Attachment 134965 Details for Bug 30720 – Bug 30720: Batch action links in result list missing permission checks

[patch] Bug 30720: Batch action links in result list missing permission checks

Bug-30720-Batch-action-links-in-result-list-missin.patch (text/plain), 2.88 KB, created by Katrin Fischer on 2022-05-13 10:30:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2022-05-13 10:30:50 UTC

Size: 2.88 KB

patch

obsolete

>From 55e1793f6bee24533fe4ce95c0c225c3e5311888 Mon Sep 17 00:00:00 2001
>From: Katrin Fischer <katrin.fischer@bsz-bw.de>
>Date: Fri, 13 May 2022 10:25:27 +0000
>Subject: [PATCH] Bug 30720: Batch action links in result list missing
> permission checks
>
>In the staff interface you can select records for merging, batch editing,
>and batch deleting from the result list. This fixes the code to check for
>the specific batch edit records and batch delete records permissions, so
>those actions are only shown if the user has the right permissions.
>As there is no merge record permission yet, it's assumed that edit_cataloge is
>needed as before (no change in behavior).
>
>To test:
>- Create a staff user with only catalogue and editcatalogue permissions.
>- Do a search in the catalog of the staff interface
>- Select a few records from result list to unlock the Edit button on top
>- Verify it shows all three options: edit, delete and merge
>- Apply patch
>- Verfiy now only merging is shown
>- Add the records_batchdel and records_batchmod permissions from the tools
>  area one after another and verify the display changes accordingly.
>---
> .../intranet-tmpl/prog/en/modules/catalogue/results.tt      | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
>index cde3f0f090..0e550fd353 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
>@@ -175,11 +175,17 @@
>                                     <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
>                                         <i class="fa fa-pencil"></i> Edit <span class="caret"></span>
>                                     </button>
>+                                    [% IF ( CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel || CAN_user_editcatalogue_edit_catalogue ) %]
>                                     <ul class="dropdown-menu">
>+                                        [% IF ( CAN_user_tools_records_batchmod ) %]
>                                         <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li>
>+                                        [% END %]
>+                                        [% IF ( CAN_user_tools_records_batchdel ) %]
>                                         <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li>
>+                                        [% END %]
>                                         <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li>
>                                     </ul>
>+                                    [% END %]
>                                 </div>
>                             [% END %]
> 
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 30720: 134965 | 134970 | 134995