Bug 18426: Make sure the logged in user can edit the subscriptions

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index 18364bc..491b840 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -34,15 +34,17 @@
     [% ELSE %]
         [% SET tab = 'opened' %]
     [% END %]
-    <div class="actions">
-        <a class="select-all" href="#" data-tab="[% tab %]"><i class="fa fa-check"></i> Select all</a>
-        |
-        <a class="clear-all" href="#" data-tab="[% tab %]"><i class="fa fa-remove"></i> Clear all</a>
-        <span class="itemselection_actions">
-            | Actions:
-            <a class="itemselection_action_modify"><i class="fa fa-pencil"></i> Modify selected serials</a>
-        </span>
-    </div>
+    [% IF CAN_user_serials_edit_subscription %]
+        <div class="actions">
+            <a class="select-all" href="#" data-tab="[% tab %]"><i class="fa fa-check"></i> Select all</a>
+            |
+            <a class="clear-all" href="#" data-tab="[% tab %]"><i class="fa fa-remove"></i> Clear all</a>
+            <span class="itemselection_actions">
+                | Actions:
+                <a class="itemselection_action_modify"><i class="fa fa-pencil"></i> Modify selected serials</a>
+            </span>
+        </div>
+    [% END %]
     <table>
       <thead>
         <tr>
@@ -84,7 +86,13 @@
         [% FOREACH subscription IN subscriptions %]
         [% UNLESS subscription.cannotdisplay %]
           <tr>
-            <td><input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid %]"/></td>
+            <td>
+                [% UNLESS subscription.cannotedit %]
+                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid %]" />
+                [% ELSE %]
+                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid %]" disabled="disabled" title="You cannot edit this subscription" />
+                [% END %]
+            </td>
             <td>
             [% IF ( subscription.issn ) %][% subscription.issn %]
             [% END %]

diff --git a/serials/subscription-batchedit.pl b/serials/subscription-batchedit.pl
index 865116a..9483ac6 100755 (executable)
--- a/serials/subscription-batchedit.pl
+++ b/serials/subscription-batchedit.pl
@@ -69,6 +69,7 @@ if ($batchedit) {
     }
 
     foreach my $subscription (@subscriptions) {
+        next unless C4::Serials::can_edit_subscription( $subscription->unblessed ); # This should be moved to Koha::Subscription->can_edit
         while (my ($key, $value) = each %params) {
             if (defined $value and $value ne '') {
                 $subscription->$key($value);