Jonathan Druart
cee2cf9ff9
Test plan: Login with a patron that is not allowed to see patron's information for patrons outside of his group. Try to access patron's information from scripts of the patron module (members/*) and circ/circulation.pl. You should be able to access patron's information of patrons outside of your group and get "You are not allowed to see the information of this patron." If you try and access a patron page with a borrowernumber that does not exist, you should get "This patron does not exist" Technical note: A new C4::Output subroutine is created in this patch: "output_and_exit_if_error" Executed at the beginning of the script it will permit not to copy/paste all the different checks to know if the logged in user is authorised to see patron's information. The design here can be discussed, but I did not find an alternative with as less changes. On the way I refactor what we did with 'unknowuser' previously: it will now work with all patron pages, not only the few that used it. Note that the 'or die "Not logged in";' part should not be needed, but... who trusts C4::Auth? I think it could be used as a safeguard later. I am willing to sed and remove them if required. Changes in discharge.pl are mainly indentation changes. With this patch we should now have a $patron variable that refer to the patron we want to access. That will be very useful to remove plenty of code in members/* and only pass this variable to the template (instead of 1 variable per patron's attribute). Signed-off-by: Signed-off-by: Jon McGowan <jon.mcgowan@ptfs-europe.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
65 lines
4.5 KiB
HTML
65 lines
4.5 KiB
HTML
[% INCLUDE 'blocking_errors.inc' %]
|
|
[% IF subscriptionid and ( CAN_user_serials_edit_subscription || CAN_user_serials_create_subscription || CAN_user_serials_delete_subscription || CAN_user_serials_receive_serials ) %]
|
|
<div id="toolbar" class="btn-toolbar">
|
|
[% IF CAN_user_serials_create_subscription %]
|
|
[% IF biblionumber_for_new_subscription %]
|
|
<div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription %]"><i class="fa fa-plus"></i> New subscription</a></div>
|
|
[% ELSE %]
|
|
<div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl"><i class="fa fa-plus"></i> New subscription</a></div>
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_serials_edit_subscription || CAN_user_serials_create_subscription || CAN_user_serials_delete_subscription ) %]
|
|
[% UNLESS ( cannotedit ) %]
|
|
<div class="btn-group">
|
|
<button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-pencil"></i> Edit <span class="caret"></span></button>
|
|
<ul class="dropdown-menu">
|
|
[% IF ( cannotedit ) %] <li class="disabled"> [% ELSE %]
|
|
<li> [% END %]
|
|
<a href="/cgi-bin/koha/serials/subscription-add.pl?op=modify&subscriptionid=[% subscriptionid %]">Edit subscription</a></li>
|
|
[% IF ( cannotedit ) %] <li class="disabled"> [% ELSE %]
|
|
<li> [% END %]
|
|
<a href="/cgi-bin/koha/serials/subscription-add.pl?op=dup&subscriptionid=[% subscriptionid %]">Edit as new (duplicate)</a></li>
|
|
|
|
[% IF CAN_user_editcatalogue_edit_catalogue %]
|
|
<li><a id="editbiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">Edit record</a></li>
|
|
[% END %]
|
|
|
|
[% IF serialsadditems && CAN_user_editcatalogue_edit_items %]
|
|
<li><a id="edititems" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]">Edit items</a></li>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_serials_delete_subscription ) %]
|
|
[% IF ( cannotedit ) %] <li class="disabled"> [% ELSE %]
|
|
<li> [% END %]
|
|
<a href="#" id="deletesub">Delete subscription</a></li>[% END %]
|
|
</ul>
|
|
</div>
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% IF not cannotedit or CAN_user_serials_receive_serials %]
|
|
[% IF CAN_user_serials_renew_subscription and not closed %]
|
|
<div class="btn-group"><a id="renew" class="btn btn-default btn-sm" href="#"><i class="fa fa-refresh"></i> Renew</a></div>
|
|
[% END %]
|
|
[% IF CAN_user_serials_receive_serials and not closed %]
|
|
<div class="btn-group"><a id="receive" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/serials-edit.pl?subscriptionid=[% subscriptionid %]&serstatus=1,3"><i class="fa fa-inbox"></i> Receive</a></div>
|
|
[% END %]
|
|
[% UNLESS cannotedit %]
|
|
[% IF closed %]
|
|
<div class="btn-group"><a id="reopen" class="btn btn-default btn-sm" href="#"><i class="fa fa-repeat"></i> Reopen</a></div>
|
|
[% ELSE %]
|
|
<div class="btn-group"><a id="close" class="btn btn-default btn-sm" href="#"><i class="fa fa-times-circle"></i> Close</a></div>
|
|
[% END %]
|
|
[% END %]
|
|
[% END %]
|
|
</div>
|
|
[% ELSIF CAN_user_serials_create_subscription %]
|
|
<div id="toolbar" class="btn-toolbar">
|
|
[% IF ( biblionumber_for_new_subscription ) %]
|
|
<div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription %]"><i class="fa fa-plus"></i> New subscription</a></div>
|
|
[% ELSE %]
|
|
<div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl"><i class="fa fa-plus"></i> New subscription</a></div>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|