From cdcb7474b9c73f3707257477fe6b7b2c1a3b0023 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 6 Nov 2019 19:59:21 +0100
Subject: [PATCH] Bug 23590: Only return patrons that have the
 suggestions_manage permission
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 .../prog/en/modules/common/patron_search.tt   |  9 +++
 .../prog/en/modules/suggestion/suggestion.tt  |  2 +-
 suggestion/add_user_search.pl                 | 63 +++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100755 suggestion/add_user_search.pl

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/common/patron_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/common/patron_search.tt
index 54f9899353..19cd0ab952 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/common/patron_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/common/patron_search.tt
@@ -53,6 +53,10 @@
             <div class="hint">Only staff with superlibrarian or acquisitions permissions (or order_manage permission if granular permissions are enabled) are returned in the search results</div>
         [% END %]
 
+        [% IF patrons_with_suggestion_perm_only %]
+            <div class="hint">Only staff with superlibrarian or suggestions_manage permissions are returned in the search results</div>
+        [% END %]
+
         <div class="browse">
             Browse by last name:
             [% FOREACH letter IN alphabet.split(' ') %]
@@ -167,6 +171,11 @@
                         'name': 'has_permission',
                         'value': 'acquisition.order_manage',
                     }
+                    [% ELSIF patrons_with_suggestion_perm_only %]
+                    ,{
+                        'name': 'has_permission',
+                        'value': 'acquisition.suggestions_manage',
+                    }
                     [% END %]
                     );
                     $.ajax({
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index be50156aa8..9b50d2938f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -859,7 +859,7 @@
 
     <script type="text/javascript">
         function editManagerPopup() {
-            window.open("/cgi-bin/koha/admin/add_user_search.pl?selection_type=select",
+            window.open("/cgi-bin/koha/suggestion/add_user_search.pl?selection_type=select",
                 'PatronPopup',
                 'width=740,height=450,location=yes,toolbar=no,'
                 + 'scrollbars=yes,resize=yes'
diff --git a/suggestion/add_user_search.pl b/suggestion/add_user_search.pl
new file mode 100755
index 0000000000..290f80d466
--- /dev/null
+++ b/suggestion/add_user_search.pl
@@ -0,0 +1,63 @@
+#!/usr/bin/perl
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+
+use CGI qw ( -utf8 );
+use C4::Auth;
+use C4::Output;
+use C4::Members;
+
+use Koha::Patron::Categories;
+
+my $input = new CGI;
+
+my $dbh = C4::Context->dbh;
+
+my ( $template, $loggedinuser, $cookie, $staff_flags ) = get_template_and_user(
+    {   template_name   => "common/patron_search.tt",
+        query           => $input,
+        type            => "intranet",
+        authnotrequired => 0,
+        flagsrequired   => { acquisition => 'suggestions_manage' },
+    }
+);
+
+my $q = $input->param('q') || '';
+my $op = $input->param('op') || '';
+my $selection_type = $input->param('selection_type') || 'add';
+
+my $referer = $input->referer();
+
+# If this script is called by suggestion/suggestion.pl
+# the patrons to return should be superlibrarian or have the suggestions_manage flag
+my $search_patrons_with_suggestion_perm_only =
+    ( $referer =~ m|suggestion/suggestion.pl| )
+        ? 1 : 0;
+
+my $patron_categories = Koha::Patron::Categories->search_limited;
+$template->param(
+    patrons_with_suggestion_perm_only => $search_patrons_with_suggestion_perm_only,
+    view => ( $input->request_method() eq "GET" ) ? "show_form" : "show_results",
+    columns => ['cardnumber', 'name', 'branch', 'category', 'action'],
+    json_template => 'acqui/tables/members_results.tt',
+    selection_type => $selection_type,
+    alphabet        => ( C4::Context->preference('alphabet') || join ' ', 'A' .. 'Z' ),
+    categories      => $patron_categories,
+    aaSorting       => 1,
+);
+output_html_with_http_headers( $input, $cookie, $template->output );
-- 
2.39.5