From dbaa312babfd129d2e67858ecd1de7d957339fc0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 10 Dec 2019 20:03:28 +0100
Subject: [PATCH] Bug 24157: New permission - reopen_closed_invoices

New permission to reopen a closed invoice.

Test plan:
- Remove the new permission "reopen_closed_invoices" for a given patron,
use it to log in into Koha
- Create an invoice, close it
=> You are not able to reopen the invoice
- Add the permission
=> You are able to reopen the invoice

Sponsored-by: Galway-Mayo Institute of Technology
---
 acqui/invoice.pl                              |  8 +++++++-
 .../data/mysql/atomicupdate/bug_24157.perl    | 10 ++++++++++
 installer/data/mysql/userpermissions.sql      |  1 +
 .../prog/en/includes/blocking_errors.inc      |  2 ++
 .../prog/en/includes/permissions.inc          |  5 +++++
 .../prog/en/modules/acqui/invoice.tt          | 19 ++++++++++++++++---
 .../prog/en/modules/acqui/invoices.tt         |  4 +++-
 .../prog/en/modules/acqui/parcel.tt           |  4 +++-
 8 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100644 installer/data/mysql/atomicupdate/bug_24157.perl

diff --git a/acqui/invoice.pl b/acqui/invoice.pl
index 26717e99fe..5a7ce08f38 100755
--- a/acqui/invoice.pl
+++ b/acqui/invoice.pl
@@ -52,6 +52,8 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
     }
 );
 
+my $logged_in_patron = Koha::Patrons->find( $loggedinuser );
+
 my $invoiceid = $input->param('invoiceid');
 my $op        = $input->param('op');
 
@@ -70,6 +72,9 @@ if ( $op && $op eq 'close' ) {
     }
 }
 elsif ( $op && $op eq 'reopen' ) {
+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
+        unless $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
+
     ReopenInvoice($invoiceid);
     my $referer = $input->param('referer');
     if ($referer) {
@@ -90,7 +95,8 @@ elsif ( $op && $op eq 'mod' ) {
         shipmentcost_budgetid => $shipment_budget_id
     );
     if ($input->param('reopen')) {
-        ReopenInvoice($invoiceid);
+        ReopenInvoice($invoiceid)
+            if $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
     } elsif ($input->param('close')) {
         CloseInvoice($invoiceid);
     } elsif ($input->param('merge')) {
diff --git a/installer/data/mysql/atomicupdate/bug_24157.perl b/installer/data/mysql/atomicupdate/bug_24157.perl
new file mode 100644
index 0000000000..60536820ea
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_24157.perl
@@ -0,0 +1,10 @@
+$DBversion = 'XXX'; # will be replaced by the RM
+if( CheckVersion( $DBversion ) ) {
+    $dbh->do(q|
+        INSERT IGNORE INTO permissions (module_bit, code, description) VALUES
+        (11, 'reopen_closed_invoices', 'Reopen closed invoices')
+    |);
+
+    SetVersion( $DBversion );
+    print "Upgrade to $DBversion done (Bug 24157: Add new permission reopen_closed_invoices)\n";
+}
diff --git a/installer/data/mysql/userpermissions.sql b/installer/data/mysql/userpermissions.sql
index 136c7b16bc..34c62262dd 100644
--- a/installer/data/mysql/userpermissions.sql
+++ b/installer/data/mysql/userpermissions.sql
@@ -62,6 +62,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
    (11, 'budget_add_del', 'Add and delete funds (but can''t modify funds)'),
    (11, 'budget_manage_all', 'Manage all funds'),
    (11, 'edi_manage', 'Manage EDIFACT transmissions'),
+   (11, 'reopen_closed_invoices', 'Reopen closed invoices'),
    (12, 'suggestions_manage', 'Manage purchase suggestions'),
    (13, 'edit_news', 'Write news for the OPAC and staff interfaces'),
    (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
index 510d95fbc2..1959382c2d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
@@ -17,6 +17,8 @@
         <div class="dialog message">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div>
     [% CASE 'budget_is_locked' %]
         <div class="dialog message">The budget is locked, fund creation is not possible.</div>
+    [% CASE 'insufficient_permission' %]
+        <div class="dialog message">You do not have sufficient permission to continue.</div>
     [% CASE %][% blocking_error | html %]
     [% END %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
index 3f7cb441c1..2d9819fb2f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
@@ -667,6 +667,11 @@
             Manage EDIFACT transmissions
         </span>
         <span class="permissioncode">([% name | html %])</span>
+    [%- CASE 'reopen_closed_invoices' -%]
+        <span class="sub_permission reopen_closed_invoices_subpermission">
+            Reopen closed invoices
+        </span>
+        <span class="permissioncode">([% name | html %])</span>
   [%# self_check %]
     [%- CASE 'self_checkin_module' -%]
         <span class="sub_permission self_checkin_module_subpermission">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
index 24b488421c..40a33b16e3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
@@ -15,6 +15,8 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
+[% SET readonly = NOT CAN_user_acquisition_edit_invoices %]
+
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">[% invoicenumber | html %]</a></div>
 
 <div class="main container-fluid">
@@ -35,8 +37,12 @@
             <ol>
             <li>
                 <label for="shipmentdate" class="required">Invoice number:</label>
-                <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="required" required="required"/>
-                <span class="required">Required</span>
+                [% IF readonly %]
+                    [% invoicenumber | html %]
+                [% ELSE %]
+                    <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="required" required="required"/>
+                    <span class="required">Required</span>
+                [% END %]
             </li>
 
             <li><label for="shipmentdate">Shipment date:</label>
@@ -71,7 +77,14 @@
             <li><span class="label">Status:</span>
                 Closed on [% invoiceclosedate | $KohaDates %]</li>
 
-            <li><label for="reopen">Reopen: </label> <input type="checkbox" name="reopen" id="reopen" /></li>
+            <li>
+                <label for="reopen">Reopen: </label>
+                [% IF CAN_user_acquisition_reopen_closed_invoices %]
+                    <input type="checkbox" name="reopen" id="reopen" />
+                [% ELSE %]
+                    <input type="checkbox" name="reopen" id="reopen" readonly="readonly" />
+                [% END %]
+            </li>
             [% ELSE %]
             <li><span class="label">Status:</span>
                 Open</li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 458112e011..c314452f02 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -81,7 +81,9 @@
                           <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="invoiceactions[% invoice.invoiceid | html %]">
                               <li><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid | uri %]"><i class="fa fa-search"></i> Details</a></li>
                             [% IF invoice.closedate %]
-                                <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-refresh"></i> Reopen</a></li>
+                                [% IF CAN_user_acquisition_reopen_closed_invoices %]
+                                    <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-refresh"></i> Reopen</a></li>
+                                [% END %]
                             [% ELSE %]
                                 <li><a href="invoice.pl?op=close&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-times-circle"></i> Close</a></li>
                             [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
index 414844397c..36798c3a47 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
@@ -213,7 +213,9 @@
 [% ELSE %]
     <p>
         Invoice is closed, so you can't receive orders anymore.
-        <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid | uri %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]">Reopen it</a>.
+        [% IF CAN_user_acquisition_reopen_closed_invoices %]
+            <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid | uri %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]">Reopen it</a>.
+        [% END %]
     </p>
 [% END %]
 
-- 
2.20.1