Bug 25572 - Permissions for Mana Reports are currently linked to Permissions in Serials
Summary: Permissions for Mana Reports are currently linked to Permissions in Serials
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Mana-kb (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Alex Arnaud
QA Contact:
URL:
Keywords:
Depends on: 17047
Blocks:
  Show dependency treegraph
 
Reported: 2020-05-21 19:35 UTC by Kelly McElligott
Modified: 2023-03-10 20:22 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 25572: Fix permission check for mana (reports) (2.22 KB, patch)
2020-11-20 08:01 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25572: Fix permission check for mana (reports) (2.28 KB, patch)
2020-11-20 16:47 UTC, Kelly McElligott
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly McElligott 2020-05-21 19:35:09 UTC
Mana works with both Reports and Serials.  Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module.
Comment 1 Jonathan Druart 2020-05-22 08:20:44 UTC
From svc/mana/search:
 32 my ( $auth_status, $sessionID ) =
 33   check_cookie_auth( $input->cookie('CGISESSID'),
 34     { serials => 'create_subscription' } );

Not sure how we can fix this correctly.
Comment 2 Andrew Fuerste-Henry 2020-11-19 17:21:23 UTC
+1 on this, folks don't like having to give extra permissions for stuff like this to work.
Comment 3 Jeff Gaines 2020-11-19 17:24:03 UTC
Yes, I have staff that do nothing with Serials but are heavy report users.
Comment 4 Jonathan Druart 2020-11-20 08:01:26 UTC
Created attachment 113865 [details] [review]
Bug 25572: Fix permission check for mana (reports)

Mana works with both Reports and Serials.
Currently a staff member needs to have a serial permissions to be able to use the
Mana function in the reporting module. If the staff member does not have the
permission, "Create A New Subscription", the staff member can not use Mana in the
reports module.

Test plan:
Enable Mana
Create a patron with the "create new subscription" permission
Create another patron with the "create new report" permission
Confirm that both can use Mana in their respective module.
Comment 5 Kelly McElligott 2020-11-20 16:47:12 UTC
Created attachment 113899 [details] [review]
Bug 25572: Fix permission check for mana (reports)

Mana works with both Reports and Serials.
Currently a staff member needs to have a serial permissions to be able to use the
Mana function in the reporting module. If the staff member does not have the
permission, "Create A New Subscription", the staff member can not use Mana in the
reports module.

Test plan:
Enable Mana
Create a patron with the "create new subscription" permission
Create another patron with the "create new report" permission
Confirm that both can use Mana in their respective module.

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com	>
Comment 6 Victor Grousset/tuxayo 2020-12-25 20:52:22 UTC
Hi, I have a patron with just the catalogue and create_reports permissions.
I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out.
When giving the create_subscription permission, it works, the form is filled with the SQL of the report.
Could I be missing a step? First time using Mana to create a report I think.

Services where restarted after applying the patch.

Logs look alright:
172.24.0.1 - - [25/Dec/2020:20:32:06 +0000] "POST /intranet/svc/mana/use HTTP/1.1" 200 0 "http://172.24.0.6:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL" "Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0"


As for the subscriptions, it works with minimal permissions.
BTW was there a simpler way to test with sample than to search the web for the ISSN of a famous newspaper then import (the right one) with Z39.50?
Comment 7 Jonathan Druart 2021-01-04 09:51:50 UTC
(In reply to Victor Grousset/tuxayo from comment #6)
> Hi, I have a patron with just the catalogue and create_reports permissions.
> I can't create a report from Mana, when clicking on "import" the button
> spins infinitely. When refreshing the page, I'm logged out.
> When giving the create_subscription permission, it works, the form is filled
> with the SQL of the report.
> Could I be missing a step? First time using Mana to create a report I think.

I followed those steps and it works ok for me.
Comment 8 Julian Maurice 2021-01-08 09:26:50 UTC
This patch only modifies svc/mana/search but all svc/mana/* scripts are affected by the same bug, so all of them should be fixed.

Also, it is really weird that these scripts return a 200 OK response when permissions don't match. It should be a 403.
Comment 9 Jonathan Druart 2021-01-08 09:32:36 UTC
Alex, can you have a look please?