Attachment 171105 Details for Bug 35905 – Bug 35905: Add permission checks to report results

[patch] Bug 35905: Add permission checks to report results

Bug-35905-Add-permission-checks-to-report-results.patch (text/plain), 21.99 KB, created by Brendan Lawlor on 2024-09-05 20:44:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Brendan Lawlor

Created: 2024-09-05 20:44:24 UTC

Size: 21.99 KB

patch

obsolete

>From 26a19129d32b8f9a7cc237ccdf201603a3bf30a4 Mon Sep 17 00:00:00 2001
>From: Brendan Lawlor <blawlor@clamsnet.org>
>Date: Thu, 5 Sep 2024 18:47:33 +0000
>Subject: [PATCH] Bug 35905: Add permission checks to report results
>
>There are some links on the report results page that the user may not have access to
>
>This patch adds permission checks to the report results page to:
>1. Disable the batch operations button or remove its dropdown items
>2. Remove automatic links from the
>    itemnumber, biblionumber, borrowernumber, and cardnumber columns
>3. Remove the 'Hide/Show data menus' button
>When the user doen't have permission to those actions
>
>To test:
>1. Create the following two reports
>    a) select borrowernumber, cardnumber from borrowers limit 100
>    b) select itemnumber, biblionumber from items limit 100
>2. Create a user with only catalogue and reports permissions
>3. Run each report as the user with minimal permissions
>3. Verify the batch operations button is disabled
>4. Verify there is no link to edit, view or checkout patron in borrowernumber columns
>5. Verify there is no link to edit record in itemnumber and biblionumber columns
>6. Add the following permissions one at a time and re run the reports
>    tools_items_batchmod
>    tools_items_batchdel
>    tools_records_batchmod
>    tools_records_batchdel
>    tools_edit_patrons
>    editcatalogue_edit_catalogue
>    editcatalogue_edit_items
>    borrowers_edit_borrowers
>7. Verify the batch operations button is enabled and displays the correct links
>8. Verify the links in borrowernumber and cardnumber columns
>    to view, edit and checkout patron are displayed correctly
>9. Verify the links in itemnumber and biblionumber columns
>    to edit record are displayed correctly
>---
> .../modules/reports/guided_reports_start.tt   | 92 ++++++++++++-------
> 1 file changed, 61 insertions(+), 31 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>index ed1e0cf7de..90a540be1a 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>@@ -1061,7 +1061,11 @@
>                                     <div id="toolbar" class="btn-toolbar">
>                                         [% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers || batch_borrowernumbers ) %]
>                                             <div class="btn-group">
>-                                                <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="true">
>+                                                [% IF (( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel || CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel ) && ( batch_itemnumbers || batch_biblionumbers )) || ( CAN_user_tools_edit_patrons && batch_borrowernumbers || batch_cardnumbers ) %]
>+                                                    <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="true">
>+                                                [% ELSE %]
>+                                                    <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="true" disabled>
>+                                                [% END %]
>                                                     Batch operations with [% IF unlimited_total >= limit %][% results.size | html %][% ELSE %][% unlimited_total | html %][% END %] visible records
>                                                     <span class="caret"></span>
>                                                 </button>
>@@ -1077,13 +1081,13 @@
>                                                         [% END %]
>                                                     [% END %]
>                                                     [% IF show_cardnumber_ops || show_borrowernumber_ops %]
>-                                                        <li><h6 class="dropdown-header">Patron records</h6></li>
>-                                                        [% IF show_cardnumber_ops || show_borrowernumber_ops %]
>+                                                        [% IF ( show_cardnumber_ops || show_borrowernumber_ops) && CAN_user_tools_edit_patrons %]
>+                                                            <li><h6 class="dropdown-header">Patron records</h6></li>
>                                                             <li>
>                                                                 <a href="#" data-submit="batch_patron_modification" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible results to batch patron modification" class="dropdown-item batch_op send_to_patron_mod">Batch patron modification</a>
>                                                             </li>
>                                                         [% END %]
>-                                                        [% IF show_borrowernumber_ops %]
>+                                                        [% IF show_borrowernumber_ops && CAN_user_tools_edit_patrons %]
>                                                             <li>
>                                                                 <a href="#" data-submit="patron_card_creator" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible results to a new patron card batch" class="dropdown-item batch_op send_to_patron_card_batch">Patron card creator</a>
>                                                             </li>
>@@ -1091,25 +1095,37 @@
>                                                     [% END %]
>                                                     [% FOREACH header_ro IN header_row %]
>                                                         [% IF header_ro.has_biblionumbers && ( header_ro.cell == 'biblionumber' || header_types.item( header_ro.cell ) == 'biblionumber' ) %]
>-                                                            <li><h6 class="dropdown-header">Bibliographic records</h6></li>
>-                                                            <li>
>-                                                                <a href="#" data-submit="batch_record_modification" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible records to batch record modification" class="dropdown-item batch_op send_to_record_mod">Batch record modification</a>
>-                                                            </li>
>-                                                            <li>
>-                                                                <a href="#" data-submit="batch_record_deletion" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible records to batch record deletion" class="dropdown-item batch_op send_to_record_del">Batch record deletion</a>
