From f3ba91f4a8e95931239985bf29df0ce723c8d2df Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 14 Jan 2020 10:02:11 +0100 Subject: [PATCH] Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission --- installer/data/mysql/atomicupdate/bug_22868.perl | 19 +++++++++++++++++++ installer/data/mysql/userflags.sql | 3 ++- installer/data/mysql/userpermissions.sql | 2 +- .../prog/en/includes/acquisitions-menu.inc | 2 +- .../intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- .../intranet-tmpl/prog/en/includes/permissions.inc | 5 ++++- .../intranet-tmpl/prog/en/modules/acqui/acqui-home.tt | 2 +- .../intranet-tmpl/prog/en/modules/intranet-main.tt | 2 +- members/purchase-suggestions.pl | 2 +- suggestion/suggestion.pl | 2 +- 10 files changed, 32 insertions(+), 9 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_22868.perl diff --git a/installer/data/mysql/atomicupdate/bug_22868.perl b/installer/data/mysql/atomicupdate/bug_22868.perl new file mode 100644 index 0000000000..ab4853dc45 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_22868.perl @@ -0,0 +1,19 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do(q{ + INSERT IGNORE INTO `userflags` (`bit`, `flag`, `flagdesc`, `defaulton`) + VALUES (12, 'suggestions', 'Suggestion management', 0) + }); + + $dbh->do(q{ + UPDATE permissions SET module_bit=12 + WHERE code="suggestions_manage" + }); + + $dbh->do(q{ + UPDATE borrowers SET flags = flags + (1<<12) WHERE flags & (1 << 11) + }); + + SetVersion( $DBversion ); + print "Upgrade to $DBversion done (Bug 22868 - Move suggestions_manage subpermission out of acquisition permission)\n"; +} diff --git a/installer/data/mysql/userflags.sql b/installer/data/mysql/userflags.sql index 5b1748d15d..ecadc0d450 100644 --- a/installer/data/mysql/userflags.sql +++ b/installer/data/mysql/userflags.sql @@ -8,7 +8,8 @@ INSERT INTO userflags (bit, flag, flagdesc, defaulton) VALUES (6,'reserveforothers','Place and modify holds for patrons',0), (9,'editcatalogue','Edit catalog (Modify bibliographic/holdings data)',0), (10,'updatecharges','Manage patrons fines and fees',0), -(11,'acquisition','Acquisition and/or suggestion management',0), +(11,'acquisition','Acquisition management',0), +(12,'suggestions','Suggestion management',0), (13,'tools','Use all tools (expand for granular tools permissions)',0), (14,'editauthorities','Edit authorities',0), (15,'serials','Manage serial subscriptions',0), diff --git a/installer/data/mysql/userpermissions.sql b/installer/data/mysql/userpermissions.sql index ab46391bdc..611e17eff0 100644 --- a/installer/data/mysql/userpermissions.sql +++ b/installer/data/mysql/userpermissions.sql @@ -48,7 +48,6 @@ INSERT INTO permissions (module_bit, code, description) VALUES (10, 'writeoff', 'Write off fines and fees'), (10, 'remaining_permissions', 'Remaining permissions for managing fines and fees'), (11, 'currencies_manage', 'Manage currencies and exchange rates'), - (11, 'suggestions_manage', 'Manage purchase suggestions'), (11, 'vendors_manage', 'Manage vendors'), (11, 'contracts_manage', 'Manage contracts'), (11, 'period_manage', 'Manage budgets'), @@ -62,6 +61,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES (11, 'budget_add_del', 'Add and delete funds (but can''t modify funds)'), (11, 'budget_manage_all', 'Manage all funds'), (11, 'edi_manage', 'Manage EDIFACT transmissions'), + (12, 'suggestions_manage', 'Manage purchase suggestions'), (13, 'edit_news', 'Write news for the OPAC and staff interfaces'), (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'), (13, 'edit_calendar', 'Define days when the library is closed'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc index f5ef2e4579..de132ec66f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc @@ -4,7 +4,7 @@