Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission
Summary: Able to view menu for Purchase Suggestions even when user does not have permi...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Thomas Wright
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-14 23:23 UTC by Thomas Wright
Modified: 2016-06-21 21:36 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission (1.97 KB, patch)
2015-01-14 23:29 UTC, Thomas Wright
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission (1.93 KB, patch)
2015-01-15 06:35 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission (2.23 KB, patch)
2015-01-15 11:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13584: (follow-up) Able to view menu for Purchase Suggestions even when user does not have permission (1.48 KB, patch)
2015-01-15 11:08 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Wright 2015-01-14 23:23:37 UTC
Same problem as Bug 10943. The page requires borrowers to access but the menu item is still shown to users who do not have the borrowers permission.

From purchase-suggestions.pl we can see there is no check for which permissions are required to visit the linked page.

Yet in the include the only thing checked is:
    [% IF ( suggestionsview ) %]

So a user who doesn't have permission to access Purchase suggestions can still see the menu item.
Comment 1 Thomas Wright 2015-01-14 23:25:56 UTC
I'm working on this.
Comment 2 Thomas Wright 2015-01-14 23:29:54 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2015-01-15 06:35:00 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-01-15 06:38:01 UTC
Currently there is a second file for building the navigation that could be changed too, but this patch is correct and an improvement.

/ koha-tmpl / intranet-tmpl / prog / en / includes / circ-menu.tt

There is a bug report to remove the file in favor of the .inc, as both have some differences right now.
Comment 5 Jonathan Druart 2015-01-15 11:08:12 UTC
Created attachment 35298 [details] [review]
Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission

Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken

Testing Plan:

-Search for a patron with an account that does not have the 'borrowers' permission
*Purchase suggestions item should not be seen in the menu.

-Change the accounts permissions so they have the 'borrowers' permission
*Purchase suggestions item should be present in the menu.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The page requires borrowers permission, so the link should act accordingly.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Same problem for Fines, Circulation history, Notices and Statistics
tabs.
circ-menu.tt is only used from the Fines tab (which is not accessible),
to it's not useful to add this check to it. But for the consistency, it
makes sense. follow-up coming.
Comment 6 Jonathan Druart 2015-01-15 11:08:27 UTC
Created attachment 35299 [details] [review]
Bug 13584: (follow-up) Able to view menu for Purchase Suggestions even when user does not have permission

Same changes as the previous patch, for the .tt file.
Comment 7 Tomás Cohen Arazi 2015-01-21 14:12:04 UTC
Patch pushed to master.

Thanks Thomas!