Same problem as Bug 10943. The page requires borrowers to access but the menu item is still shown to users who do not have the borrowers permission. From purchase-suggestions.pl we can see there is no check for which permissions are required to visit the linked page. Yet in the include the only thing checked is: [% IF ( suggestionsview ) %] So a user who doesn't have permission to access Purchase suggestions can still see the menu item.
I'm working on this.
Created attachment 35267 [details] [review] Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu.
Created attachment 35285 [details] [review] [SIGNED OFF] Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> The page requires borrowers permission, so the link should act accordingly.
Currently there is a second file for building the navigation that could be changed too, but this patch is correct and an improvement. / koha-tmpl / intranet-tmpl / prog / en / includes / circ-menu.tt There is a bug report to remove the file in favor of the .inc, as both have some differences right now.
Created attachment 35298 [details] [review] Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> The page requires borrowers permission, so the link should act accordingly. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Same problem for Fines, Circulation history, Notices and Statistics tabs. circ-menu.tt is only used from the Fines tab (which is not accessible), to it's not useful to add this check to it. But for the consistency, it makes sense. follow-up coming.
Created attachment 35299 [details] [review] Bug 13584: (follow-up) Able to view menu for Purchase Suggestions even when user does not have permission Same changes as the previous patch, for the .tt file.
Patch pushed to master. Thanks Thomas!