Bug 18756

Summary: Users can view aq.baskets even if they are not allowed
Product: Koha Reporter: Christophe Croullebois <christophe.croullebois>
Component: AcquisitionsAssignee: Christophe Croullebois <christophe.croullebois>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: baptiste.wojtkowski, fridolin.somers, jonathan.druart, katrin.fischer, mtj
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 7295    
Bug Blocks:    
Attachments: Bug 18756: Users can view aq.baskets even if they are not allowed
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed
Bug 18756 - add Unit Test
Bug 18756 - add Unit Test
Bug 18756: Users can view aq.baskets even if they are not allowed
Bug 18756 - add Unit Test

Description Christophe Croullebois 2017-06-08 12:49:29 UTC
Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
Comment 1 Christophe Croullebois 2017-06-08 14:11:18 UTC
Created attachment 64103 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket
Comment 2 Josef Moravec 2017-06-11 08:03:29 UTC
Created attachment 64179 [details] [review]
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Jonathan Druart 2017-06-13 15:35:55 UTC
Christophe, please provide tests for this change.
Comment 4 Fridolin Somers 2017-06-14 10:39:07 UTC
Created attachment 64280 [details] [review]
Bug 18756 - add Unit Test
Comment 5 Lee Jamison 2017-06-16 16:14:44 UTC
Created attachment 64403 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Comment 6 Nick Clemens 2017-06-23 11:03:59 UTC
Created attachment 64588 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Nick Clemens 2017-06-23 11:04:03 UTC
Created attachment 64589 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Jonathan Druart 2017-07-06 18:51:05 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 9 Fridolin Somers 2017-07-10 10:39:31 UTC
Pushed to 17.05.x, will be in 17.05.02
Comment 10 Katrin Fischer 2017-07-15 18:04:34 UTC
These patches have been pushed to 16.11.x and will be in 16.11.10.
Comment 11 Mason James 2017-07-31 11:33:47 UTC
Pushed to 16.05.x, for 16.05.15 release