Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
Created attachment 64103 [details] [review] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket
Created attachment 64179 [details] [review] [SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Christophe, please provide tests for this change.
Created attachment 64280 [details] [review] Bug 18756 - add Unit Test
Created attachment 64403 [details] [review] Bug 18756 - add Unit Test Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Created attachment 64588 [details] [review] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 64589 [details] [review] Bug 18756 - add Unit Test Signed-off-by: Lee Jamison <ldjamison@marywood.edu> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 17.05.x, will be in 17.05.02
These patches have been pushed to 16.11.x and will be in 16.11.10.
Pushed to 16.05.x, for 16.05.15 release