Bug 37737 - Users with 'execute_reports' permission can create reports 23.11 and lower
Summary: Users with 'execute_reports' permission can create reports 23.11 and lower
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Lisette Scheer
QA Contact: Testopia
URL:
Keywords: rel_23_11_candidate
Depends on:
Blocks:
 
Reported: 2024-08-26 18:06 UTC by Nick Clemens (kidclamp)
Modified: 2024-11-14 21:48 UTC (History)
16 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.10,23.05.16,22.11.22
Circulation function:

Attachments
Bug 37737: [23.11] Fixed report permissions to prevent not allowed duplication (1.29 KB, patch)
2024-08-29 22:50 UTC, Lisette Scheer 		Details | Diff | Splinter Review
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication (1.50 KB, patch)
2024-09-09 20:16 UTC, Lisette Scheer 		Details | Diff | Splinter Review
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication (1.56 KB, patch)
2024-09-12 16:25 UTC, Brendan Lawlor 		Details | Diff | Splinter Review
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication (1.61 KB, patch)
2024-09-17 12:38 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-08-26 18:06:09 UTC 
When a user clicks 'Preview SQL' on a report, they have a 'Duplicate' button

This sends a URL with phase:
phase=Create%20report%20from%20existing

The permissions check looks for:
'Build new from existing'
when the phase isn't found we only require:
reports: '*' (any report permission)

The Duplicate button leads to a form where the phase is "Save Report" which, again, is not in the permissions checks at the start and so defaults to reports:*

Fix by bug 34478 in 24.05+
Comment 1 David Cook 2024-08-27 00:02:37 UTC 
Yeah the reports permissions are a bit of a mess :(
Comment 2 Lisette Scheer 2024-08-29 22:50:20 UTC 
Created attachment 170891 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent not allowed duplication

Made the run report permission explicit
Comment 3 Fridolin Somers 2024-09-09 15:21:22 UTC 
 else {
-    $flagsrequired = '*';
 }

Is this on purpose ?
Empty else o_O
Comment 4 Lisette Scheer 2024-09-09 15:44:21 UTC 
(In reply to Fridolin Somers from comment #3)
>  else {
> -    $flagsrequired = '*';
>  }
> 
> Is this on purpose ?
> Empty else o_O

No, no it was not. I'll fix it and do a new patch.
Comment 5 Lisette Scheer 2024-09-09 20:16:41 UTC 
Created attachment 171232 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.
Comment 6 Brendan Lawlor 2024-09-12 16:25:30 UTC 
Created attachment 171418 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 7 Nick Clemens (kidclamp) 2024-09-17 12:38:54 UTC 
Created attachment 171619 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Fridolin Somers 2024-10-21 11:51:08 UTC 
Sorry i missed this one for 23.11.09, will be in 23.11.10
Comment 9 Wainui Witika-Park 2024-10-23 23:02:24 UTC 
Applied to 23.05.x-security for 23.05.16
Comment 10 Phil Ringnalda 2024-11-14 21:48:22 UTC 
Verified that the Version(s) released in: 22.11.22 was true.