Summary: | Permissions for Mana Reports are currently linked to Permissions in Serials | ||
---|---|---|---|
Product: | Koha | Reporter: | Kelly McElligott <kelly> |
Component: | Mana-kb | Assignee: | Alex Arnaud <alex.arnaud> |
Status: | Failed QA --- | QA Contact: | |
Severity: | normal | ||
Priority: | P5 - low | CC: | alex.arnaud, andrewfh, hebah, jgaine, jonathan.druart, julian.maurice, victor |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Bug Depends on: | 17047 | ||
Bug Blocks: | |||
Attachments: |
Bug 25572: Fix permission check for mana (reports)
Bug 25572: Fix permission check for mana (reports) |
Description
Kelly McElligott
2020-05-21 19:35:09 UTC
From svc/mana/search: 32 my ( $auth_status, $sessionID ) = 33 check_cookie_auth( $input->cookie('CGISESSID'), 34 { serials => 'create_subscription' } ); Not sure how we can fix this correctly. +1 on this, folks don't like having to give extra permissions for stuff like this to work. Yes, I have staff that do nothing with Serials but are heavy report users. Created attachment 113865 [details] [review] Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. Created attachment 113899 [details] [review] Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com > Hi, I have a patron with just the catalogue and create_reports permissions. I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out. When giving the create_subscription permission, it works, the form is filled with the SQL of the report. Could I be missing a step? First time using Mana to create a report I think. Services where restarted after applying the patch. Logs look alright: 172.24.0.1 - - [25/Dec/2020:20:32:06 +0000] "POST /intranet/svc/mana/use HTTP/1.1" 200 0 "http://172.24.0.6:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL" "Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0" As for the subscriptions, it works with minimal permissions. BTW was there a simpler way to test with sample than to search the web for the ISSN of a famous newspaper then import (the right one) with Z39.50? (In reply to Victor Grousset/tuxayo from comment #6) > Hi, I have a patron with just the catalogue and create_reports permissions. > I can't create a report from Mana, when clicking on "import" the button > spins infinitely. When refreshing the page, I'm logged out. > When giving the create_subscription permission, it works, the form is filled > with the SQL of the report. > Could I be missing a step? First time using Mana to create a report I think. I followed those steps and it works ok for me. This patch only modifies svc/mana/search but all svc/mana/* scripts are affected by the same bug, so all of them should be fixed. Also, it is really weird that these scripts return a 200 OK response when permissions don't match. It should be a 403. Alex, can you have a look please? |