Bug 30720 - Batch delete links from result list missing permission checks
Summary: Batch delete links from result list missing permission checks
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Keywords:
Depends on: 23349
Blocks:
  Show dependency treegraph
 
Reported: 2022-05-09 14:26 UTC by Katrin Fischer
Modified: 2023-12-28 20:42 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00


Attachments
Bug 30720: Batch action links in result list missing permission checks (2.88 KB, patch)
2022-05-13 10:30 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 30720: Batch action links in result list missing permission checks (2.93 KB, patch)
2022-05-13 13:20 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30720: Batch action links in result list missing permission checks (2.99 KB, patch)
2022-05-14 07:52 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2022-05-09 14:26:12 UTC
When several records are selected from the result list in the staff interface, it unlocks a button with several batch options.

The batch delete and batch edit tools have separate permissions independent from the edit_catalogue permission, so this should be updated to check for each of them separately for displaying the button and the separate entries.

                            [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
                                <div class="btn-group">
                                    <a class="btn btn-default btn-xs" id="z3950submit" href="#"><i class="fa fa-search"></i> Z39.50/SRU search</a>
                                </div>
                                <div class="btn-group">
                                    <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                                        <i class="fa fa-pencil"></i> Edit <span class="caret"></span>
                                    </button>
                                    <ul class="dropdown-menu">
                                        <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li>
                                        <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li>
                                        <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li>
                                    </ul>
                                </div>
                            [% END %]
Comment 1 Katrin Fischer 2022-05-13 10:30:50 UTC
Created attachment 134965 [details] [review]
Bug 30720: Batch action links in result list missing permission checks

In the staff interface you can select records for merging, batch editing,
and batch deleting from the result list. This fixes the code to check for
the specific batch edit records and batch delete records permissions, so
those actions are only shown if the user has the right permissions.
As there is no merge record permission yet, it's assumed that edit_cataloge is
needed as before (no change in behavior).

To test:
- Create a staff user with only catalogue and editcatalogue permissions.
- Do a search in the catalog of the staff interface
- Select a few records from result list to unlock the Edit button on top
- Verify it shows all three options: edit, delete and merge
- Apply patch
- Verfiy now only merging is shown
- Add the records_batchdel and records_batchmod permissions from the tools
  area one after another and verify the display changes accordingly.
Comment 2 Owen Leonard 2022-05-13 13:20:03 UTC
Created attachment 134970 [details] [review]
Bug 30720: Batch action links in result list missing permission checks

In the staff interface you can select records for merging, batch editing,
and batch deleting from the result list. This fixes the code to check for
the specific batch edit records and batch delete records permissions, so
those actions are only shown if the user has the right permissions.
As there is no merge record permission yet, it's assumed that edit_cataloge is
needed as before (no change in behavior).

To test:
- Create a staff user with only catalogue and editcatalogue permissions.
- Do a search in the catalog of the staff interface
- Select a few records from result list to unlock the Edit button on top
- Verify it shows all three options: edit, delete and merge
- Apply patch
- Verfiy now only merging is shown
- Add the records_batchdel and records_batchmod permissions from the tools
  area one after another and verify the display changes accordingly.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Martin Renvoize 2022-05-14 07:52:39 UTC
Created attachment 134995 [details] [review]
Bug 30720: Batch action links in result list missing permission checks

In the staff interface you can select records for merging, batch editing,
and batch deleting from the result list. This fixes the code to check for
the specific batch edit records and batch delete records permissions, so
those actions are only shown if the user has the right permissions.
As there is no merge record permission yet, it's assumed that edit_cataloge is
needed as before (no change in behavior).

To test:
- Create a staff user with only catalogue and editcatalogue permissions.
- Do a search in the catalog of the staff interface
- Select a few records from result list to unlock the Edit button on top
- Verify it shows all three options: edit, delete and merge
- Apply patch
- Verfiy now only merging is shown
- Add the records_batchdel and records_batchmod permissions from the tools
  area one after another and verify the display changes accordingly.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2022-05-14 07:53:07 UTC
Good catch Katrin, all works as expected and QA scripts are happy.

PQA
Comment 5 Fridolin Somers 2022-05-16 21:14:53 UTC
Those links have been added by Bug 23349
Comment 6 Fridolin Somers 2022-05-16 21:21:00 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