e3faa4d66b
This patch just fixes a missing permission on the intranet main page. Currently, the Additional Content modules allows people to edit, modify or create new additional content just by checking if they have any tool permission at all, and not the right one. To test: 1 - From the staff client, create a news article for the intranet. 2 - Create (or use) an additional staff patron, giving them the necessary permissions to access the intranet, but no tool permission. 3 - Using another browser (or incognito mode), log on the intranet page with your new staff account, you should be able to see the news content, but not edit or delete it. That's the expected behavior. 4 - From your main admin account, give your test account the edit_additional_contents permission. 5 - Your test account should now be able to edit/delete the news content. This is also expected behavior. 6 - Using the main account again, remove this time the edit_additional_contents but add any other subtool permission (edit_calendar is a good one for instance) 7 - Repeat step 5 and confirm that your test account can still edit or delete the news content. This shouldn't happen. 8 - Apply patch 9 - Repeat steps 4-6, and confirm that your test account can now only edit or delete news content if they have the edit_additional_contents permission enabled. Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
280 lines
16 KiB
Text
280 lines
16 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE Koha %]
|
|
[% USE Branches %]
|
|
[% USE KohaDates %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha staff interface</title>
|
|
[% Asset.css("css/mainpage.css") | $raw %]
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
<body id="main_intranet-main" class="intranet-main">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'home-search.inc' %]
|
|
|
|
<nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumb">
|
|
<ol>
|
|
<li>
|
|
<a href="#" aria-current="page">Home</a>
|
|
</li>
|
|
</ol>
|
|
</nav>
|
|
|
|
<div id="container-main" class="container-fluid">
|
|
<div class="row">
|
|
<h1 class="sr-only">Koha home</h1>
|
|
<div class="col-sm-3">
|
|
[% IF ( koha_news.count ) %]
|
|
<div id="area-news">
|
|
<h3><span class="news_title">News</span></h3>
|
|
[% SET show_author = Koha.Preference('NewsAuthorDisplay') == 'staff' || Koha.Preference('NewsAuthorDisplay') == 'both' %]
|
|
[% FOREACH koha_new IN koha_news %]
|
|
<div class="newsitem" id="news[% koha_new.idnew | html %]"><h4>[% koha_new.title | html %]</h4>
|
|
<div class="newsbody">[% koha_new.content | $raw %]</div>
|
|
<p class="newsfooter"> Posted on [% koha_new.published_on | $KohaDates %][% IF( show_author && koha_new.author ) %] by <span class="newsauthor">[% INCLUDE 'patron-title.inc' patron=koha_new.author %]<br />[% END %]
|
|
[% IF ( CAN_user_tools_edit_additional_contents ) %]
|
|
<a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&id=[% koha_new.idnew | uri %]">Edit</a>
|
|
| <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=del&ids=[% koha_new.idnew | html %]">Delete</a>
|
|
| <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form">New</a>
|
|
[% END %]
|
|
</p>
|
|
</div>
|
|
[% END %]
|
|
</div><!-- /additional-contents -->
|
|
[% END %]
|
|
[% IF ( daily_quote ) %]
|
|
<div id="area-news">
|
|
<h3>Quote of the day</h3>
|
|
<div class="newsitem">
|
|
<span id="daily-quote-text">[% daily_quote.text | html %]</span><span id="daily-quote-sep"> ~ </span><span id="daily-quote-source">[% daily_quote.source | html %]</span>
|
|
</div>
|
|
</div>
|
|
[% END %]
|
|
</div> <!-- /.col-sm-2 -->
|
|
<div class="col-sm-9">
|
|
<div class="row">
|
|
<div class="col-xs-6">
|
|
<ul class="biglinks-list">
|
|
[% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]
|
|
<li>
|
|
<a class="icon_general icon_circulation" href="/cgi-bin/koha/circ/circulation-home.pl"><i class="fa fa-fw fa-exchange"></i>Circulation</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_borrowers_edit_borrowers %]
|
|
<li>
|
|
<a class="icon_general icon_patrons" href="/cgi-bin/koha/members/members-home.pl"><i class="fa fa-fw fa-id-card-o"></i>Patrons</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_catalogue ) %]
