From 4caa14a962295223e5e7c0bce9b0d0ae23cc96f2 Mon Sep 17 00:00:00 2001 From: Brendan Lawlor Date: Thu, 5 Sep 2024 18:47:33 +0000 Subject: [PATCH] Bug 35905: Add permission checks to report results There are some links on the report results page that the user may not have access to This patch adds permission checks to the report results page to: 1. Disable the batch operations button or remove its dropdown items 2. Remove automatic links from the itemnumber, biblionumber, borrowernumber, and cardnumber columns 3. Remove the 'Hide/Show data menus' button When the user doen't have permission to those actions To test: 1. Create the following two reports a) select borrowernumber, cardnumber from borrowers limit 100 b) select itemnumber, biblionumber from items limit 100 2. Create a user with only catalogue and reports permissions 3. Run each report as the user with minimal permissions 3. Verify the batch operations button is disabled 4. Verify there is no link to edit, view or checkout patron in borrowernumber columns 5. Verify there is no link to edit record in itemnumber and biblionumber columns 6. Add the following permissions one at a time and re run the reports tools_items_batchmod tools_items_batchdel tools_records_batchmod tools_records_batchdel tools_edit_patrons editcatalogue_edit_catalogue editcatalogue_edit_items borrowers_edit_borrowers 7. Verify the batch operations button is enabled and displays the correct links 8. Verify the links in borrowernumber and cardnumber columns to view, edit and checkout patron are displayed correctly 9. Verify the links in itemnumber and biblionumber columns to edit record are displayed correctly Signed-off-by: Olivier V --- .../modules/reports/guided_reports_start.tt | 92 ++++++++++++------- 1 file changed, 61 insertions(+), 31 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt index ed1e0cf7de..90a540be1a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt @@ -1061,7 +1061,11 @@
[% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers || batch_borrowernumbers ) %]
- @@ -1077,13 +1081,13 @@ [% END %] [% END %] [% IF show_cardnumber_ops || show_borrowernumber_ops %] -
  • Patron records
    • - [% IF show_cardnumber_ops || show_borrowernumber_ops %] + [% IF ( show_cardnumber_ops || show_borrowernumber_ops) && CAN_user_tools_edit_patrons %] +
  • Patron records
  • Batch patron modification
    • [% END %] - [% IF show_borrowernumber_ops %] + [% IF show_borrowernumber_ops && CAN_user_tools_edit_patrons %]
  • Patron card creator
    • @@ -1091,25 +1095,37 @@ [% END %] [% FOREACH header_ro IN header_row %] [% IF header_ro.has_biblionumbers && ( header_ro.cell == 'biblionumber' || header_types.item( header_ro.cell ) == 'biblionumber' ) %] -
  • Bibliographic records
    • -
  • - Batch record modification -
    • -
  • - Batch record deletion -
    • + [% IF ( CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel ) %] +
  • Bibliographic records
    • + [% IF CAN_user_tools_records_batchmod %] +
  • + Batch record modification +
    • + [% END %] + [% IF CAN_user_tools_records_batchdel %] +
  • + Batch record deletion +
    • + [% END %] + [% END # /IF CAN_user_tools_records_batchmod || CAN_user_tools_records_batchdel %]
  • Add to list
    • [% END %] [% IF header_ro.has_itemnumbers && ( header_ro.cell == 'itemnumber' || header_types.item( header_ro.cell ) == 'itemnumber' ) %] -
  • Item records
    • -
  • - Batch item modification -
    • -
  • - Batch item deletion -
    • + [% IF ( CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel ) %] +
  • Item records
    • + [% IF CAN_user_tools_items_batchmod %] +
  • + Batch item modification +
    • + [% END %] + [% IF CAN_user_tools_items_batchdel %] +
  • + Batch item deletion +
    • + [% END %] + [% END # /IF CAN_user_tools_items_batchmod || CAN_user_tools_items_batchdel %] [% END %] [% END # /FOREACH header_ro %] @@ -1143,7 +1159,7 @@
    [% END # /IF ( unlimited_total > 10 && limit <= 1000 ) %] - [% IF ( batch_biblionumbers || batch_itemnumbers || batch_cardnumbers ) %] + [% IF ( batch_biblionumbers || batch_itemnumbers ) ||( batch_cardnumbers || batch_borrowernumbers && (CAN_user_borrowers_list_borrowers || CAN_user_borrowers_edit_borrowers || CAN_user_circulate_circulate_remaining_permissions ) ) %] @@ -1190,7 +1206,9 @@ [% cells.cell | $raw %] @@ -1200,28 +1218,40 @@ [% cells.cell | $raw %] [% ELSIF header_row.$place.cell == 'borrowernumber' || header_types.item(header_row.$place.cell) == 'borrowernumber' %] - [% cells.cell | $raw %] - + [% IF CAN_user_borrowers_list_borrowers || CAN_user_borrowers_edit_borrowers || CAN_user_circulate_circulate_remaining_permissions %] + [% cells.cell | $raw %] + + [% ELSE %] + [% cells.cell | $raw %] + [% END %] - [% ELSIF header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %] + [% ELSIF CAN_user_circulate_circulate_remaining_permissions && header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %] [% cells.cell | $raw %] -- 2.34.1