Bug 33999 - Subscription details link on bibliographic detail page should have permission check
Summary: Subscription details link on bibliographic detail page should have permission...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Owen Leonard
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-13 16:39 UTC by Owen Leonard
Modified: 2023-12-28 20:47 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02,22.11.08
Circulation function:


Attachments
Bug 33999: Subscription details link on bibliographic detail page should have permission check (1.75 KB, patch)
2023-06-13 16:44 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 33999: Subscription details link on bibliographic detail page should have permission check (1.80 KB, patch)
2023-06-13 19:10 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 33999: (follow-up) Use link-styled button (1.19 KB, patch)
2023-06-26 14:07 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 33999: Subscription details link on bibliographic detail page should have permission check (1.86 KB, patch)
2023-07-03 13:55 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 33999: (follow-up) Use link-styled button (1.25 KB, patch)
2023-07-03 13:56 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2023-06-13 16:39:49 UTC
On the bibliographic detail page for a serial record, under the "Subscriptions" tab, there is a link to "Subscription details." This link takes the user to the Serials module, so it should not be displayed if the user doesn't have the correct permission.
Comment 1 Owen Leonard 2023-06-13 16:44:51 UTC
Created attachment 152314 [details] [review]
Bug 33999: Subscription details link on bibliographic detail page should have permission check

This patch wraps the "Subscription details" link on the bibliographic
detail page with a permissions check, "CAN_user_serials," so that a user
lacking permission to access the Serials module will not be shown the
link.

To test, apply the patch and view the bibliographic detail page of a
serial record.

- When viewing the "Subscriptions" tab as a user with Serials
  permissions you should see the "Subscription details" link.
- When viewing the tab as a user without the correct permissions the
  link should not be present.
Comment 2 Lucas Gass (lukeg) 2023-06-13 19:10:42 UTC
Created attachment 152320 [details] [review]
Bug 33999: Subscription details link on bibliographic detail page should have permission check

This patch wraps the "Subscription details" link on the bibliographic
detail page with a permissions check, "CAN_user_serials," so that a user
lacking permission to access the Serials module will not be shown the
link.

To test, apply the patch and view the bibliographic detail page of a
serial record.

- When viewing the "Subscriptions" tab as a user with Serials
  permissions you should see the "Subscription details" link.
- When viewing the tab as a user without the correct permissions the
  link should not be present.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 3 Katrin Fischer 2023-06-22 21:38:25 UTC
The permission check is correct of course, but I am not sure about turning this into a button. For me a button means "action", but here it's "navigation".

Owen, what do you think?
Comment 4 Owen Leonard 2023-06-26 14:07:34 UTC
Created attachment 152687 [details] [review]
Bug 33999: (follow-up) Use link-styled button
Comment 5 Martin Renvoize (ashimema) 2023-07-03 13:55:59 UTC
Created attachment 152977 [details] [review]
Bug 33999: Subscription details link on bibliographic detail page should have permission check

This patch wraps the "Subscription details" link on the bibliographic
detail page with a permissions check, "CAN_user_serials," so that a user
lacking permission to access the Serials module will not be shown the
link.

To test, apply the patch and view the bibliographic detail page of a
serial record.

- When viewing the "Subscriptions" tab as a user with Serials
  permissions you should see the "Subscription details" link.
- When viewing the tab as a user without the correct permissions the
  link should not be present.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize (ashimema) 2023-07-03 13:56:02 UTC
Created attachment 152978 [details] [review]
Bug 33999: (follow-up) Use link-styled button

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 7 Martin Renvoize (ashimema) 2023-07-03 13:56:17 UTC
Nice catch, Passing QA
Comment 8 Tomás Cohen Arazi (tcohen) 2023-07-03 17:51:05 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 9 Martin Renvoize (ashimema) 2023-07-17 15:00:16 UTC
Thanks for all the hard work!

Pushed to 23.05.x for the next release
Comment 10 Matt Blenkinsop 2023-07-18 13:12:01 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x