Bug 13583 - Able to view menu for Statistics even when user does not have permission
Summary: Able to view menu for Statistics even when user does not have permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-14 22:58 UTC by Thomas Wright
Modified: 2016-06-21 21:37 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13583 - Able to view menu for Statistics even when user does not have permission Added check for borrowers that stops the Statistics link being shown. This could be done through the css but that function currently appears to be broke (2.06 KB, patch)
2015-01-14 23:09 UTC, Thomas Wright
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13583 - Able to view menu for Statistics even when user does not have permission Added check for borrowers that stops the Statistics link being shown. This could be done through the css but that function currently appears to be broke (2.13 KB, patch)
2015-01-18 22:06 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 13583 - Able to view menu for Statistics even when user does not have permission (2.11 KB, patch)
2015-01-19 13:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13583: (follow-up) Able to view menu for Statistics even when user does not have permission (1.47 KB, patch)
2015-01-19 13:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13583: (follow-up) Able to view menu for Statistics even when user does not have permission (1.63 KB, patch)
2015-01-19 13:10 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Wright 2015-01-14 22:58:42 UTC
Same problem as Bug 10943. The page requires borrowers to access but the menu item is still shown to users who do not have the borrowers permission.

From statistics.pl we see:
    flagsrequired => {borrowers => 1},

No permissions are currently checked.

So a user who doesn't have permission to access Statistics can still see the menu item.
Comment 1 Thomas Wright 2015-01-14 22:58:52 UTC
Working on this.
Comment 2 Thomas Wright 2015-01-14 23:09:09 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2015-01-18 22:05:45 UTC
There is also 
 koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.tt
but there are many more differences to resolve between both files, so I think this should not be a blocker here.
Comment 4 Katrin Fischer 2015-01-18 22:06:35 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-01-19 13:08:09 UTC
Created attachment 35379 [details] [review]
Bug 13583 - Able to view menu for Statistics even when user does not have permission

Added check for borrowers that stops the Statistics link being shown. This could be done through the css but that function currently appears to be broke

Testing Plan:

-Search for a patron with an account that does not have the 'borrowers' permission
*Statistics should not be seen in the menu.

-Change the accounts permissions so they have the 'borrowers' permission
*Statistics should be present in the menu.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described.
Comment 6 Jonathan Druart 2015-01-19 13:08:17 UTC Comment hidden (obsolete)
Comment 7 Jonathan Druart 2015-01-19 13:10:52 UTC
Created attachment 35381 [details] [review]
Bug 13583: (follow-up) Able to view menu for Statistics even when user does not have permission

Same changes as the previous patch, for the .tt file.
Comment 8 Tomás Cohen Arazi 2015-01-22 19:43:59 UTC
Patches pushed to master.

Thanks Thomas!