From 7660861d40f68e0c60b9a144a6ddb490763d4c15 Mon Sep 17 00:00:00 2001
From: Katrin Fischer <katrin.fischer@bsz-bw.de>
Date: Fri, 13 May 2022 10:25:27 +0000
Subject: [PATCH] Bug 30720: Batch action links in result list missing
 permission checks

In the staff interface you can select records for merging, batch editing,
and batch deleting from the result list. This fixes the code to check for
the specific batch edit records and batch delete records permissions, so
those actions are only shown if the user has the right permissions.
As there is no merge record permission yet, it's assumed that edit_cataloge is
needed as before (no change in behavior).

To test:
- Create a staff user with only catalogue and editcatalogue permissions.
- Do a search in the catalog of the staff interface
- Select a few records from result list to unlock the Edit button on top
- Verify it shows all three options: edit, delete and merge
- Apply patch
- Verfiy now only merging is shown
- Add the records_batchdel and records_batchmod permissions from the tools
  area one after another and verify the display changes accordingly.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../intranet-tmpl/prog/en/modules/catalogue/results.tt      | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
index cde3f0f090..0e550fd353 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
@@ -175,11 +175,17 @@
                                     <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                                         <i class="fa fa-pencil"></i> Edit <span class="caret"></span>
                                     </button>
+                                    [% IF ( CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel || CAN_user_editcatalogue_edit_catalogue ) %]
                                     <ul class="dropdown-menu">
+                                        [% IF ( CAN_user_tools_records_batchmod ) %]
                                         <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li>
+                                        [% END %]
+                                        [% IF ( CAN_user_tools_records_batchdel ) %]
                                         <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li>
+                                        [% END %]
                                         <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li>
                                     </ul>
+                                    [% END %]
                                 </div>
                             [% END %]
 
-- 
2.39.5