Bug 22990: Add CSRF protection to boraccount, pay and suggestion
[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / members / member-flags.tt
1 [% USE raw %]
2 [% USE Asset %]
3 [% USE Branches %]
4 [% SET footerjs = 1 %]
5 [% PROCESS 'permissions.inc' %]
6 [% INCLUDE 'doc-head-open.inc' %]
7 <title>
8     Set permissions for [% INCLUDE 'patron-title.inc' no_html = 1 %] &rsaquo; Patrons &rsaquo; Koha
9 </title>
10 [% INCLUDE 'doc-head-close.inc' %]
11 </head>
12
13 <body id="pat_member-flags" class="pat">
14 [% WRAPPER 'header.inc' %]
15     [% INCLUDE 'patron-search-header.inc' %]
16 [% END %]
17
18 [% WRAPPER 'sub-header.inc' %]
19     [% WRAPPER breadcrumbs %]
20         [% WRAPPER breadcrumb_item %]
21             <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
22         [% END %]
23         [% WRAPPER breadcrumb_item %]
24             <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | uri %]">[% INCLUDE 'patron-title.inc' %]</a>
25         [% END %]
26         [% WRAPPER breadcrumb_item bc_active= 1 %]
27             <span>Set permissions</span>
28         [% END %]
29     [% END #/ WRAPPER breadcrumbs %]
30 [% END #/ WRAPPER sub-header.inc %]
31
32 <div class="main container-fluid">
33     <div class="row">
34         <div class="col-sm-10 col-sm-push-2">
35             <main>
36
37 [% INCLUDE 'members-toolbar.inc' %]
38
39 <form id="flag_form" method="post" action="/cgi-bin/koha/members/member-flags.pl">
40     <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
41     <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
42     <input type="hidden" name="newflags" value="1" />
43     <h1>Set permissions for [% INCLUDE 'patron-title.inc' no_html = 1 %]</h1>
44
45     <div id="permissionstree">
46         <div id="permissions_toolbar" class="btn-toolbar">
47             <button type="submit" class="btn btn-primary"><i class="fa fa-save"></i> Save</button>
48             <a class="btn btn-default" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-times"></i> Cancel</a>
49             <a class="toggleall toggleall_on btn btn-link" href="#"><i class="fa-solid fa-square-plus"></i> Show all</a>
50             <a class="toggleall toggleall_off btn btn-link" href="#"><i class="fa-solid fa-square-minus"></i> Hide all</a>
51             <a id="CheckAllFlags" class="btn btn-link" href="#">
52                 <i class="fa fa-check"></i> Select all
53             </a>
54             <a id="UncheckAllFlags" class="btn btn-link" href="#">
55                 <i class="fa fa-times"></i> Clear all
56             </a>
57             <div class="btn-group pull-right">
58                 Filter: <input type="text" name="permissions_filter" id="permissions_filter" size="20" />
59                 <a href="#" id="clear_filter" style="display:none"><i class="fa fa-times"></i></a>
60             </div>
61         </div>
62         <div class="permissions">
63             [% FOREACH loo IN loop %]
64                 [% IF ( loo.expand ) %]
65                     <div id="parent-flag-[% loo.flag | html %]" class="open parent">
66                 [% ELSE %]
67                     <div id="parent-flag-[% loo.flag | html %]" class="parent">
68                 [% END %]
69                 [% IF ( loo.checked ) %]
70                     [% IF disable_superlibrarian_privs && loo.bit == 0 %]
71                         <input type="checkbox" disabled="disabled" data-bit="0" id="flag-0" class="parent flag superlib" name="flag" value="[% loo.flag | html %]" checked="checked" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
72                         <input type="hidden" id="flag-0" name="flag" value="[% loo.flag | html %]" >
73                     [% ELSE %]
74                           <input type="checkbox" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]" class="parent flag" name="flag" value="[% loo.flag | html %]" checked="checked" />
75                     [% END %]
76                 [% ELSE %]
77                     [% IF disable_superlibrarian_privs && loo.bit == 0 %]
78                         <input type="checkbox" disabled="disabled" class="flag parent" data-bit="0" id="flag-0" name="flag" value="[% loo.flag | html %]" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
79                     [% ELSE %]
80                         <input type="checkbox" class="flag parent" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" />
81                     [% END %]
82                 [% END # /IF loo.checked %]
83                     <label class="permissiondesc" for="flag-[% loo.bit | html %]">
84                         [% PROCESS main_permissions name=loo.flag %]
85                     </label>
86                     [% IF ( loo.flag == "superlibrarian" ) %]<div class="hint superlibrarian-hint">This permission grants access to all areas. If selected, specific sub-permissions cannot be selected.</div>[% END %]
