From ad6fe53f0c7fdf1e27f35603da26f51e8c49250b Mon Sep 17 00:00:00 2001
From: Mathieu Saby <mathieu.saby@univ-rennes2.fr>
Date: Sun, 22 Dec 2013 22:48:34 +0100
Subject: [PATCH] Bug 11027: (follow-up) Create link to baskets/basketgroups
 only if user have required permissions

With this followup, a user without order_manage permission won't be able
to cick on a basket and a user without group_manage permission won't be
able to click on a basketgroup

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
---
 .../prog/en/modules/acqui/lateorders.tt              | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
index a0369458b2..c5341c29e6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
@@ -159,10 +159,18 @@ $(document).ready(function() {
                    [% lateorder.subtotal %]
             </td>
             <td>
-                <a href="basket.pl?basketno=[% lateorder.basketno %]" title="basket">[% lateorder.basketname %] ([% lateorder.basketno %])</a>
+                [% IF ( CAN_user_acquisition_order_manage ) %]
+                    <a href="basket.pl?basketno=[% lateorder.basketno %]" title="basket">[% lateorder.basketname %] ([% lateorder.basketno %])</a>
+                [% ELSE %]
+                    [% lateorder.basketname %] ([% lateorder.basketno %])
+                [% END %]
             </td>
             <td>
-                <a href="basketgroup.pl?op=add&booksellerid=[% lateorder.supplierid %]&basketgroupid=[% lateorder.basketgroupid %]" title="basketgroup">[% lateorder.basketgroupname %] ([% lateorder.basketgroupid %])</a>
+                [% IF ( CAN_user_acquisition_group_manage ) %]
+                    <a href="basketgroup.pl?op=add&booksellerid=[% lateorder.supplierid %]&basketgroupid=[% lateorder.basketgroupid %]" title="basketgroup">[% lateorder.basketgroupname %] ([% lateorder.basketgroupid %])</a>
+                [% ELSE %]
+                    [% lateorder.basketgroupname %] ([% lateorder.basketgroupid %])</a>
+                [% END %]
             </td>
             <td>[% lateorder.branch %]
             </td>
-- 
2.39.5