class="delete_invoice"><i class="fa fa-trash"></i> Delete</a></li>
                                 [% END %]
                             [% END %]
-- 
2.11.0