Bugzilla – Attachment 170636 Details for
Bug 35905
Missing permission check for "record batch delete" from reports
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35905: (follow-up) Add permission checks to report reuslts
Bug-35905-follow-up-Add-permission-checks-to-repor.patch (text/plain), 8.36 KB, created by
Brendan Lawlor
on 2024-08-23 14:42:59 UTC
(
hide
)
Description:
Bug 35905: (follow-up) Add permission checks to report reuslts
Filename:
MIME Type:
Creator:
Brendan Lawlor
Created:
2024-08-23 14:42:59 UTC
Size:
8.36 KB
patch
obsolete
>From 538c09f8e6b6d1673a747ba33ae08301a5cd4ce4 Mon Sep 17 00:00:00 2001 >From: Brendan Lawlor <blawlor@clamsnet.org> >Date: Thu, 22 Aug 2024 21:17:51 +0000 >Subject: [PATCH] Bug 35905: (follow-up) Add permission checks to report > reuslts > >To test: >1. Create the following two reports > a) select borrowernumber, cardnumber from borrowers limit 100 > b) select itemnumber, biblionumber from items limit 100 >2. Create a user with only catalogue and reports permissions >3. Run each report as the user with minimal permissions >3. Verify the batch operations button is disabled >4. Verify there is no link to edit patron in borrowernumber columns >5. Verify there is no link to edit record in itemnumber and biblionumber columns >6. Add the following permissions one at a time and re run the reports > tools_items_batchmod > tools_items_batchdel > editcatalogue_edit_catalogue > editcatalogue_edit_items > tools_edit_patrons > borrowers_edit_borrowers >7. Verify the batch operations button is enabled and displays the correct links >8. Verify the links to edit patron and edit record are displayed correctly >--- > .../modules/reports/guided_reports_start.tt | 24 ++++++++++++------- > 1 file changed, 15 insertions(+), 9 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >index 0721c22dc2..fa52af269b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >@@ -1057,10 +1057,14 @@ > <div id="toolbar" class="btn-toolbar"> > [% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers || batch_borrowernumbers ) %] > <div class="btn-group"> >- <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true"> >- Batch operations with [% IF unlimited_total >= limit %][% results.size | html %][% ELSE %][% unlimited_total | html %][% END %] visible records >- <span class="caret"></span> >- </button> >+ [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel || CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || CAN_user_tools_edit_patrons ) %] >+ <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true"> >+ [% ELSE %] >+ <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true" disabled> >+ [% END %] >+ Batch operations with [% IF unlimited_total >= limit %][% results.size | html %][% ELSE %][% unlimited_total | html %][% END %] visible records >+ <span class="caret"></span> >+ </button> > <ul class="dropdown-menu" aria-labelledby="batch_mod_menu"> > [% FOREACH header_ro IN header_row %] > [% IF header_ro.cell == 'cardnumber' || header_types.item( header_ro.cell ) == 'cardnumber' || header_ro.cell == 'borrowernumber' || header_types.item( header_ro.cell ) == 'borrowernumber' %] >@@ -1074,12 +1078,12 @@ > [% END %] > [% IF show_cardnumber_ops || show_borrowernumber_ops %] > <li class="dropdown-header">Patron records</li> >- [% IF show_cardnumber_ops || show_borrowernumber_ops %] >+ [% IF ( show_cardnumber_ops || show_borrowernumber_ops ) && CAN_user_tools_edit_patrons %] > <li> > <a href="#" data-submit="batch_patron_modification" data-toggle="tooltip" data-placement="right" title="Send visible results to batch patron modification" class="batch_op send_to_patron_mod">Batch patron modification</a> > </li> > [% END %] >- [% IF show_borrowernumber_ops %] >+ [% IF show_borrowernumber_ops && CAN_user_tools_edit_patrons %] > <li> > <a href="#" data-submit="patron_card_creator" data-toggle="tooltip" data-placement="right" title="Send visible results to a new patron card batch" class="batch_op send_to_patron_card_batch">Patron card creator</a> > </li> >@@ -1102,7 +1106,7 @@ > [% END %] > [% IF header_ro.has_itemnumbers && ( header_ro.cell == 'itemnumber' || header_types.item( header_ro.cell ) == 'itemnumber' ) %] > [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel ) %] >- <li class="dropdown-header">Item records</li> >+ <li class="dropdown-header">Item records</li> > <li> > <a href="#" data-submit="batch_item_modification" data-toggle="tooltip" data-placement="right" title="Send visible items to batch item modification" class="batch_op send_to_item_mod">Batch item modification</a> > </li> >@@ -1218,8 +1222,10 @@ > <ul class="dropdown-menu pull-right" role="menu"> > <li><a target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye"></i> View patron</a></li> > <li role="separator" class="divider"></li> >- <li><a target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li> >- <li role="separator" class="divider"></li> >+ [% IF CAN_user_borrowers_edit_borrowers %] >+ <li><a target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li> >+ <li role="separator" class="divider"></li> >+ [% END # /IF CAN_user_borrowers_edit_borrowers %] > <li><a target="_blank" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa fa-barcode"></i> Check out</a></li> > </ul> > </div> >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35905
:
169260
|
169263
|
170440
|
170634
|
170635
|
170636
|
171105
|
171492