Bug 37737

Summary:	Users with 'execute_reports' permission can create reports 23.11 and lower
Product:	Koha	Reporter:	Nick Clemens (kidclamp) <nick>
Component:	Reports	Assignee:	Lisette Scheer <lisette>
Status:	RESOLVED FIXED	QA Contact:	Testopia <testopia>
Severity:	major
Priority:	P5 - low	CC:	blawlor, dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, wainuiwitikapark
Version:	Main	Keywords:	rel_23_11_candidate
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37683
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	23.11.10,23.05.16,22.11.22
Circulation function:
Attachments:	Bug 37737: [23.11] Fixed report permissions to prevent not allowed duplication Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Description Nick Clemens (kidclamp) 2024-08-26 18:06:09 UTC

When a user clicks 'Preview SQL' on a report, they have a 'Duplicate' button

This sends a URL with phase:
phase=Create%20report%20from%20existing

The permissions check looks for:
'Build new from existing'
when the phase isn't found we only require:
reports: '*' (any report permission)

The Duplicate button leads to a form where the phase is "Save Report" which, again, is not in the permissions checks at the start and so defaults to reports:*

Fix by bug 34478 in 24.05+

Comment 1 David Cook 2024-08-27 00:02:37 UTC

Yeah the reports permissions are a bit of a mess :(

Comment 2 Lisette Scheer 2024-08-29 22:50:20 UTC

Created attachment 170891 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent not allowed duplication

Made the run report permission explicit

Comment 3 Fridolin Somers 2024-09-09 15:21:22 UTC

 else {
-    $flagsrequired = '*';
 }

Is this on purpose ?
Empty else o_O

Comment 4 Lisette Scheer 2024-09-09 15:44:21 UTC

(In reply to Fridolin Somers from comment #3)
>  else {
> -    $flagsrequired = '*';
>  }
> 
> Is this on purpose ?
> Empty else o_O

No, no it was not. I'll fix it and do a new patch.

Comment 5 Lisette Scheer 2024-09-09 20:16:41 UTC

Created attachment 171232 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.

Comment 6 Brendan Lawlor 2024-09-12 16:25:30 UTC

Created attachment 171418 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Comment 7 Nick Clemens (kidclamp) 2024-09-17 12:38:54 UTC

Created attachment 171619 [details] [review]
Bug 37737: [23.11] Fixed report permissions to prevent disallowed duplication

Test plan:
1. Checkout 23.11
2. Create a report
3. Create a user with staff login and run reports permissions
4. Log in as your new user
5. Preview the SQL of the report
6. In the preview modal, select Duplicate report
7. Apply patch
8. Repeat steps 4-6.
9. You should be prompted to login.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Comment 8 Fridolin Somers 2024-10-21 11:51:08 UTC

Sorry i missed this one for 23.11.09, will be in 23.11.10

Comment 9 Wainui Witika-Park 2024-10-23 23:02:24 UTC

Applied to 23.05.x-security for 23.05.16

Comment 10 Phil Ringnalda 2024-11-14 21:48:22 UTC

Verified that the Version(s) released in: 22.11.22 was true.