From f5bae08d547aca9408a0c6a6f595e2faf20e8416 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 14 Jan 2020 10:02:11 +0100 Subject: [PATCH] Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission --- installer/data/mysql/userflags.sql | 3 ++- installer/data/mysql/userpermissions.sql | 2 +- koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc | 2 +- koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc | 5 ++++- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt | 2 +- members/purchase-suggestions.pl | 2 +- suggestion/suggestion.pl | 2 +- 9 files changed, 13 insertions(+), 9 deletions(-) diff --git a/installer/data/mysql/userflags.sql b/installer/data/mysql/userflags.sql index 5b1748d15d..ecadc0d450 100644 --- a/installer/data/mysql/userflags.sql +++ b/installer/data/mysql/userflags.sql @@ -8,7 +8,8 @@ INSERT INTO userflags (bit, flag, flagdesc, defaulton) VALUES (6,'reserveforothers','Place and modify holds for patrons',0), (9,'editcatalogue','Edit catalog (Modify bibliographic/holdings data)',0), (10,'updatecharges','Manage patrons fines and fees',0), -(11,'acquisition','Acquisition and/or suggestion management',0), +(11,'acquisition','Acquisition management',0), +(12,'suggestions','Suggestion management',0), (13,'tools','Use all tools (expand for granular tools permissions)',0), (14,'editauthorities','Edit authorities',0), (15,'serials','Manage serial subscriptions',0), diff --git a/installer/data/mysql/userpermissions.sql b/installer/data/mysql/userpermissions.sql index ab46391bdc..611e17eff0 100644 --- a/installer/data/mysql/userpermissions.sql +++ b/installer/data/mysql/userpermissions.sql @@ -48,7 +48,6 @@ INSERT INTO permissions (module_bit, code, description) VALUES (10, 'writeoff', 'Write off fines and fees'), (10, 'remaining_permissions', 'Remaining permissions for managing fines and fees'), (11, 'currencies_manage', 'Manage currencies and exchange rates'), - (11, 'suggestions_manage', 'Manage purchase suggestions'), (11, 'vendors_manage', 'Manage vendors'), (11, 'contracts_manage', 'Manage contracts'), (11, 'period_manage', 'Manage budgets'), @@ -62,6 +61,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES (11, 'budget_add_del', 'Add and delete funds (but can''t modify funds)'), (11, 'budget_manage_all', 'Manage all funds'), (11, 'edi_manage', 'Manage EDIFACT transmissions'), + (12, 'suggestions_manage', 'Manage purchase suggestions'), (13, 'edit_news', 'Write news for the OPAC and staff interfaces'), (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'), (13, 'edit_calendar', 'Define days when the library is closed'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc index f5ef2e4579..de132ec66f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc @@ -4,7 +4,7 @@