|
|
<li>
|
|
<a class="icon_general icon_search" href="/cgi-bin/koha/catalogue/search.pl">
|
|
<span class="fa-stack">
|
|
<i class="fa fa-fw fa-book fa-stack-1x"></i>
|
|
<i class="fa fa-fw fa-search fa-stack-2x"></i>
|
|
</span>
|
|
Advanced search
|
|
</a>
|
|
</li>
|
|
<li>
|
|
<a class="icon_general icon_search" href="/cgi-bin/koha/catalogue/itemsearch.pl">
|
|
<span class="fa-stack">
|
|
<i class="fa fa-fw fa-list fa-stack-1x"></i>
|
|
<i class="fa fa-fw fa-search fa-stack-2x"></i>
|
|
</span>
|
|
Item search
|
|
</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
<li>
|
|
<a class="icon_general icon_lists" href="/cgi-bin/koha/virtualshelves/shelves.pl"><i class="fa fa-fw fa-list-alt"></i>Lists</a>
|
|
</li>
|
|
|
|
[% IF ( UseCourseReserves ) %]
|
|
<li>
|
|
<a class="icon_general icon_course_reserves" href="/cgi-bin/koha/course_reserves/course-reserves.pl"><i class="fa fa-fw fa-book"></i>Course reserves</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
<li>
|
|
<a class="icon_general icon_authorities" href="/cgi-bin/koha/authorities/authorities-home.pl"><i class="fa fa-fw fa-link"></i>Authorities</a>
|
|
</li>
|
|
[% IF Koha.Preference('ILLModule') && CAN_user_ill %]
|
|
<li>
|
|
<a class="icon_general icon_ill" href="/cgi-bin/koha/ill/ill-requests.pl"><i class="fa fa-fw fa-retweet"></i>ILL requests</a>
|
|
</li>
|
|
[% END %]
|
|
</ul>
|
|
</div> <!-- /.col-xs-6 -->
|
|
<div class="col-xs-6">
|
|
<ul class="biglinks-list">
|
|
|
|
[% IF ( Koha.Preference('EnablePointOfSale') && Koha.Preference('UseCashRegisters') && CAN_user_cash_management_takepayment ) %]
|
|
<li>
|
|
<a class="icon_general icon_pos" href="/cgi-bin/koha/pos/pay.pl"><i class="fa fa-fw fa-shopping-cart"></i>Point of sale</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ) %]
|
|
<li>
|
|
<a class="icon_general icon_cataloging" href="/cgi-bin/koha/cataloguing/addbooks.pl"><i class="fa fa-fw fa-tag"></i>Cataloging</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_serials ) %]
|
|
<li>
|
|
<a class="icon_general icon_serials" href="/cgi-bin/koha/serials/serials-home.pl"><i class="fa fa-fw fa-newspaper-o"></i>Serials</a>
|
|
<span class="biglink"></span>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_acquisition ) %]
|
|
<li>
|
|
<a class="icon_general icon_acquisitions" href="/cgi-bin/koha/acqui/acqui-home.pl"><i class="fa fa-fw fa-gift"></i>Acquisitions</a>
|
|
<span class="biglink"></span>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_reports ) %]
|
|
<li>
|
|
<a class="icon_general icon_reports" href="/cgi-bin/koha/reports/reports-home.pl"><i class="fa fa-fw fa-pie-chart"></i>Reports</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
|
|
[% IF ( CAN_user_tools ) %]
|
|
<li>
|
|
<a class="icon_general icon_tools" href="/cgi-bin/koha/tools/tools-home.pl"><i class="fa fa-fw fa-wrench"></i>Tools</a>
|
|
</li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_parameters ) %]
|
|
<li>
|
|
<a class="icon_general icon_administration" href="/cgi-bin/koha/admin/admin-home.pl"><i class="fa fa-fw fa-cogs"></i>Koha administration</a>
|
|
</li>
|
|
[% END %]
|
|
<li>
|
|
<a class="icon_general icon_koha" href="/cgi-bin/koha/about.pl"><img src="[% interface | html %]/[% theme | html %]/img/koha-egg.svg" alt="Koha Logo SVG"/> About Koha</a>
|
|
</li>
|
|
</ul>
|
|
</div> <!-- /.col-sm-6 -->
|
|
|
|
</div> <!-- /.row -->
|
|
<div class="row">
|
|
<div class="col-sm-12">
|
|
[%# Following statement must be in one line for translatability %]
|
|
[% IF ( CAN_user_tools_moderate_comments && pendingcomments ) || ( CAN_user_tools_moderate_tags && pendingtags ) || ( CAN_user_borrowers_edit_borrowers && pending_borrower_modifications ) || ( CAN_user_suggestions_suggestions_manage && ( pendingsuggestions || all_pendingsuggestions )) || ( CAN_user_borrowers_edit_borrowers && pending_discharge_requests ) || pending_article_requests || ( Koha.Preference('AllowCheckoutNotes') && CAN_user_circulate_manage_checkout_notes && pending_checkout_notes.count ) || ( Koha.Preference('OPACReportProblem') && CAN_user_problem_reports && pending_problem_reports.count ) || already_ran_jobs %]
|
|