>-                                                            </li>
>+                                                            [% IF ( CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel ) %]
>+                                                                <li><h6 class="dropdown-header">Bibliographic records</h6></li>
>+                                                                [% IF CAN_user_tools_records_batchmod %]
>+                                                                    <li>
>+                                                                        <a href="#" data-submit="batch_record_modification" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible records to batch record modification" class="dropdown-item batch_op send_to_record_mod">Batch record modification</a>
>+                                                                    </li>
>+                                                                [% END %]
>+                                                                [% IF CAN_user_tools_records_batchdel %]
>+                                                                    <li>
>+                                                                        <a href="#" data-submit="batch_record_deletion" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible records to batch record deletion" class="dropdown-item batch_op send_to_record_del">Batch record deletion</a>
>+                                                                    </li>
>+                                                                [% END %]
>+                                                            [% END # /IF CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel %]
>                                                             <li>
>                                                                 <a href="#" data-submit="batch_add_to_list" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible records to a list" class="dropdown-item batch_op send_to_list">Add to list</a>
>                                                             </li>
>                                                         [% END %]
>                                                         [% IF header_ro.has_itemnumbers && ( header_ro.cell == 'itemnumber' || header_types.item( header_ro.cell ) == 'itemnumber' ) %]
>-                                                            <li><h6 class="dropdown-header">Item records</h6></li>
>-                                                            <li>
>-                                                                <a href="#" data-submit="batch_item_modification" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible items to batch item modification" class="dropdown-item batch_op send_to_item_mod">Batch item modification</a>
>-                                                            </li>
>-                                                            <li>
>-                                                                <a href="#" data-submit="batch_item_deletion" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible items to batch item deletion" class="dropdown-item batch_op send_to_item_del">Batch item deletion</a>
>-                                                            </li>
>+                                                            [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel ) %]
>+                                                                <li><h6 class="dropdown-header">Item records</h6></li>
>+                                                                [% IF CAN_user_tools_items_batchmod %]
>+                                                                    <li>
>+                                                                        <a href="#" data-submit="batch_item_modification" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible items to batch item modification" class="dropdown-item batch_op send_to_item_mod">Batch item modification</a>
>+                                                                    </li>
>+                                                                [% END %]
>+                                                                [% IF CAN_user_tools_items_batchdel %]
>+                                                                    <li>
>+                                                                        <a href="#" data-submit="batch_item_deletion" data-bs-toggle="tooltip" data-bs-placement="right" title="Send visible items to batch item deletion" class="dropdown-item batch_op send_to_item_del">Batch item deletion</a>
>+                                                                    </li>
>+                                                                [% END %]
>+                                                            [% END # /IF CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel %]
>                                                         [% END %]
>                                                     [% END # /FOREACH header_ro %]
>                                                 </ul> 
>@@ -1143,7 +1159,7 @@
>                                             </div>
>                                         [% END # /IF ( unlimited_total > 10 && limit <= 1000 ) %]
> 
>-                                        [% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers ) %]
>+                                        [% IF ( batch_biblionumbers || batch_itemnumbers ) ||( batch_cardnumbers || batch_borrowernumbers && (CAN_user_borrowers_list_borrowers || CAN_user_borrowers_edit_borrowers || CAN_user_circulate_circulate_remaining_permissions ) ) %]
>                                             <a href="#" class="btn btn-link" id="toggle_auto_links">
>                                                 <i class="fa-solid fa-eye autolink" aria-hidden="true" style="display:none"></i>
>                                                 <i class="fa-solid fa-eye-slash autolink" aria-hidden="true"></i>
>@@ -1190,7 +1206,9 @@
>                                                         <span class="data-plain">[% cells.cell | $raw %]</span>
>                                                         <div id="itemnumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-bs-toggle="dropdown" href="#">[% cells.cell | $raw %] </a>
>                                                             <ul class="dropdown-menu pull-right" role="menu">
>-                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&itemnumber=[% cells.cell | $raw %]"><i class="fa-fw fa-solid fa-pencil" aria-hidden="true"></i> Edit item</a></li>
>+                                                                [% IF CAN_user_editcatalogue_edit_items %]