87                 [% IF ( loo.sub_perm_loop ) %]
88                     <a class="toggle-[% loo.bit | html %] togglechildren_off" href="#" data-bit="[% loo.bit | html %]"><i class="fa-solid fa-square-minus"></i> Hide details</a>
89                     <a class="toggle-[% loo.bit | html %] togglechildren_on" href="#" data-bit="[% loo.bit | html %]"><i class="fa-solid fa-square-plus"></i> Show details</a>
90                     <div class="children" id="flag-[% loo.bit | html %]-children">
91                         [% FOREACH sub_perm_loo IN loo.sub_perm_loop %]
92                             <div class="child-flags">
93                                 [% IF ( sub_perm_loo.checked ) %]
94                                     <input type="checkbox" id="[% sub_perm_loo.id | html %]" class="child flag" name="flag" value="[% sub_perm_loo.perm | html %]" checked="checked" />
95                                 [% ELSE %]
96                                     <input type="checkbox" id="[% sub_perm_loo.id | html %]" class="child flag" name="flag" value="[% sub_perm_loo.perm | html %]" />
97                                 [% END %]
98                                 <label class="permissiondesc" for="[% sub_perm_loo.id | html %]">
99                                     [% PROCESS sub_permissions name=sub_perm_loo.code %]
100                                 </label>
101                             </div>
102                         [% END %]
103                     </div> <!-- /#flag-[% loo.bit | html %]-children -->
104                 [% END # /IF loo.sub_perm_loop %]
105                 </div> <!-- /.parent -->
106             [% END # /FOREACH loo %]
107         </div>
108     </div> <!-- /#permissionstree -->
109 </form>
110
111             </main>
112         </div> <!-- /.col-sm-10.col-sm-push-2 -->
113
114         <div class="col-sm-2 col-sm-pull-10">
115             <aside>
116                 [% INCLUDE 'circ-menu.inc' %]
117             </aside>
118         </div> <!-- /.col-sm-2.col-sm-pull-10 -->
119     </div> <!-- /.row -->
120
121 [% MACRO jsinclude BLOCK %]
122     [% INCLUDE 'str/members-menu.inc' %]
123     [% Asset.js("js/members-menu.js") | $raw %]
124     [% Asset.js("lib/hc-sticky.js") | $raw %]
125     <script>
126         var Sticky;
127         $(document).ready(function() {
128
129             [% IF disable_superlibrarian_privs && patron.is_superlibrarian %]
130                 $("#CheckAllFlags,#UncheckAllFlags")
131                     .attr("disabled", true)
132                     .attr("title", _("The system preference ProtectSuperlibrarian is enabled"))
133                     .on("click", function(e){e.preventDefault()});
134             [% ELSE %]
135                 $("#CheckAllFlags").on("click",function(){
136                     $(".flag").attr("disabled", false);
137                     $(".flag").prop("checked", true);
138                     $("#flag-0").prop("checked", false);
139                     [% IF disable_superlibrarian_privs %]
140                         $("#flag-0").prop("disabled", true);
141                     [% END %]
142                     return false;
143                 });
144                 $("#UncheckAllFlags").on("click",function(){
145                     $(".flag").attr("disabled", false);
146                     [% IF disable_superlibrarian_privs %]
147                         $("#flag-0").prop("disabled", true);
148                     [% END %]
149                     $(".flag").prop("checked", false);
150                     return false;
151                 });
152                 $(".flag").change(function(){
153                     if(!$(this).is(':checked')){
154                         $("input#flag-0").prop("checked", false);
155                     }
156                 });
157             [% END %]
158
159             Sticky = $("#permissions_toolbar");
160             Sticky.hcSticky({
161                 stickTo: "#permissionstree",
162                 stickyClass: "floating"
163             });
164
165             $(".open div").show();
166
167             $("#permissions_filter").on("keyup", function(){
168                 $("#clear_filter").css("display","inline-block");
169                 $("a[class^=toggle-]").hide();
170                 var string = $(this).val();
171                 var divs = $("div[id!='parent-flag-superlibrarian']", ".permissions");
172                 if( string != "" && string.length > 3 ){
173                     divs.each(function(){
174                         if ( $(this).text().search(new RegExp( string, "i")) < 0 ) {
175                             $(this).hide();
176                         } else {
177                             $(this).show();
178                         }
179                     });
180                 } else {
181                     divs.show();
