|
Description
Tomás Cohen Arazi (tcohen)
2023-07-14 20:11:19 UTC
Created attachment 153527 [details] [review] Bug 34288: Add CAN_user_tools to Cataloging home link This patch adds the CAN_user_tools permissions check to the options checked when infering whether to display the Catagloging module link on the staff interface main page. Marking as assigned, there are some edge cases I've already been working on. Writing the unit tests now. Created attachment 153560 [details] [review] Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D Created attachment 153561 [details] [review] Bug 34288: (follow-up) Tidy block Created attachment 153562 [details] [review] Bug 34288: Unit tests Created attachment 153565 [details] [review] Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 153566 [details] [review] Bug 34288: (follow-up) Tidy block Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 153567 [details] [review] Bug 34288: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Looking at the fastadd cataloging side of this is making me wonder if the page permissions are still wrong for that case.. we show the link from the home page with `( fast_cataloging && CAN_user_editcatalogue_fast_cataloging )` but then inside the page itself we're looking for 'editcatalogue' Ah.. my mistake.. I think `editcatalogue => '*'` covers it as a subpermission 'any' case Created attachment 153571 [details] [review] Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 153572 [details] [review] Bug 34288: (follow-up) Tidy block Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 153573 [details] [review] Bug 34288: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Thanks Tomas.. Passing QA Pushed to master for 23.11. Nice work everyone, thanks! Please backport this to 22.11. We can't live with this issue for a year. :) (In reply to Christopher Brannon from comment #16) > Please backport this to 22.11. We can't live with this issue for a year. :) :-P Thanks for all the hard work! Pushed to 23.05.x for the next release Nice work everyone! Pushed to oldstable for 22.11.x (In reply to Matt Blenkinsop from comment #19) > Nice work everyone! > > Pushed to oldstable for 22.11.x Nice! Hmmmm....I can still get to the spine label tools without having permission to them. Is something still broken? I'm on 22.11.8 (In reply to Christopher Brannon from comment #21) > Hmmmm....I can still get to the spine label tools without having permission > to them. Is something still broken? I'm on 22.11.8 FYI, if I just have a link to the spine label page, I get in and can use it. (In reply to Christopher Brannon from comment #22) > (In reply to Christopher Brannon from comment #21) > > Hmmmm....I can still get to the spine label tools without having permission > > to them. Is something still broken? I'm on 22.11.8 > > FYI, if I just have a link to the spine label page, I get in and can use it. Filed bug 34288 (In reply to Nick Clemens from comment #23) > (In reply to Christopher Brannon from comment #22) > > (In reply to Christopher Brannon from comment #21) > > > Hmmmm....I can still get to the spine label tools without having permission > > > to them. Is something still broken? I'm on 22.11.8 > > > > FYI, if I just have a link to the spine label page, I get in and can use it. > > Filed bug 34288 I mean bug 34790 |