When several records are selected from the result list in the staff interface, it unlocks a button with several batch options. The batch delete and batch edit tools have separate permissions independent from the edit_catalogue permission, so this should be updated to check for each of them separately for displaying the button and the separate entries. [% IF ( CAN_user_editcatalogue_edit_catalogue ) %] <div class="btn-group"> <a class="btn btn-default btn-xs" id="z3950submit" href="#"><i class="fa fa-search"></i> Z39.50/SRU search</a> </div> <div class="btn-group"> <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="fa fa-pencil"></i> Edit <span class="caret"></span> </button> <ul class="dropdown-menu"> <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li> <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li> <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li> </ul> </div> [% END %]
Created attachment 134965 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly.
Created attachment 134970 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 134995 [details] [review] Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Good catch Katrin, all works as expected and QA scripts are happy. PQA
Those links have been added by Bug 23349
Pushed to master for 22.05, thanks to everybody involved [U+1F984]