Bugzilla – Attachment 169263 Details for
Bug 35905
Missing permission check for "record batch delete" from reports
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35905: Add permission checks to report results
Bug-35905-Add-permission-checks-to-report-results.patch (text/plain), 5.68 KB, created by
Roman Dolny
on 2024-07-20 09:06:14 UTC
(
hide
)
Description:
Bug 35905: Add permission checks to report results
Filename:
MIME Type:
Creator:
Roman Dolny
Created:
2024-07-20 09:06:14 UTC
Size:
5.68 KB
patch
obsolete
>From 36bd5a0a1ea196b54aa120f4e91129f1e220b970 Mon Sep 17 00:00:00 2001 >From: Brendan Lawlor <blawlor@clamsnet.org> >Date: Fri, 19 Jul 2024 20:51:15 +0000 >Subject: [PATCH] Bug 35905: Add permission checks to report results > >Test plan: >1. Apply patch >2. Create a report like: > select biblionumber from biblio limit 10 >2. Run the report >3. Verify batch operations dropdown contains batch modification and deletion >4. Run the report again as a user that has only catalogue and reports permissions >5. Confirm the batch operations drop down only includes Add to list >6. Confirm the records drop down only includes View record > >Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> >--- > .../modules/reports/guided_reports_start.tt | 20 +++++++++++-------- > 1 file changed, 12 insertions(+), 8 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >index 50f7a65a4f..8428ff1be5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >@@ -1085,12 +1085,14 @@ > [% FOREACH header_ro IN header_row %] > [% IF header_ro.has_biblionumbers && ( header_ro.cell == 'biblionumber' || header_types.item( header_ro.cell ) == 'biblionumber' ) %] > <li class="dropdown-header">Bibliographic records</li> >- <li> >- <a href="#" data-submit="batch_record_modification" data-toggle="tooltip" data-placement="right" title="Send visible records to batch record modification" class="batch_op send_to_record_mod">Batch record modification</a> >- </li> >- <li> >- <a href="#" data-submit="batch_record_deletion" data-toggle="tooltip" data-placement="right" title="Send visible records to batch record deletion" class="batch_op send_to_record_del">Batch record deletion</a> >- </li> >+ [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel ) %] >+ <li> >+ <a href="#" data-submit="batch_record_modification" data-toggle="tooltip" data-placement="right" title="Send visible records to batch record modification" class="batch_op send_to_record_mod">Batch record modification</a> >+ </li> >+ <li> >+ <a href="#" data-submit="batch_record_deletion" data-toggle="tooltip" data-placement="right" title="Send visible records to batch record deletion" class="batch_op send_to_record_del">Batch record deletion</a> >+ </li> >+ [% END # /IF CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel %] > <li> > <a href="#" data-submit="batch_add_to_list" data-toggle="tooltip" data-placement="right" title="Send visible records to a list" class="batch_op send_to_list">Add to list</a> > </li> >@@ -1194,8 +1196,10 @@ > <span class="data-plain">[% cells.cell | $raw %]</span> > <div id="biblionumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-toggle="dropdown" href="#">[% cells.cell | $raw %] <b class="caret"></b></a> > <ul class="dropdown-menu pull-right" role="menu"> >- <li><a target="_blank" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit record</a></li> >- <li role="separator" class="divider"></li> >+ [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ) %] >+ <li><a target="_blank" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit record</a></li> >+ <li role="separator" class="divider"></li> >+ [% END # /IF CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items %] > <li><a target="_blank" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye"></i> View record</a></li> > </ul> > </div> >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35905
:
169260
|
169263
|
170440
|
170634
|
170635
|
170636
|
171105
|
171492