182                 }
183             });
184
185             $("#clear_filter").on("click", function(){
186                 $(".togglechildren_off").show();
187                 $("#permissions_filter").val("");
188                 $("div", "#permissionstree").show();
189                 $(this).css("display","none");
190             });
191
192             // Enforce Superlibrarian Privilege Mutual Exclusivity
193             if( $('input[id="flag-0"]:checked').length || $(".superlib:checked").length ){
194                 if ($('input[name="flag"]:checked').length > 1){
195                     alert(_("Inconsistency detected!") + "\n\n" + _("The superlibrarian privilege is mutually exclusive of other privileges, as it includes them all.") + "\n\n" + _("This patron's privileges will now be reset to include only superlibrarian."));
196                 }
197
198                 setLibrarian();
199             }
200
201             $('input#flag-0').click(function() {
202                 if( $('input[id="flag-0"]:checked').length || $(".superlib:checked").length ){
203                     $('input[name="flag"]').each(function() {
204                         if($(this).attr('id') != "flag-0" && !$(this).hasClass('superlib') ){
205                             $(this).prop('disabled', true);
206                             $(this).prop('checked', false);
207                         }
208                     });
209                 }
210                 else {
211                     $('input[name="flag"]').each(function() {
212                         $(this).prop('disabled', false);
213                     });
214                 }
215             });
216
217
218             $(".toggleall_off, .toggleall_on").on('click', function(e) {
219                 e.preventDefault();
220                 if( $(this).hasClass("toggleall_on")){
221                     $(".children,.togglechildren_off").show();
222                     $(".togglechildren_on").hide();
223                 } else {
224                     $(".children,.togglechildren_off").hide();
225                     $(".togglechildren_on").show();
226                 }
227             });
228
229             $(".togglechildren_off, .togglechildren_on").on('click', function(e) {
230                 e.preventDefault();
231                 var bit = $(this).data("bit");
232                 $("#flag-" + bit + "-children").toggle();
233                 $(".toggle-" + bit).toggle();
234             });
235
236             $(".togglechildren_off, .togglechildren_on").hover( function(){
237                 $(this).parent().addClass("permission-highlight");
238             }, function(){
239                 $(this).parent().removeClass("permission-highlight");
240             });
241
242             $(".flag").on("change",function(e){
243                 e.preventDefault();
244                 if( $(this).hasClass("child") ){
245                     if( $(this).prop("checked") ){
246                         // If this is the last of all the child boxes to be checked the parent should be checked too
247                         var unchecked = 0;
248                         $(this).closest(".children").find(".child").each(function(){
249                             if( !$(this).prop("checked") ){
250                                 // There are still unchecked checkboxes in this group
251                                 unchecked = 1;
252                             }
253                         });
254                         if( unchecked === 0 ){
255                             $(this).closest(".parent").find(".flag.parent").prop("checked", true);
256                         }
257                     } else {
258                         $(this).closest(".parent").find(".flag.parent").prop("checked", false);
259                     }
260                 } else {
261                     var bit = $(this).data("bit");
262                     if( $(this).is(":checked") ){
263                         $("#flag-" + bit + "-children").show().find(".flag").prop("checked", true);
264                         $(".toggle-" + bit + ".togglechildren_on").hide();
265                         $(".toggle-" + bit + ".togglechildren_off").show();
266                     } else {
267                         $("#flag-" + bit + "-children").show().find(".flag").prop("checked", false);
268                     }
269                 }
270             });
271         });
272
273         function setLibrarian(){
274             $('input[name="flag"]').each(function() {
275                 if($(this).attr('id') != "flag-0" && !$(this).hasClass('superlib') ){
276                     $(this).prop('disabled', true);
277                     $(this).prop('checked', false);
278                 }
279             });
280         }
281
282     </script>
283 [% END %]
284
285 [% INCLUDE 'intranet-bottom.inc' %]