members/member-flags.pl

   1 #!/usr/bin/perl
   2
   3 # script to edit a member's flags
   4 # Written by Steve Tonnesen
   5 # July 26, 2002 (my birthday!)
   6
   7 use Modern::Perl;
   8
   9 use CGI qw ( -utf8 );
  10 use C4::Output;
  11 use C4::Auth qw(:DEFAULT :EditPermissions);
  12 use C4::Context;
  13 use C4::Members;
  14 #use C4::Acquisitions;
  15
  16 use Koha::Patron::Categories;
  17 use Koha::Patrons;
  18
  19 use C4::Output;
  20 use Koha::Token;
  21
  22 my $input = new CGI;
  23
  24 my $flagsrequired = { permissions => 1 };
  25 my $member=$input->param('member');
  26 my $patron = Koha::Patrons->find( $member );
  27 unless ( $patron ) {
  28     print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$member");
  29     exit;
  30 }
  31
  32 my $category_type = $patron->category->category_type;
  33 my $bor = $patron->unblessed;
  34 if( $category_type eq 'S' )  { # FIXME Is this really needed?
  35     $flagsrequired->{'staffaccess'} = 1;
  36 }
  37 my ($template, $loggedinuser, $cookie) = get_template_and_user({
  38         template_name   => "members/member-flags.tt",
  39         query           => $input,
  40         type            => "intranet",
  41         authnotrequired => 0,
  42         flagsrequired   => $flagsrequired,
  43         debug           => 1,
  44 });
  45
  46 my $logged_in_user = Koha::Patrons->find( $loggedinuser );
  47 output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } );
  48
  49 my %member2;
  50 $member2{'borrowernumber'}=$member;
  51
  52 if ($input->param('newflags')) {
  53
  54     output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
  55         unless Koha::Token->new->check_csrf({
  56             session_id => scalar $input->cookie('CGISESSID'),
  57             token  => scalar $input->param('csrf_token'),
  58         });
  59
  60
  61     my $dbh=C4::Context->dbh();
  62
  63     my @perms = $input->multi_param('flag');
  64     my %all_module_perms = ();
  65     my %sub_perms = ();
  66     foreach my $perm (@perms) {
  67         if ($perm !~ /:/) {
  68             $all_module_perms{$perm} = 1;
  69         } else {
  70             my ($module, $sub_perm) = split /:/, $perm, 2;
  71             push @{ $sub_perms{$module} }, $sub_perm;
  72         }
  73     }
  74
  75     # construct flags
  76     my $module_flags = 0;
  77     my $sth=$dbh->prepare("SELECT bit,flag FROM userflags ORDER BY bit");
  78     $sth->execute();
  79     while (my ($bit, $flag) = $sth->fetchrow_array) {
  80         if (exists $all_module_perms{$flag}) {
  81             $module_flags += 2**$bit;
  82         }
  83     }
  84
  85     $sth = $dbh->prepare("UPDATE borrowers SET flags=? WHERE borrowernumber=?");
  86     my $old_flags = $patron->flags // 0;
  87     if( ( $old_flags == 1 || $module_flags == 1 ) &&
  88       $old_flags != $module_flags ) {
  89         die "Non-superlibrarian is changing superlibrarian privileges" if !C4::Context->IsSuperLibrarian && C4::Context->preference('ProtectSuperlibrarianPrivileges'); # Interface should not allow this, so we can just die here
  90     }
  91     $sth->execute($module_flags, $member);
  92
  93     # deal with subpermissions
  94     $sth = $dbh->prepare("DELETE FROM user_permissions WHERE borrowernumber = ?");
  95     $sth->execute($member);
  96     $sth = $dbh->prepare("INSERT INTO user_permissions (borrowernumber, module_bit, code)
  97                         SELECT ?, bit, ?
  98                         FROM userflags
  99                         WHERE flag = ?");
 100     foreach my $module (keys %sub_perms) {
 101         next if exists $all_module_perms{$module};
 102         foreach my $sub_perm (@{ $sub_perms{$module} }) {
 103             $sth->execute($member, $sub_perm, $module);
 104         }
 105     }
 106
 107     print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member");
 108 } else {
 109
 110     my $accessflags;
 111     my $dbh = C4::Context->dbh();
 112     # FIXME This needs to be improved to avoid doing the same query
 113     my $sth = $dbh->prepare("select bit,flag from userflags");
 114     $sth->execute;
 115     while ( my ( $bit, $flag ) = $sth->fetchrow ) {
 116         if ( $bor->{flags} && $bor->{flags} & 2**$bit ) {
 117             $accessflags->{$flag} = 1;
 118         }
 119     }
 120
 121     my $all_perms  = get_all_subpermissions();
 122     my $user_perms = get_user_subpermissions($bor->{'userid'});
 123     $sth = $dbh->prepare("SELECT bit, flag FROM userflags ORDER BY bit");
 124     $sth->execute;
 125     my @loop;
 126
 127     while (my ($bit, $flag) = $sth->fetchrow) {
 128         my $checked='';
 129         if ($accessflags->{$flag}) {
 130             $checked= 1;
 131         }
 132
 133         my %row = ( bit => $bit,
 134             flag => $flag,
 135             checked => $checked,
 136         );
 137
 138         my @sub_perm_loop = ();
 139         my $expand_parent = 0;
 140         if ($checked) {
 141             if (exists $all_perms->{$flag}) {
 142                 $expand_parent = 1;
 143                 foreach my $sub_perm (sort keys %{ $all_perms->{$flag} }) {
 144                     push @sub_perm_loop, {
 145                         id => "${flag}_$sub_perm",
 146                         perm => "$flag:$sub_perm",
 147                         code => $sub_perm,
 148                         checked => 1
 149                     };
 150                 }
 151             }
 152         } else {
 153             if (exists $user_perms->{$flag}) {
 154                 $expand_parent = 1;
 155                 # put selected ones first
 156                 foreach my $sub_perm (sort keys %{ $user_perms->{$flag} }) {
 157                     push @sub_perm_loop, {
 158                         id => "${flag}_$sub_perm",
 159                         perm => "$flag:$sub_perm",
 160                         code => $sub_perm,
 161                         checked => 1
 162                     };
 163                 }
 164             }
 165             # then ones not selected
 166             if (exists $all_perms->{$flag}) {
 167                 foreach my $sub_perm (sort keys %{ $all_perms->{$flag} }) {
 168                     push @sub_perm_loop, {
 169                         id => "${flag}_$sub_perm",
 170                         perm => "$flag:$sub_perm",
 171                         code => $sub_perm,
 172                         checked => 0
 173                     } unless exists $user_perms->{$flag} and exists $user_perms->{$flag}->{$sub_perm};
 174                 }
 175             }
 176         }
 177         $row{expand} = $expand_parent;
 178         if ($#sub_perm_loop > -1) {
 179             $row{sub_perm_loop} = \@sub_perm_loop;
 180         }
 181         next if ( ( $row{flag} eq 'cash_management' ) && !C4::Context->preference('UseCashRegisters') );
 182         push @loop, \%row;
 183     }
 184
 185 $template->param(
 186     patron         => $patron,
 187     loop           => \@loop,
 188     csrf_token =>
 189         Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
 190     disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
 191 );
 192
 193     output_html_with_http_headers $input, $cookie, $template->output;
 194
 195 }