<div id="area-pending">
|
|
[% IF pending_article_requests %]
|
|
<div class="pending-info" id="article_requests_pending">
|
|
|
|
<a href="/cgi-bin/koha/circ/article-requests.pl">Article requests</a>:
|
|
<span class="pending-number-link">[% pending_article_requests | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_suggestions_suggestions_manage && ( pendingsuggestions || all_pendingsuggestions ) %]
|
|
<div class="pending-info" id="suggestions_pending">
|
|
|
|
Suggestions pending approval:
|
|
<a href="/cgi-bin/koha/suggestion/suggestion.pl?branchcode=[% Branches.GetLoggedInBranchcode | url %]#ASKED">
|
|
<span id="pendingsuggestions" class="pending-number-link">[% Branches.GetLoggedInBranchname | html %]: [% pendingsuggestions | html %]</span>
|
|
</a>
|
|
[% IF (all_pendingsuggestions > 0) %]
|
|
/
|
|
<a href="/cgi-bin/koha/suggestion/suggestion.pl?branchcode=__ANY__#ASKED">
|
|
<span id="all_pendingsuggestions" class="pending-number-link">All libraries: [% all_pendingsuggestions | html %]</span>
|
|
</a>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_moderate_comments && pendingcomments ) %]
|
|
<div class="pending-info" id="comments_pending">
|
|
<a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments pending approval</a>:
|
|
<span class="pending-number-link">[% pendingcomments | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_moderate_tags && pendingtags ) %]
|
|
<div class="pending-info" id="tags_pending">
|
|
<a href="/cgi-bin/koha/tags/review.pl">Tags pending approval</a>:
|
|
<span class="pending-number-link">[% pendingtags | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
|
|
[% IF ( CAN_user_borrowers_edit_borrowers && pending_borrower_modifications ) %]
|
|
<div class="pending-info" id="patron_updates_pending">
|
|
<a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
|
|
<span class="pending-number-link">[% pending_borrower_modifications | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_borrowers_edit_borrowers && pending_discharge_requests %]
|
|
<div class="pending-info" id="patron_discharges_pending">
|
|
<a href="/cgi-bin/koha/members/discharges.pl">Discharge requests pending</a>:
|
|
<span class="pending-number-link">[% pending_discharge_requests | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF Koha.Preference('AllowCheckoutNotes') && CAN_user_circulate_manage_checkout_notes && pending_checkout_notes.count %]
|
|
<div class="pending-info" id="checkout_notes_pending">
|
|
<a href="/cgi-bin/koha/circ/checkout-notes.pl">Checkout notes pending</a>:
|
|
<span class="pending-number-link">[% pending_checkout_notes.count | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( Koha.Preference('OPACReportProblem') && CAN_user_problem_reports && pending_problem_reports.count ) %]
|
|
<div class="pending-info" id="problem_reports_pending">
|
|
<a href="/cgi-bin/koha/tools/problem-reports.pl">OPAC problem reports pending</a>:
|
|
<span class="pending-number-link">[% pending_problem_reports.count | html %]</span>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF already_ran_jobs %]
|
|
<div class="pending-info" id="background_jobs">
|
|
<a href="/cgi-bin/koha/admin/background_jobs.pl">Access your background jobs</a>
|
|
</div>
|
|
[% END %]
|
|
|
|
</div>
|
|
|
|
[% END %]
|
|
|
|
</div> <!-- /.col-sm-12 -->
|
|
</div> <!-- /.row -->
|
|
|
|
[% IF ( IntranetmainUserblock ) %]
|
|
<div class="row">
|
|
<div class="col-sm-12">
|
|
<div id="area-userblock">
|
|
<div class="user-info">
|
|
[% IntranetmainUserblock | $raw %]
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
[% END %]
|
|
</div> <!-- /.col-sm-9 -->
|
|
|
|
</div> <!-- /.row -->
|
|
</div> <!-- /.container-fluid -->
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
<script>
|
|
//<![CDATA[
|
|
var MSG_CONFIRM_DELETE = _("Are you sure you want to delete this news item? This cannot be undone.");
|
|
$(document).ready(function(){
|
|
$(".news_delete").on("click", function(){
|
|
return confirmDelete(MSG_CONFIRM_DELETE);
|
|
});
|
|
});
|
|
//]]>
|
|
</script>
|
|
[% END %]
|
|
<!-- the main div is closed in intranet-bottom.inc -->
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|