In 16.11.05.000 If a user has permissions to run - but not create or edit reports - they can still create or edit reports by editing the the URL while running a report and changing the Phase parameter to "Edit SQL" or "Create report from SQL".
I could confirm that on master too, raising importance...
Doesn't surprise me. There are many parts of Koha where the permission restricts viewing a link or a button, but doesn't apply to the actual web page itself :/.
Also reproduced it. Let's see if I can fix this quickly...
Created attachment 65292 [details] [review] Bug 18898 - Some permissions for Reports can be bypassed If you manually visit the following links when you only have permission to run reports, you'll still be able to access the ability to create and edit reports: /cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL /cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL This patch ties these 2 unaccounted for phases to the create_reports permission.
Created attachment 65320 [details] [review] Bug 18898 - Some permissions for Reports can be bypassed If you manually visit the following links when you only have permission to run reports, you'll still be able to access the ability to create and edit reports: /cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL /cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL This patch ties these 2 unaccounted for phases to the create_reports permission. With patch, issue no longer can be reproduced. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 65337 [details] [review] Bug 18898 - Some permissions for Reports can be bypassed If you manually visit the following links when you only have permission to run reports, you'll still be able to access the ability to create and edit reports: /cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL /cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL This patch ties these 2 unaccounted for phases to the create_reports permission. With patch, issue no longer can be reproduced. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 17.05.x, will be in 17.05.04.
This patch has been pushed to 16.11.x and will be in 16.11.12.
Pushed to 16.05.x, for 16.05.17 release