The spent and ordered pages linked from the funds table on acquisition home page require full (all) acquisition rights. Patch will change the required permission, so that one permission in acquisition will be enough to access the pages.
Created attachment 7883 [details] [review] Bug 7602: Spent and ordered pages require full acquisition permissions Changes permissions on these pages so that one acquisition permission will make it possible to access the pages. Currently pages are only accessible for users with full (all checkboxes checked) acquisition permissions.
Created attachment 7895 [details] [review] [SIGNED-OFF] Bug 7602: Spent and ordered pages require full acquisition permissions Changes permissions on these pages so that one acquisition permission will make it possible to access the pages. Currently pages are only accessible for users with full (all checkboxes checked) acquisition permissions. Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com> Tested with only one acquisitions permission (various choices) and patron can access the ordered and spent pages.
QA Comment: The proposed patch works as expected. But on the ordered.pl page, there is a link to neworderempty.pl. This one is strictly accessible if you have the order_manage permission. Shouldn't the permission be order_manage for these 2 pages ?
Hi Jonathan, that's a good question. I figured that it would not hurt to make it accessible to users with 1 acq permission, because it's only a report. You can't change order or budget information from that page. As an enhancement the links could be hidden, if you lack the proper permission (order_manage). I am not sure how others think about this - perhaps we can do a quick poll?
I'm with Katrin, I think that it could be enhanced, but I'm not sure it should hold this patch back.
Hi Jonathan, I looked at the permission table again, because I wanted to change to your suggestion. But I am not sure order_manage is the way to go. There are lots of reasons why this information could be important for people with other acq permissions: - order_receive - find out what has not been delivered yet - budget_* - checking what the money is being spent for - order_manage - ... - ... I wonder if someone without any of these permissions will have access to acquisitions at all?
Created attachment 7979 [details] [review] Bug 7602: Followup: Spent and ordered pages require full acquisition permissions Bug 7602: Followup: Spent and ordered pages require full acquisition permissions hide link to neworderempty if user does not have order_manage permission It seems this patch is a response for our problem :) What do you think about it ?
I think it's a good thing - but we should change the spent page to take permissions into account too. There is a link to the receive page that should depend on the right permission.
Created attachment 8029 [details] [review] [SIGNED-OFF] Bug 7602: Followup: Spent and ordered pages require full acquisition permissions hide link to neworderempty if user does not have order_manage permission Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
First patch: simple change to permissions. Passed QA Second patch: adds conditional to template to links only show if they're relevant to the user. Passed QA.
Patch for "spent" still missing, so obsoleting patches and changing status to reflect that.
We could be more strict like only showing the link to the invoice if the user has the corresponding permission, but I will move this idea to a separate bug.
After looking at the pages: The only links on the ordered page are to the vendor and to the invoice page - both are accessible with * (any acq permission). So I think there are no more changes needed.