From 8ca26c8a852d5e4125ac4d7abf105a4b6138059f Mon Sep 17 00:00:00 2001 From: Brendan Lawlor Date: Tue, 9 Sep 2025 13:56:15 +0000 Subject: [PATCH] Bug 35830: Add merge_borrowers subpermission Merging patrons only required edit_borrowers permission but would result in a patron deletion. This patch requires a new merge_borrowers subpermission To test: 1. Give a patron the following permissions catalogue, edit_borrowers, list_borrowers 2. Log into the staff interface as the patron 3. Do a patron search and select 2 patrons 4. Click merge patron - success - a patron got deleted 5. Apply patch, updatedatabase and restart_all 6. Repeat steps 3 and 4 - you can't 7. Add the new permission for merge_borrowers 8. Repeat steps 3 and 4 - now you can 9. prove t/Koha/Auth/Patrons.t Sponsored-by: CLAMS Signed-off-by: Owen Leonard Signed-off-by: David Cook Signed-off-by: wainuiwitikapark --- ...ug_35830_add_merge_borrowers_permission.pl | 23 +++++++++++++++++++ .../data/mysql/mandatory/userpermissions.sql | 1 + .../prog/en/includes/permissions.inc | 3 +++ .../prog/en/modules/members/member.tt | 6 ++++- members/merge-patrons.pl | 8 +++---- t/Koha/Auth/Permissions.t | 1 + 6 files changed, 37 insertions(+), 5 deletions(-) create mode 100755 installer/data/mysql/atomicupdate/Bug_35830_add_merge_borrowers_permission.pl diff --git a/installer/data/mysql/atomicupdate/Bug_35830_add_merge_borrowers_permission.pl b/installer/data/mysql/atomicupdate/Bug_35830_add_merge_borrowers_permission.pl new file mode 100755 index 0000000000..0e630b0aa8 --- /dev/null +++ b/installer/data/mysql/atomicupdate/Bug_35830_add_merge_borrowers_permission.pl @@ -0,0 +1,23 @@ +use Modern::Perl; + +return { + bug_number => "35830", + description => "Add permission borrowers:merge_borrowers", + up => sub { + my ($args) = @_; + my ( $dbh, $out ) = @$args{qw(dbh out)}; + + $dbh->do( + q{INSERT IGNORE INTO permissions (module_bit, code, description) + VALUES (4, 'merge_borrowers', 'Merge patrons')} + ); + + say $out "Added new permission 'merge_borrowers'"; + + $dbh->do( + q{INSERT INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, module_bit, 'merge_borrowers' FROM user_permissions where module_bit = 4 and code = 'edit_borrowers';} + ); + + say $out "Added 'merge_borrowers' permission to existing users with 'edit_borrowers'"; + }, +}; diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index a919b1a9fb..770df769fe 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -44,6 +44,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 3, 'manage_identity_providers', 'Manage identity providers'), ( 4, 'delete_borrowers', 'Delete patrons'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), + ( 4, 'merge_borrowers', 'Merge patrons'), ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), ( 6, 'place_holds', 'Place holds for patrons'), ( 6, 'modify_holds_priority', 'Modify holds priority'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index 931a5cfda1..dbfa5a3d5a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -296,6 +296,9 @@ Delete patrons ([% name | html %]) + [%- CASE 'merge_borrowers' -%] + Merge patrons + ([% name | html %]) [%- CASE 'edit_borrowers' -%] Add, modify and view patron information diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt index 170abbc27b..1a5e055fa4 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt @@ -58,7 +58,11 @@ | Clear all [% IF CAN_user_tools_manage_patron_lists %] - + [% END %] + [% IF CAN_user_borrowers_merge_borrowers %] +
+ +
[% END %] [% IF CAN_user_tools_manage_patron_lists %] diff --git a/members/merge-patrons.pl b/members/merge-patrons.pl index 5318ff6ff5..2c95b4c63d 100755 --- a/members/merge-patrons.pl +++ b/members/merge-patrons.pl @@ -30,10 +30,10 @@ my $cgi = CGI->new; my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( { - template_name => "members/merge-patrons.tt", - query => $cgi, - type => "intranet", - flagsrequired => { borrowers => 'edit_borrowers' }, + template_name => "members/merge-patrons.tt", + query => $cgi, + type => "intranet", + flagsrequired => { borrowers => 'merge_borrowers' }, } ); diff --git a/t/Koha/Auth/Permissions.t b/t/Koha/Auth/Permissions.t index 5fd840770a..80f55afe53 100755 --- a/t/Koha/Auth/Permissions.t +++ b/t/Koha/Auth/Permissions.t @@ -123,6 +123,7 @@ subtest 'superlibrarian tests' => sub { 'CAN_user_acquisition_vendors_manage' => 1, 'CAN_user_acquisition' => 1, 'CAN_user_borrowers_delete_borrowers' => 1, + 'CAN_user_borrowers_merge_borrowers' => 1, 'CAN_user_borrowers_edit_borrowers' => 1, 'CAN_user_borrowers_view_borrower_infos_from_any_libraries' => 1, 'CAN_user_borrowers' => 1,