Bug 18756

Summary: Users can view aq.baskets even if they are not allowed
Product: Koha Reporter: Christophe Croullebois <christophe.croullebois>
Component: AcquisitionsAssignee: Christophe Croullebois <christophe.croullebois>
Status: Passed QA --- QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: baptiste.wojtkowski, fridolin.somers, jonathan.druart
Version: master   
Hardware: All   
OS: All   
Whiteboard:
Change sponsored?: --- Patch complexity: Trivial patch
Bot Control: --- When did the bot last check this:
Who signed the patch off: Text to go in the release notes:
Attachments: Bug 18756: Users can view aq.baskets even if they are not allowed
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed
Bug 18756 - add Unit Test
Bug 18756 - add Unit Test
Bug 18756: Users can view aq.baskets even if they are not allowed
Bug 18756 - add Unit Test

Description Christophe Croullebois 2017-06-08 12:49:29 UTC
Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
Comment 1 Christophe Croullebois 2017-06-08 14:11:18 UTC
Created attachment 64103 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket
Comment 2 Josef Moravec 2017-06-11 08:03:29 UTC
Created attachment 64179 [details] [review]
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Jonathan Druart 2017-06-13 15:35:55 UTC
Christophe, please provide tests for this change.
Comment 4 Fridolin SOMERS 2017-06-14 10:39:07 UTC
Created attachment 64280 [details] [review]
Bug 18756 - add Unit Test
Comment 5 Lee Jamison 2017-06-16 16:14:44 UTC
Created attachment 64403 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Comment 6 Nick Clemens 2017-06-23 11:03:59 UTC
Created attachment 64588 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Nick Clemens 2017-06-23 11:04:03 UTC
Created attachment 64589 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>