Bug 18756 - Users can view aq.baskets even if they are not allowed
Summary: Users can view aq.baskets even if they are not allowed
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Christophe Croullebois
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on: 7295
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-08 12:49 UTC by Christophe Croullebois
Modified: 2017-07-31 11:33 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18756: Users can view aq.baskets even if they are not allowed (1.43 KB, patch)
2017-06-08 14:11 UTC, Christophe Croullebois
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed (1.50 KB, patch)
2017-06-11 08:03 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 18756 - add Unit Test (1.18 KB, patch)
2017-06-14 10:39 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
Bug 18756 - add Unit Test (1.23 KB, patch)
2017-06-16 16:14 UTC, Lee Jamison
Details | Diff | Splinter Review
Bug 18756: Users can view aq.baskets even if they are not allowed (1.54 KB, patch)
2017-06-23 11:03 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 18756 - add Unit Test (1.29 KB, patch)
2017-06-23 11:04 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Christophe Croullebois 2017-06-08 12:49:29 UTC
Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
Comment 1 Christophe Croullebois 2017-06-08 14:11:18 UTC
Created attachment 64103 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket
Comment 2 Josef Moravec 2017-06-11 08:03:29 UTC
Created attachment 64179 [details] [review]
[SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Jonathan Druart 2017-06-13 15:35:55 UTC
Christophe, please provide tests for this change.
Comment 4 Fridolin SOMERS 2017-06-14 10:39:07 UTC
Created attachment 64280 [details] [review]
Bug 18756 - add Unit Test
Comment 5 Lee Jamison 2017-06-16 16:14:44 UTC
Created attachment 64403 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Comment 6 Nick Clemens 2017-06-23 11:03:59 UTC
Created attachment 64588 [details] [review]
Bug 18756: Users can view aq.baskets even if they are not allowed

Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.

Test plan :
1- select system preference 'AcqViewBaskets' on 'user'
2- create 2 borrowers (A, B) with only permissions on acquisition :
group_manage
order_manage
order_receive
staff
3- login with A and create a basket
4- add a basquet manager other than B
5- relog with account B
6- you can see the basket

Apply the patch.
The basket is no longer visible.
1- relog with A
2- add basquet manager B
3- relog with B
5- you must see the basket

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Nick Clemens 2017-06-23 11:04:03 UTC
Created attachment 64589 [details] [review]
Bug 18756 - add Unit Test

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Jonathan Druart 2017-07-06 18:51:05 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 9 Fridolin SOMERS 2017-07-10 10:39:31 UTC
Pushed to 17.05.x, will be in 17.05.02
Comment 10 Katrin Fischer 2017-07-15 18:04:34 UTC
These patches have been pushed to 16.11.x and will be in 16.11.10.
Comment 11 Mason James 2017-07-31 11:33:47 UTC
Pushed to 16.05.x, for 16.05.15 release