From bc7244cd6d49e236ce7f992196c9d0d4a617109a Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 20 Nov 2020 08:59:06 +0100 Subject: [PATCH] Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. --- svc/mana/search | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/svc/mana/search b/svc/mana/search index 84b356c738..03d804d9d2 100755 --- a/svc/mana/search +++ b/svc/mana/search @@ -29,30 +29,31 @@ use CGI; my $input = CGI->new; +my $templatename; +my $resource = $input->param('resource'); +my $flagsrequired; +if ( $resource eq 'report' ) { + $templatename = "mana/mana-report-search-result.tt"; + $flagsrequired = { reports => 'create_reports' }; +} +else { + $templatename = "mana/mana-subscription-search-result.tt"; + $flagsrequired = { serials => 'create_subscription' }; +} + my ( $auth_status, $sessionID ) = - check_cookie_auth( $input->cookie('CGISESSID'), - { serials => 'create_subscription' } ); + check_cookie_auth( $input->cookie('CGISESSID'), $flagsrequired ); if ( $auth_status ne "ok" ) { exit 0; } -my $templatename; -if ($input->param( "resource" ) eq 'report') { - $templatename = "mana/mana-report-search-result.tt"; -} else { - $templatename = "mana/mana-subscription-search-result.tt"; -} - my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { template_name => $templatename, query => $input, type => "intranet", - - # flagsrequired => { serials => $permission }, - flagsrequired => { serials => 'create_subscription' }, - debug => 1, + flagsrequired => $flagsrequired, } ); -- 2.20.1