Bug 22868: Move suggestions_manage subperm out of acquisition perm
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Tue, 14 Jan 2020 09:02:11 +0000 (10:02 +0100)
committerMartin Renvoize <martin.renvoize@ptfs-europe.com>
Thu, 30 Jan 2020 08:27:00 +0000 (08:27 +0000)
commitae53caa6818939274352fde85454c24112e6f984
tree231e8b2efc8cdc0c7868f3421ffb1c5c92e740f4
parenta5c82cf0da49b81801d215ee2968754ad655c9cf
Bug 22868: Move suggestions_manage subperm out of acquisition perm

Bug 11911 replaced the permission of suggestions.pl (create a purchase
suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'.
However we have a lot of acquisition scripts that have lax permissions
(acquisition => '*' which means any sub permissions of acquisition is
enough).

That causes problem when a circulation staff can create purchase
suggestions but not access acquisition information.

One solution is to move the suggestions_manage subpermission out of the
acquisition permission and create a new suggestion permission.

Test plan:
0. Setup
* Create a patron with several permission (and full acquisition
permission)
* Create another patron with several permission, and suggestions_manage
permission
* Create another patron without the suggestions_manage permission
1. Apply the patch and execute the update database entry
2. Note that the third patron you create still does not have
suggestions_manage
3. Confirm that you can create a purchase suggestion if you have
suggestions_manage, but cannot access acquisition pages if you do not
have any subpermissions of the acquisition permission

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
installer/data/mysql/atomicupdate/bug_22868.perl [new file with mode: 0644]
installer/data/mysql/userflags.sql
installer/data/mysql/userpermissions.sql
koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
members/purchase-suggestions.pl
suggestion/suggestion.pl