Bug 24157: New permission - delete_invoices

Add a new permission to delete invoices

Test plan:
- Remove the new permission "delete_invoices" for a given patron,
use it to log in into Koha
- Create an invoice, try to delete it
=> There is no way to delete it
- Add the permission
=> Now you can delete the invoice

Sponsored-by: Galway-Mayo Institute of Technology

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

acqui/invoice.pl

@@ -110,6 +110,10 @@ elsif ( $op && $op eq 'mod' ) {
     $template->param( modified => 1 );
 }
 elsif ( $op && $op eq 'delete' ) {
+
+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
+        unless $logged_in_patron->has_permission( { acquisition => 'delete_invoices' } );
+
     DelInvoice($invoiceid);
     defined($invoice_files) && $invoice_files->DelAllFiles();
     my $referer = $input->param('referer') || 'invoices.pl';

installer/data/mysql/atomicupdate/bug_24157.perl

@@ -11,6 +11,11 @@ if( CheckVersion( $DBversion ) ) {
     |);
 
 
+    $dbh->do(q|
+        INSERT IGNORE INTO permissions (module_bit, code, description) VALUES
+        (11, 'delete_invoices', 'Delete invoices')
+    |);
+
     SetVersion( $DBversion );
-    print "Upgrade to $DBversion done (Bug 24157: Add new permissions reopen_closed_invoices, edit_invoices)\n";
+    print "Upgrade to $DBversion done (Bug 24157: Add new permissions reopen_closed_invoices, edit_invoices delete_invoices)\n";
 }

installer/data/mysql/userpermissions.sql

@@ -67,6 +67,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
    (11, 'edi_manage', 'Manage EDIFACT transmissions'),
    (11, 'reopen_closed_invoices', 'Reopen closed invoices'),
    (11, 'edit_invoices', 'Edit invoices'),
+   (11, 'delete_invoices', 'Delete invoices'),
    (12, 'suggestions_manage', 'Manage purchase suggestions'),
    (13, 'edit_news', 'Write news for the OPAC and staff interfaces'),
    (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),

koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc

@@ -700,6 +700,11 @@
             Edit invoices
         </span>
         <span class="permissioncode">([% name | html %])</span>
+    [%- CASE 'delete_invoices' -%]
+        <span class="sub_permission delete_invoices_subpermission">
+            Delete invoices
+        </span>
+        <span class="permissioncode">([% name | html %])</span>
   [%# self_check %]
     [%- CASE 'self_checkin_module' -%]
         <span class="sub_permission self_checkin_module_subpermission">

koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt

@@ -90,7 +90,7 @@
                                 [% END %]
                             [% END %]
                             [% UNLESS invoice.receivedbiblios || invoice.receiveditems %]
-                                [% IF CAN_user_acquisition_edit_invoices %]
+                                [% IF CAN_user_acquisition_delete_invoices %]
                                     <li><a href="invoice.pl?op=delete&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]" class="delete_invoice"><i class="fa fa-trash"></i> Delete</a></li>
                                 [% END %]
                             [% END %]