Bug 35905 - Missing permission check for "record batch delete" from reports
Summary: Missing permission check for "record batch delete" from reports
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Brendan Lawlor
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-25 10:25 UTC by Katrin Fischer
Modified: 2024-11-15 07:41 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 35905: Add permission checks to report results (5.63 KB, patch)
2024-07-19 20:59 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35905: Add permission checks to report results (5.68 KB, patch)
2024-07-20 09:06 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 35905: Add permission checks to report results (5.78 KB, patch)
2024-08-16 08:48 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 35905: Add permission checks to report results (5.74 KB, patch)
2024-08-23 14:42 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35905: (follow-up) Add permission checks to report results (6.88 KB, patch)
2024-08-23 14:42 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35905: (follow-up) Add permission checks to report reuslts (8.36 KB, patch)
2024-08-23 14:42 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35905: Add permission checks to report results (21.99 KB, patch)
2024-09-05 20:44 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35905: Add permission checks to report results (22.04 KB, patch)
2024-09-13 18:42 UTC, Olivier Vezina
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2024-01-25 10:25:08 UTC
If the user has reports permission, but is missing the "batch record delete" permission, it will still show up as link on top of the reports table.

To test:
* Create a report like:

select biblionumber from biblio limit 10

* Run the report
* Verify you have the batch delete option on top of the table
* Re-run with a user that is not a super librarian or has the permission
* Verify the link still shows, but leads to a 'permission denied' when clicked
Comment 1 Brendan Lawlor 2024-07-19 20:59:12 UTC
Created attachment 169260 [details] [review]
Bug 35905: Add permission checks to report results

Test plan:
1. Apply patch
2. Create a report like:
  select biblionumber from biblio limit 10
2. Run the report
3. Verify batch operations dropdown contains batch modification and deletion
4. Run the report again as a user that has only catalogue and reports permissions
5. Confirm the batch operations drop down only includes Add to list
6. Confirm the records drop down only includes View record
Comment 2 Roman Dolny 2024-07-20 09:06:14 UTC
Created attachment 169263 [details] [review]
Bug 35905: Add permission checks to report results

Test plan:
1. Apply patch
2. Create a report like:
  select biblionumber from biblio limit 10
2. Run the report
3. Verify batch operations dropdown contains batch modification and deletion
4. Run the report again as a user that has only catalogue and reports permissions
5. Confirm the batch operations drop down only includes Add to list
6. Confirm the records drop down only includes View record

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 3 Marcel de Rooy 2024-08-16 08:48:11 UTC
Created attachment 170440 [details] [review]
Bug 35905: Add permission checks to report results

Test plan:
1. Apply patch
2. Create a report like:
  select biblionumber from biblio limit 10
2. Run the report
3. Verify batch operations dropdown contains batch modification and deletion
4. Run the report again as a user that has only catalogue and reports permissions
5. Confirm the batch operations drop down only includes Add to list
6. Confirm the records drop down only includes View record

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Katrin Fischer 2024-08-19 15:15:04 UTC
If I read this correctly, this seems not quite right:

    [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ) %]

For "Edit record".

I believe the edit_items is not right here. The page seems only be accessible with either fast_cataloging or edit_catalogue. I think edit_catalogue is the one here.

Can you please revise?
Comment 5 Brendan Lawlor 2024-08-19 16:35:26 UTC
(In reply to Katrin Fischer from comment #4)
> If I read this correctly, this seems not quite right:
> 
>     [% IF ( CAN_user_editcatalogue_edit_catalogue ||
> CAN_user_editcatalogue_edit_items ) %]
> 
> For "Edit record".
> 
> I believe the edit_items is not right here. The page seems only be
> accessible with either fast_cataloging or edit_catalogue. I think
> edit_catalogue is the one here.
> 
> Can you please revise?

Thanks Katrin!

You are right there is something off here. I think it may need some more logic to handle all the different links that are automatically rendered in report results. 

I added edit_items here for reports that have the itemnumber in them. Item numbers link to /cataloguing/additem.pl?op=edititem&itemnumber=1 where i think edit_items is maybe the least permission needed to access that page, but I'm not sure if that's exactly correct either.

I just realized that the same issue exists for reports with brrowernumber or cardnumber in them too.

It's been a while since I looked at this code in detail, but I will give it another shot.
Comment 6 Katrin Fischer 2024-08-19 17:02:43 UTC
What we could also consider: Fixing the batch link here and moving the other permission checks to another report if that makes things easier.
Comment 7 Brendan Lawlor 2024-08-23 14:42:55 UTC
Created attachment 170634 [details] [review]
Bug 35905: Add permission checks to report results

Test plan:
1. Apply patch
2. Create a report like:
  select biblionumber from biblio limit 10
2. Run the report
3. Verify batch operations dropdown contains batch modification and deletion
4. Run the report again as a user that has only catalogue and reports permissions
5. Confirm the batch operations drop down only includes Add to list
6. Confirm the records drop down only includes View record

