From 538c09f8e6b6d1673a747ba33ae08301a5cd4ce4 Mon Sep 17 00:00:00 2001
From: Brendan Lawlor <blawlor@clamsnet.org>
Date: Thu, 22 Aug 2024 21:17:51 +0000
Subject: [PATCH] Bug 35905: (follow-up) Add permission checks to report
 reuslts

To test:
1. Create the following two reports
    a) select borrowernumber, cardnumber from borrowers limit 100
    b) select itemnumber, biblionumber from items limit 100
2. Create a user with only catalogue and reports permissions
3. Run each report as the user with minimal permissions
3. Verify the batch operations button is disabled
4. Verify there is no link to edit patron in borrowernumber columns
5. Verify there is no link to edit record in itemnumber and biblionumber columns
6. Add the following permissions one at a time and re run the reports
    tools_items_batchmod
    tools_items_batchdel
    editcatalogue_edit_catalogue
    editcatalogue_edit_items
    tools_edit_patrons
    borrowers_edit_borrowers
7. Verify the batch operations button is enabled and displays the correct links
8. Verify the links to edit patron and edit record are displayed correctly
---
 .../modules/reports/guided_reports_start.tt   | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 0721c22dc2..fa52af269b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -1057,10 +1057,14 @@
                                     <div id="toolbar" class="btn-toolbar">
                                         [% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers || batch_borrowernumbers ) %]
                                             <div class="btn-group">
-                                                <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true">
-                                                    Batch operations with [% IF unlimited_total >= limit %][% results.size | html %][% ELSE %][% unlimited_total | html %][% END %] visible records
-                                                    <span class="caret"></span>
-                                                </button>
+                                                [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel || CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items || CAN_user_tools_edit_patrons ) %]
+                                                    <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true">
+                                                [% ELSE %]
+                                                    <button class="btn btn-default btn-sm dropdown-toggle" type="button" id="batch_mod_menu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true" disabled>
+                                                [% END %]
+                                                        Batch operations with [% IF unlimited_total >= limit %][% results.size | html %][% ELSE %][% unlimited_total | html %][% END %] visible records
+                                                        <span class="caret"></span>
+                                                    </button>
                                                 <ul class="dropdown-menu" aria-labelledby="batch_mod_menu">
                                                     [% FOREACH header_ro IN header_row %]
                                                         [% IF header_ro.cell == 'cardnumber' || header_types.item( header_ro.cell ) == 'cardnumber' || header_ro.cell == 'borrowernumber' || header_types.item( header_ro.cell ) == 'borrowernumber' %]
@@ -1074,12 +1078,12 @@
                                                     [% END %]
                                                     [% IF show_cardnumber_ops || show_borrowernumber_ops %]
                                                         <li class="dropdown-header">Patron records</li>
-                                                        [% IF show_cardnumber_ops || show_borrowernumber_ops %]
+                                                        [% IF ( show_cardnumber_ops || show_borrowernumber_ops ) && CAN_user_tools_edit_patrons %]
                                                             <li>
                                                                 <a href="#" data-submit="batch_patron_modification" data-toggle="tooltip" data-placement="right" title="Send visible results to batch patron modification" class="batch_op send_to_patron_mod">Batch patron modification</a>
                                                             </li>
                                                         [% END %]
-                                                        [% IF show_borrowernumber_ops %]
+                                                        [% IF show_borrowernumber_ops && CAN_user_tools_edit_patrons %]
                                                             <li>
                                                                 <a href="#" data-submit="patron_card_creator" data-toggle="tooltip" data-placement="right" title="Send visible results to a new patron card batch" class="batch_op send_to_patron_card_batch">Patron card creator</a>
                                                             </li>
@@ -1102,7 +1106,7 @@
                                                         [% END %]
                                                         [% IF header_ro.has_itemnumbers && ( header_ro.cell == 'itemnumber' || header_types.item( header_ro.cell ) == 'itemnumber' ) %]
                                                                 [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel ) %]
-                                                                    <li class="dropdown-header">Item records</li>  
+                                                                    <li class="dropdown-header">Item records</li>
                                                                     <li>
                                                                         <a href="#" data-submit="batch_item_modification" data-toggle="tooltip" data-placement="right" title="Send visible items to batch item modification" class="batch_op send_to_item_mod">Batch item modification</a>
                                                                     </li>
@@ -1218,8 +1222,10 @@
                                                             <ul class="dropdown-menu pull-right" role="menu">
                                                                 <li><a target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-eye"></i> View patron</a></li>
                                                                 <li role="separator" class="divider"></li>
-                                                                <li><a target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&amp;borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li>
-                                                                <li role="separator" class="divider"></li>
+                                                                [% IF CAN_user_borrowers_edit_borrowers %]
+                                                                    <li><a target="_blank" href="/cgi-bin/koha/members/memberentry.pl?op=edit_form&amp;borrowernumber=[% cells.cell | $raw %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit patron</a></li>
+                                                                    <li role="separator" class="divider"></li>
+                                                                [% END # /IF CAN_user_borrowers_edit_borrowers %]
                                                                 <li><a target="_blank" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% cells.cell | $raw %]"><i class="fa fa-barcode"></i> Check out</a></li>
                                                             </ul>
                                                         </div>
-- 
2.39.2