| Summary: | Users can view aq.baskets even if they are not allowed | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Christophe Croullebois <christophe.croullebois> |
| Component: | Acquisitions | Assignee: | Christophe Croullebois <christophe.croullebois> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | baptiste.wojtkowski, fridolin.somers, jonathan.druart, mtj |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 7295 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 18756: Users can view aq.baskets even if they are not allowed
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed Bug 18756 - add Unit Test Bug 18756 - add Unit Test Bug 18756: Users can view aq.baskets even if they are not allowed Bug 18756 - add Unit Test |
||
|
Description
Christophe Croullebois
2017-06-08 12:49:29 UTC
Created attachment 64103 [details] [review] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket Created attachment 64179 [details] [review] [SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Christophe, please provide tests for this change. Created attachment 64280 [details] [review] Bug 18756 - add Unit Test Created attachment 64403 [details] [review] Bug 18756 - add Unit Test Signed-off-by: Lee Jamison <ldjamison@marywood.edu> Created attachment 64588 [details] [review] Bug 18756: Users can view aq.baskets even if they are not allowed Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed. Test plan : 1- select system preference 'AcqViewBaskets' on 'user' 2- create 2 borrowers (A, B) with only permissions on acquisition : group_manage order_manage order_receive staff 3- login with A and create a basket 4- add a basquet manager other than B 5- relog with account B 6- you can see the basket Apply the patch. The basket is no longer visible. 1- relog with A 2- add basquet manager B 3- relog with B 5- you must see the basket Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 64589 [details] [review] Bug 18756 - add Unit Test Signed-off-by: Lee Jamison <ldjamison@marywood.edu> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, will be in 17.05.02 These patches have been pushed to 16.11.x and will be in 16.11.10. Pushed to 16.05.x, for 16.05.15 release |