>+                                                                    <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&itemnumber=[% cells.cell | $raw %]"><i class="fa-fw fa-solid fa-pencil" aria-hidden="true"></i> Edit item</a></li>
>+                                                                [% END # /IF CAN_user_editcatalogue_edit_items %]
>                                                                 <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% cells.cell | $raw %]"><i class="fa fa-fw fa-eye" aria-hidden="true"></i> View item</a></li>
>                                                             </ul>
>                                                         </div>
>@@ -1200,28 +1218,40 @@
>                                                         <span class="data-plain">[% cells.cell | $raw %]</span>
>                                                         <div id="biblionumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-bs-toggle="dropdown" href="#">[% cells.cell | $raw %] </a>
>                                                             <ul class="dropdown-menu pull-right" role="menu">
>-                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit record</a></li>
>+                                                                [% IF CAN_user_editcatalogue_edit_catalogue %]
>+                                                                    <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit record</a></li>
>+                                                                [% END # /IF CAN_user_editcatalogue_edit_catalogue %]
>                                                                 <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye" aria-hidden="true"></i> View record</a></li>
>                                                             </ul>
>                                                         </div>
>                                                     </td>
>                                                 [% ELSIF header_row.$place.cell == 'borrowernumber' || header_types.item(header_row.$place.cell) == 'borrowernumber' %]
>                                                     <td class="batch-op borrowernumber" data-number="borrowernumber">
>-                                                        <span class="data-plain">[% cells.cell | $raw %]</span>
>-                                                        <div id="borrowernumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-bs-toggle="dropdown" href="#">[% cells.cell | $raw %] </a>
>-                                                            <ul class="dropdown-menu pull-right" role="menu">
>-                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye" aria-hidden="true"></i> View patron</a></li>
>-                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&amp;borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li>
>-                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa fa-barcode" aria-hidden="true"></i> Check out</a></li>
>-                                                            </ul>
>-                                                        </div>
>+                                                        [% IF  CAN_user_borrowers_list_borrowers || CAN_user_borrowers_edit_borrowers || CAN_user_circulate_circulate_remaining_permissions %]
>+                                                            <span class="data-plain">[% cells.cell | $raw %]</span>
>+                                                            <div id="borrowernumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-bs-toggle="dropdown" href="#">[% cells.cell | $raw %] </a>
>+                                                                <ul class="dropdown-menu pull-right" role="menu">
>+                                                                    [% IF CAN_user_borrowers_list_borrowers %]
>+                                                                        <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye" aria-hidden="true"></i> View patron</a></li>
>+                                                                    [% END %]
>+                                                                    [% IF CAN_user_borrowers_edit_borrowers %]
>+                                                                        <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&amp;borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li>
>+                                                                    [% END %]
>+                                                                    [% IF CAN_user_circulate_circulate_remaining_permissions %]
>+                                                                        <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa fa-barcode" aria-hidden="true"></i> Check out</a></li>
>+                                                                    [% END %]
>+                                                                </ul>
>+                                                            </div>
>+                                                        [% ELSE %]
>+                                                            [% cells.cell | $raw %]
>+                                                        [% END %]
>                                                     </td>
>-                                                [% ELSIF header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %]
>+                                                [% ELSIF CAN_user_circulate_circulate_remaining_permissions && header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %]
>                                                     <td class="batch-op cardnumber" data-number="cardnumber">
>                                                         <span class="data-plain">[% cells.cell | $raw %]</span>
>                                                         <div id="cardnumber_autolink" class="btn-group dropup autolink"><a class="btn btn-link dropdown-toggle" role="button" data-bs-toggle="dropdown" href="#">[% cells.cell | $raw %] </a>
>                                                             <ul class="dropdown-menu pull-right" role="menu">
>-                                                                <li><a target="_blank" href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% cells.cell | $raw %]"><i class="fa fa-barcode" aria-hidden="true"></i> Check out</a></li>
>+                                                                <li><a class="dropdown-item" target="_blank" href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% cells.cell | $raw %]"><i class="fa fa-barcode" aria-hidden="true"></i> Check out</a></li>
>                                                             </ul>
>                                                         </div>
>                                                     </td>
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 35905: 169260 | 169263 | 170440 | 170634 | 170635 | 170636 | 171105 | 171492