[Koha-bugs] [Bug 10679] Lists interface offers delete option when user doesn' t have permission

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679

Marcel de Rooy <m.de.rooy at rijksmuseum.nl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|Needs Signoff               |Failed QA

--- Comment #8 from Marcel de Rooy <m.de.rooy at rijksmuseum.nl> ---
Instead of looping through the search results of
Koha::Virtualshelfcontents->search({ shelfnumber => $self->shelfnumber })
please search for the column borrowernumber too.

The algorithm should be something as:

if list->count==0 return false
if owner return true
if delete_own AND delete_other return true (in that case you could delete all)
if delete_own AND there are 'own' entries return true (so search here!)
if delete_other AND there are 'other' entries (count - countown > 0) then
return true

Maybe you understand now why I did not write that code :)
We should perhaps consider: show the button Remove selected only if you are the
owner or allowed to delete all entries. And show a link on the individual
entries if this is not the case but you can delete an individual one. Because
if you see the button, it could well be that you are only allowed to delete one
record out of 20. Which one?
So you would need a routine can_biblio_be_removed (singular)

Or simplify the permissions: Add/Delete on owner level (or staff member,
moderator?) and Add/Delete for other users.

-- 
You are receiving this mail because:
You are watching all bug changes.