Bug 25572

Summary: Permissions for Mana Reports are currently linked to Permissions in Serials
Product: Koha Reporter: Kelly McElligott <kelly>
Component: Mana-kbAssignee: Alex Arnaud <alex.arnaud>
Status: Failed QA --- QA Contact:
Severity: normal    
Priority: P5 - low CC: alex.arnaud, andrewfh, hebah, jgaine, jonathan.druart, julian.maurice, victor
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 17047    
Bug Blocks:    
Attachments: Bug 25572: Fix permission check for mana (reports)
Bug 25572: Fix permission check for mana (reports)

Description Kelly McElligott 2020-05-21 19:35:09 UTC
Mana works with both Reports and Serials.  Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module.
Comment 1 Jonathan Druart 2020-05-22 08:20:44 UTC
From svc/mana/search:
 32 my ( $auth_status, $sessionID ) =
 33   check_cookie_auth( $input->cookie('CGISESSID'),
 34     { serials => 'create_subscription' } );

Not sure how we can fix this correctly.
Comment 2 Andrew Fuerste-Henry 2020-11-19 17:21:23 UTC
+1 on this, folks don't like having to give extra permissions for stuff like this to work.
Comment 3 Jeff Gaines 2020-11-19 17:24:03 UTC
Yes, I have staff that do nothing with Serials but are heavy report users.
Comment 4 Jonathan Druart 2020-11-20 08:01:26 UTC
Created attachment 113865 [details] [review]
Bug 25572: Fix permission check for mana (reports)

Mana works with both Reports and Serials.
Currently a staff member needs to have a serial permissions to be able to use the
Mana function in the reporting module. If the staff member does not have the
permission, "Create A New Subscription", the staff member can not use Mana in the
reports module.

Test plan:
Enable Mana
Create a patron with the "create new subscription" permission
Create another patron with the "create new report" permission
Confirm that both can use Mana in their respective module.
Comment 5 Kelly McElligott 2020-11-20 16:47:12 UTC
Created attachment 113899 [details] [review]
Bug 25572: Fix permission check for mana (reports)

Mana works with both Reports and Serials.
Currently a staff member needs to have a serial permissions to be able to use the
Mana function in the reporting module. If the staff member does not have the
permission, "Create A New Subscription", the staff member can not use Mana in the
reports module.

Test plan:
Enable Mana
Create a patron with the "create new subscription" permission
Create another patron with the "create new report" permission
Confirm that both can use Mana in their respective module.

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com	>
Comment 6 Victor Grousset/tuxayo 2020-12-25 20:52:22 UTC
Hi, I have a patron with just the catalogue and create_reports permissions.
I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out.
When giving the create_subscription permission, it works, the form is filled with the SQL of the report.
Could I be missing a step? First time using Mana to create a report I think.

Services where restarted after applying the patch.

Logs look alright:
172.24.0.1 - - [25/Dec/2020:20:32:06 +0000] "POST /intranet/svc/mana/use HTTP/1.1" 200 0 "http://172.24.0.6:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL" "Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0"


As for the subscriptions, it works with minimal permissions.
BTW was there a simpler way to test with sample than to search the web for the ISSN of a famous newspaper then import (the right one) with Z39.50?
Comment 7 Jonathan Druart 2021-01-04 09:51:50 UTC
(In reply to Victor Grousset/tuxayo from comment #6)
> Hi, I have a patron with just the catalogue and create_reports permissions.
> I can't create a report from Mana, when clicking on "import" the button
> spins infinitely. When refreshing the page, I'm logged out.
> When giving the create_subscription permission, it works, the form is filled
> with the SQL of the report.
> Could I be missing a step? First time using Mana to create a report I think.

I followed those steps and it works ok for me.
Comment 8 Julian Maurice 2021-01-08 09:26:50 UTC
This patch only modifies svc/mana/search but all svc/mana/* scripts are affected by the same bug, so all of them should be fixed.

Also, it is really weird that these scripts return a 200 OK response when permissions don't match. It should be a 403.
Comment 9 Jonathan Druart 2021-01-08 09:32:36 UTC
Alex, can you have a look please?