From 0b4bb48f2c8826e1837abe4b1218b89fd3ec3dd8 Mon Sep 17 00:00:00 2001
From: Brendan Lawlor <blawlor@clamsnet.org>
Date: Thu, 4 Apr 2024 18:29:07 +0000
Subject: [PATCH] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in
 patron-toolbar.inc

This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl

To test:
1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions
2. From the main page click on Patrons
3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors
4. Apply patch, restart all, reload the page
5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there

Signed-off-by: Esther <esther@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 .../prog/en/includes/patron-toolbar.inc       | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
index f4c2295483..924c1563b8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
@@ -4,19 +4,21 @@
 
 [% UNLESS ( no_add ) %]
 <div id="toolbar" class="btn-toolbar">
-    <div class="btn-group" id="new-patron-button">
-        <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New patron <span class="caret"></span></button>
-            <ul class="dropdown-menu">
-                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add_form&amp;categorycode=[% category.categorycode | uri %]">[% category.description | html %]</a></li>[% END %]
-            </ul>
-    </div>
-    [% IF Koha.Preference('PatronQuickAddFields') || Koha.Preference('BorrowerMandatoryField') %]
-    <div class="btn-group" id="quick-add-new-patron-button">
-        <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> Quick add new patron <span class="caret"></span></button>
-            <ul class="dropdown-menu">
-                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add_form&amp;categorycode=[% category.categorycode | uri %]&amp;quickadd=true">[% category.description | html %]</a></li>[% END %]
-            </ul>
-    </div>
+    [% IF CAN_user_borrowers_edit_borrowers %]
+        <div class="btn-group" id="new-patron-button">
+            <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New patron <span class="caret"></span></button>
+                <ul class="dropdown-menu">
+                    [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add_form&amp;categorycode=[% category.categorycode | uri %]">[% category.description | html %]</a></li>[% END %]
+                </ul>
+        </div>
+        [% IF Koha.Preference('PatronQuickAddFields') || Koha.Preference('BorrowerMandatoryField') %]
+            <div class="btn-group" id="quick-add-new-patron-button">
+                <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> Quick add new patron <span class="caret"></span></button>
+                    <ul class="dropdown-menu">
+                        [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add_form&amp;categorycode=[% category.categorycode | uri %]&amp;quickadd=true">[% category.description | html %]</a></li>[% END %]
+                    </ul>
+            </div>
+        [% END %]
     [% END %]
     [% IF CAN_user_tools_manage_patron_lists %]
         <a class="btn btn-default" href="/cgi-bin/koha/patron_lists/lists.pl" id="patron-lists-button"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Patron lists</a>
-- 
2.39.5