Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module.
From svc/mana/search: 32 my ( $auth_status, $sessionID ) = 33 check_cookie_auth( $input->cookie('CGISESSID'), 34 { serials => 'create_subscription' } ); Not sure how we can fix this correctly.
+1 on this, folks don't like having to give extra permissions for stuff like this to work.
Yes, I have staff that do nothing with Serials but are heavy report users.
Created attachment 113865 [details] [review] Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module.
Created attachment 113899 [details] [review] Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com >
Hi, I have a patron with just the catalogue and create_reports permissions. I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out. When giving the create_subscription permission, it works, the form is filled with the SQL of the report. Could I be missing a step? First time using Mana to create a report I think. Services where restarted after applying the patch. Logs look alright: 172.24.0.1 - - [25/Dec/2020:20:32:06 +0000] "POST /intranet/svc/mana/use HTTP/1.1" 200 0 "http://172.24.0.6:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL" "Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0" As for the subscriptions, it works with minimal permissions. BTW was there a simpler way to test with sample than to search the web for the ISSN of a famous newspaper then import (the right one) with Z39.50?
(In reply to Victor Grousset/tuxayo from comment #6) > Hi, I have a patron with just the catalogue and create_reports permissions. > I can't create a report from Mana, when clicking on "import" the button > spins infinitely. When refreshing the page, I'm logged out. > When giving the create_subscription permission, it works, the form is filled > with the SQL of the report. > Could I be missing a step? First time using Mana to create a report I think. I followed those steps and it works ok for me.
This patch only modifies svc/mana/search but all svc/mana/* scripts are affected by the same bug, so all of them should be fixed. Also, it is really weird that these scripts return a 200 OK response when permissions don't match. It should be a 403.
Alex, can you have a look please?