Summary: | Batch delete links from result list missing permission checks | ||
---|---|---|---|
Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
Component: | Templates | Assignee: | Katrin Fischer <katrin.fischer> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | fridolin.somers, martin.renvoize |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.05.00
|
|
Bug Depends on: | 23349 | ||
Bug Blocks: | |||
Attachments: |
Bug 30720: Batch action links in result list missing permission checks
Bug 30720: Batch action links in result list missing permission checks Bug 30720: Batch action links in result list missing permission checks |
Description
Katrin Fischer
2022-05-09 14:26:12 UTC
Created attachment 134965 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Created attachment 134970 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 134995 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Good catch Katrin, all works as expected and QA scripts are happy. PQA Pushed to master for 22.05, thanks to everybody involved 🦄 |