Split the create reports permission further, so that delete reports is separated out. This will administratively prevent accidental deletions by removing the capability from those who do so.
Created attachment 53723 [details] [review] Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission. From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability.
Wanted to test, but sorry: - atomicupdate is missing, so I have no delete_reports in table permissions - a test plan would be nice
Created attachment 53739 [details] [review] Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission. From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability.
TEST PLAN --------- 1) back up db 2) apply patch 3) ./installer/data/mysql/updatedatabase.pl -- should run without issue. 4) in mysql: > drop database ... > create database ... -- totally blanks it for fresh web install 5) run web install -- installing should have no issues 6) go to a patron 7) set permissions 8) expand the reports permission -- should have delete reports now 9) click help and scroll down to 'Granular Reports Permissions' right at the bottom. -- there should be a new delete_reports section 10) Head over to guided reports and build a few reports. -- as system account user, delete stuff should all be visible. 11) Find a patron, set all permissions, except delete reports. 12) log out and then log in as the modified patron 13) Head over the save reports -- none of the delete options should be available to the user. 14) run koha qa test tools 15) restore db
Created attachment 53741 [details] [review] Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission. From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability. TEST PLAN --------- 1) back up db 2) apply patch 3) ./installer/data/mysql/updatedatabase.pl -- should run without issue. 4) in mysql: > drop database ... > create database ... -- totally blanks it for fresh web install 5) run web install -- installing should have no issues 6) go to a patron 7) set permissions 8) expand the reports permission -- should have delete reports now 9) click help and scroll down to 'Granular Reports Permissions' right at the bottom. -- there should be a new delete_reports section 10) Head over to guided reports and build a few reports. -- as system account user, delete stuff should all be visible. 11) Find a patron, set all permissions, except delete reports. 12) log out and then log in as the modified patron 13) Head over the save reports -- none of the delete options should be available to the user. 14) run koha qa test tools 15) restore db Followed test plan. Additionally tried to delete using params in URL (not possible, OK) Signed-off-by: Marc <veron@veron.ch>
Mark, you must provide a SQL query to update the permissions of patrons. Actually everything should be ok for 95%, but if a patron has create_report but execute_report (ok that sounds weird), after this patch he won't be able to delete reports.
(In reply to Jonathan Druart from comment #6) > Mark, you must provide a SQL query to update the permissions of patrons. > Actually everything should be ok for 95%, but if a patron has create_report > but execute_report (ok that sounds weird), after this patch he won't be able > to delete reports. DOH! Thanks for catching that.
Created attachment 53864 [details] [review] Bug 16978: Followup - Copy create_report permissions for delete_report This patch should deal with comment #6's point of where a user who has create, but not execute permissions, would lose delete ability. Users with create and execute permissions would already have delete as well. TEST PLAN --------- 1) Back up db 2) drop database koha_library; 3) create database koha_library; 4) web install with all sample data with system user 6) log into staff client as system user 7) make sample koha admin user a superlibrarian 8) set username and password for sample koha admin user 9) log out and log in as koha admin 10) Create a user (USER_A) with permissions: create_reports and execute_reports. 11) Create a user (USER_B) with permissions: create_reports, but not execute_reports. 12) Create a user (USER_C) with permissions: execute_reports, but not create_reports. 13) Create a user (USER_D) with no report permissions. 14) Run the atomic update. 15) Check USER_A permissions -- should have delete_reports 16) Check USER_B -- should have delete_reports 17) Check USER_C -- should NOT have delete_reports 18) Check USER_D -- should NOT have delete_reports 19) run koha qa test tools 20) restore db
Created attachment 53871 [details] [review] Bug 16978: Followup - Copy create_report permissions for delete_report This patch should deal with comment #6's point of where a user who has create, but not execute permissions, would lose delete ability. Users with create and execute permissions would already have delete as well. TEST PLAN --------- 1) Back up db 2) drop database koha_library; 3) create database koha_library; 4) web install with all sample data with system user 6) log into staff client as system user 7) make sample koha admin user a superlibrarian 8) set username and password for sample koha admin user 9) log out and log in as koha admin 10) Create a user (USER_A) with permissions: create_reports and execute_reports. 11) Create a user (USER_B) with permissions: create_reports, but not execute_reports. 12) Create a user (USER_C) with permissions: execute_reports, but not create_reports. 13) Create a user (USER_D) with no report permissions. 14) Run the atomic update. 15) Check USER_A permissions -- should have delete_reports 16) Check USER_B -- should have delete_reports 17) Check USER_C -- should NOT have delete_reports 18) Check USER_D -- should NOT have delete_reports 19) run koha qa test tools 20) restore db Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Created attachment 53887 [details] [review] Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission. From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability. TEST PLAN --------- 1) back up db 2) apply patch 3) ./installer/data/mysql/updatedatabase.pl -- should run without issue. 4) in mysql: > drop database ... > create database ... -- totally blanks it for fresh web install 5) run web install -- installing should have no issues 6) go to a patron 7) set permissions 8) expand the reports permission -- should have delete reports now 9) click help and scroll down to 'Granular Reports Permissions' right at the bottom. -- there should be a new delete_reports section 10) Head over to guided reports and build a few reports. -- as system account user, delete stuff should all be visible. 11) Find a patron, set all permissions, except delete reports. 12) log out and then log in as the modified patron 13) Head over the save reports -- none of the delete options should be available to the user. 14) run koha qa test tools 15) restore db Followed test plan. Additionally tried to delete using params in URL (not possible, OK) Signed-off-by: Marc <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 53888 [details] [review] Bug 16978: Followup - Copy create_report permissions for delete_report This patch should deal with comment #6's point of where a user who has create, but not execute permissions, would lose delete ability. Users with create and execute permissions would already have delete as well. TEST PLAN --------- 1) Back up db 2) drop database koha_library; 3) create database koha_library; 4) web install with all sample data with system user 6) log into staff client as system user 7) make sample koha admin user a superlibrarian 8) set username and password for sample koha admin user 9) log out and log in as koha admin 10) Create a user (USER_A) with permissions: create_reports and execute_reports. 11) Create a user (USER_B) with permissions: create_reports, but not execute_reports. 12) Create a user (USER_C) with permissions: execute_reports, but not create_reports. 13) Create a user (USER_D) with no report permissions. 14) Run the atomic update. 15) Check USER_A permissions -- should have delete_reports 16) Check USER_B -- should have delete_reports 17) Check USER_C -- should NOT have delete_reports 18) Check USER_D -- should NOT have delete_reports 19) run koha qa test tools 20) restore db Signed-off-by: Frédéric Demians <f.demians@tamil.fr> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed to master for 16.11, thanks Mark!