Bug 16978 - Add delete reports user permission
Summary: Add delete reports user permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Mark Tompsett
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-26 13:50 UTC by Mark Tompsett
Modified: 2017-12-07 22:18 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 16978: Add delete reports user permission (7.02 KB, patch)
2016-07-26 13:57 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 16978: Add delete reports user permission (7.56 KB, patch)
2016-07-26 23:58 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 16978: Add delete reports user permission (8.58 KB, patch)
2016-07-27 05:06 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 16978: Followup - Copy create_report permissions for delete_report (2.12 KB, patch)
2016-08-02 00:03 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 16978: Followup - Copy create_report permissions for delete_report (2.26 KB, patch)
2016-08-02 04:49 UTC, Frédéric Demians
Details | Diff | Splinter Review
Bug 16978: Add delete reports user permission (8.65 KB, patch)
2016-08-02 10:41 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16978: Followup - Copy create_report permissions for delete_report (2.33 KB, patch)
2016-08-02 10:41 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Tompsett 2016-07-26 13:50:33 UTC
Split the create reports permission further, so that delete reports is separated out. This will administratively prevent accidental deletions by removing the capability from those who do so.
Comment 1 Mark Tompsett 2016-07-26 13:57:30 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2016-07-26 18:30:10 UTC
Wanted to test, but sorry:
- atomicupdate is missing, so I have no delete_reports in table permissions
- a test plan would be nice
Comment 3 Mark Tompsett 2016-07-26 23:58:54 UTC Comment hidden (obsolete)
Comment 4 Mark Tompsett 2016-07-27 00:11:03 UTC
TEST PLAN
---------
1) back up db
2) apply patch
3) ./installer/data/mysql/updatedatabase.pl
   -- should run without issue.
4) in mysql:
   > drop database ...
   > create database ...
   -- totally blanks it for fresh web install
5) run web install
   -- installing should have no issues
6) go to a patron
7) set permissions
8) expand the reports permission
   -- should have delete reports now
9) click help and scroll down to
   'Granular Reports Permissions' right at the bottom.
   -- there should be a new delete_reports section
10) Head over to guided reports and build a few reports.
    -- as system account user, delete stuff should all be visible.
11) Find a patron, set all permissions, except delete reports.
12) log out and then log in as the modified patron
13) Head over the save reports
    -- none of the delete options should be available to the user.
14) run koha qa test tools
15) restore db
Comment 5 Marc Véron 2016-07-27 05:06:38 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2016-08-01 14:38:53 UTC
Mark, you must provide a SQL query to update the permissions of patrons.
Actually everything should be ok for 95%, but if a patron has create_report but execute_report (ok that sounds weird), after this patch he won't be able to delete reports.
Comment 7 Mark Tompsett 2016-08-01 20:51:43 UTC
(In reply to Jonathan Druart from comment #6)
> Mark, you must provide a SQL query to update the permissions of patrons.
> Actually everything should be ok for 95%, but if a patron has create_report
> but execute_report (ok that sounds weird), after this patch he won't be able
> to delete reports.

DOH! Thanks for catching that.
Comment 8 Mark Tompsett 2016-08-02 00:03:36 UTC Comment hidden (obsolete)
Comment 9 Frédéric Demians 2016-08-02 04:49:00 UTC Comment hidden (obsolete)
Comment 10 Jonathan Druart 2016-08-02 10:41:49 UTC
Created attachment 53887 [details] [review]
Bug 16978: Add delete reports user permission

This splits off the delete capability from the create reports permission.
From a UI perspective there were CSS issues, that this patch set hackily
bypasses. Perhaps someone else can amend this enhancement with the required
changes so that the extra column at the beginning of the table can be
removed when the user does not have delete capability.

TEST PLAN
---------
1) back up db
2) apply patch
3) ./installer/data/mysql/updatedatabase.pl
   -- should run without issue.
4) in mysql:
   > drop database ...
   > create database ...
   -- totally blanks it for fresh web install
5) run web install
   -- installing should have no issues
6) go to a patron
7) set permissions
8) expand the reports permission
   -- should have delete reports now
9) click help and scroll down to
   'Granular Reports Permissions' right at the bottom.
   -- there should be a new delete_reports section
10) Head over to guided reports and build a few reports.
    -- as system account user, delete stuff should all be visible.
11) Find a patron, set all permissions, except delete reports.
12) log out and then log in as the modified patron
13) Head over the save reports
    -- none of the delete options should be available to the user.
14) run koha qa test tools
15) restore db

Followed test plan. Additionally tried to delete using params in URL
(not possible, OK)
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 11 Jonathan Druart 2016-08-02 10:41:52 UTC
Created attachment 53888 [details] [review]
Bug 16978: Followup - Copy create_report permissions for delete_report

This patch should deal with comment #6's point of where a user who
has create, but not execute permissions, would lose delete ability.
Users with create and execute permissions would already have delete
as well.

TEST PLAN
---------
 1) Back up db
 2) drop database koha_library;
 3) create database koha_library;
 4) web install with all sample data with system user
 6) log into staff client as system user
 7) make sample koha admin user a superlibrarian
 8) set username and password for sample koha admin user
 9) log out and log in as koha admin
10) Create a user (USER_A) with permissions:
        create_reports   and execute_reports.
11) Create a user (USER_B) with permissions:
        create_reports,  but not execute_reports.
12) Create a user (USER_C) with permissions:
        execute_reports, but not create_reports.
13) Create a user (USER_D) with no report permissions.
14) Run the atomic update.
15) Check USER_A permissions
    -- should have delete_reports
16) Check USER_B
    -- should have delete_reports
17) Check USER_C
    -- should NOT have delete_reports
18) Check USER_D
    -- should NOT have delete_reports
19) run koha qa test tools
20) restore db

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 12 Kyle M Hall 2016-09-09 14:25:54 UTC
Pushed to master for 16.11, thanks Mark!