Bugzilla – Attachment 124443 Details for
Bug 28882
Incorrect permissions check client-side
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 28882: permission UI allows selection of superlibrarian permission
Bug-28882-permission-UI-allows-selection-of-superl.patch (text/plain), 4.36 KB, created by
Hayley Pelham
on 2021-09-03 01:28:50 UTC
(
hide
)
Description:
Bug 28882: permission UI allows selection of superlibrarian permission
Filename:
MIME Type:
Creator:
Hayley Pelham
Created:
2021-09-03 01:28:50 UTC
Size:
4.36 KB
patch
obsolete
>From d28def68df20a13057ff3a7bb5ccedafd45a27f1 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 19 Aug 2021 15:07:50 +0200 >Subject: [PATCH] Bug 28882: permission UI allows selection of superlibrarian > permission > >With bug 20100 and 22150 we allow to select all the permissions but the >superlibrarian permission, to ease the selection. And we also forbid a >non-superlibrarian user to add superlibrarian permission. > >However there is something wrong in the JS code and it's possible to add >the superlibrarian permission. The user is getting an ugly 500 and so >the permission change is not done, but the UI checks must be fixed. > >To recreate: >Login with a non-superlibrarian user >Edit permission >Clear all >=> You can select the "superlibrarian" permission > >Test plan: >Login with a non-superlibrarian user >Try to set the superlibrarian permissions to a user >=> not possible >Try the select all/clear all >=> still cannot set the superlibrarian permission > >Work to be done: >Login with a non-superlibrarian user >Edit permissions for a superlibrarian user >=> You can remove it, then cannot add it back >Should we allow removal of superlibrarian permission by >non-superlibrarian user? >--- > .../intranet-tmpl/prog/en/modules/members/member-flags.tt | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >index 1a87c6af3a..d2f4156f51 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >@@ -69,14 +69,14 @@ > [% END %] > [% IF ( loo.checked ) %] > [% IF disable_superlibrarian_privs && loo.bit == 0 %] >- <input type="checkbox" disabled="disabled" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]_disabled" class="parent flag superlib" name="flag" value="[% loo.flag | html %]" checked="checked" title="The system preference ProtectSuperlibrarianPrivileges is enabled" /> >- <input type="hidden" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" > >+ <input type="checkbox" disabled="disabled" data-bit="0" id="flag-0" class="parent flag superlib" name="flag" value="[% loo.flag | html %]" checked="checked" title="The system preference ProtectSuperlibrarianPrivileges is enabled" /> >+ <input type="hidden" id="flag-0" name="flag" value="[% loo.flag | html %]" > > [% ELSE %] > <input type="checkbox" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]" class="parent flag" name="flag" value="[% loo.flag | html %]" checked="checked" /> > [% END %] > [% ELSE %] > [% IF disable_superlibrarian_privs && loo.bit == 0 %] >- <input type="checkbox" disabled="disabled" class="flag parent" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]_disabled" name="flag" value="[% loo.flag | html %]" title="The system preference ProtectSuperlibrarianPrivileges is enabled" /> >+ <input type="checkbox" disabled="disabled" class="flag parent" data-bit="0" id="flag-0" name="flag" value="[% loo.flag | html %]" title="The system preference ProtectSuperlibrarianPrivileges is enabled" /> > [% ELSE %] > <input type="checkbox" class="flag parent" data-bit="[% loo.bit | html %]" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" /> > [% END %] >@@ -131,10 +131,16 @@ > $(".flag").attr("disabled", false); > $(".flag").prop("checked", true); > $("#flag-0").prop("checked", false); >+ [% IF disable_superlibrarian_privs %] >+ $("#flag-0").prop("disabled", true); >+ [% END %] > return false; > }); > $("#UncheckAllFlags").on("click",function(){ > $(".flag").attr("disabled", false); >+ [% IF disable_superlibrarian_privs %] >+ $("#flag-0").prop("disabled", true); >+ [% END %] > $(".flag").prop("checked", false); > return false; > }); >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 28882
:
123972
|
124082
|
124443
|
124444
|
124445
|
124558
|
124559