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Brendan Lawlor 2024-08-23 14:42:57 UTC
Created attachment 170635 [details] [review]
Bug 35905: (follow-up) Add permission checks to report results
Comment 9 Brendan Lawlor 2024-08-23 14:42:59 UTC
Created attachment 170636 [details] [review]
Bug 35905: (follow-up) Add permission checks to report reuslts

To test:
1. Create the following two reports
    a) select borrowernumber, cardnumber from borrowers limit 100
    b) select itemnumber, biblionumber from items limit 100
2. Create a user with only catalogue and reports permissions
3. Run each report as the user with minimal permissions
3. Verify the batch operations button is disabled
4. Verify there is no link to edit patron in borrowernumber columns
5. Verify there is no link to edit record in itemnumber and biblionumber columns
6. Add the following permissions one at a time and re run the reports
    tools_items_batchmod
    tools_items_batchdel
    editcatalogue_edit_catalogue
    editcatalogue_edit_items
    tools_edit_patrons
    borrowers_edit_borrowers
7. Verify the batch operations button is enabled and displays the correct links
8. Verify the links to edit patron and edit record are displayed correctly
Comment 10 Brendan Lawlor 2024-08-23 15:17:48 UTC
This update fixes the permission checks for all batch operations and edit links. 

I think technically a user could still hit a unauthorized page if they don't have permissions to view patron records or to circulate, but that's probably less of an issue.
Comment 11 Brendan Lawlor 2024-09-05 20:44:24 UTC
Created attachment 171105 [details] [review]
Bug 35905: Add permission checks to report results

There are some links on the report results page that the user may not have access to

This patch adds permission checks to the report results page to:
1. Disable the batch operations button or remove its dropdown items
2. Remove automatic links from the
    itemnumber, biblionumber, borrowernumber, and cardnumber columns
3. Remove the 'Hide/Show data menus' button
When the user doen't have permission to those actions

To test:
1. Create the following two reports
    a) select borrowernumber, cardnumber from borrowers limit 100
    b) select itemnumber, biblionumber from items limit 100
2. Create a user with only catalogue and reports permissions
3. Run each report as the user with minimal permissions
3. Verify the batch operations button is disabled
4. Verify there is no link to edit, view or checkout patron in borrowernumber columns
5. Verify there is no link to edit record in itemnumber and biblionumber columns
6. Add the following permissions one at a time and re run the reports
    tools_items_batchmod
    tools_items_batchdel
    tools_records_batchmod
    tools_records_batchdel
    tools_edit_patrons
    editcatalogue_edit_catalogue
    editcatalogue_edit_items
    borrowers_edit_borrowers
7. Verify the batch operations button is enabled and displays the correct links
8. Verify the links in borrowernumber and cardnumber columns
    to view, edit and checkout patron are displayed correctly
9. Verify the links in itemnumber and biblionumber columns
    to edit record are displayed correctly
Comment 12 Brendan Lawlor 2024-09-05 20:58:27 UTC
I ended up adding a checks circulate_remaining_permissions so I believe this now covers all links on the reports results page that a user might not have permission to access.

But in the test plan I forgot to mention testing circulate_remaining_permissions for the checkout links
Comment 13 Olivier Vezina 2024-09-09 15:22:09 UTC
In the batch operations button, i am still getting permission issues with the Patron card creation. If i don't give the label creation permission and click on the button, i am redirected to a login page saying i don't have the permission to access the page.
Comment 14 Katrin Fischer 2024-09-09 15:40:40 UTC
(In reply to Olivier V from comment #13)
> In the batch operations button, i am still getting permission issues with
> the Patron card creation. If i don't give the label creation permission and
> click on the button, i am redirected to a login page saying i don't have the
> permission to access the page.

On first glance that seems the correct bahvior. Patron cards use the label creator permission.
Comment 15 Katrin Fischer 2024-09-09 15:41:09 UTC
(In reply to Katrin Fischer from comment #14)
> (In reply to Olivier V from comment #13)
> > In the batch operations button, i am still getting permission issues with
> > the Patron card creation. If i don't give the label creation permission and
> > click on the button, i am redirected to a login page saying i don't have the
> > permission to access the page.
> 
> On first glance that seems the correct bahvior. Patron cards use the label
> creator permission.

OH! I see what you mean, but I think that's outside of scope here and should go on a separate bug :)
Comment 16 Brendan Lawlor 2024-09-09 15:59:56 UTC
For the patron card creation, I wasn't sure what the correct permission was.

When I was testing I think it worked with the permission tools_edit_patrons. If the least permission for that is actually tools_label_creator I can update the patch for that.
Comment 17 Olivier Vezina 2024-09-13 18:42:16 UTC
Created attachment 171492 [details] [review]
Bug 35905: Add permission checks to report results

There are some links on the report results page that the user may not have access to

This patch adds permission checks to the report results page to:
1. Disable the batch operations button or remove its dropdown items
2. Remove automatic links from the
    itemnumber, biblionumber, borrowernumber, and cardnumber columns
3. Remove the 'Hide/Show data menus' button
When the user doen't have permission to those actions

To test:
1. Create the following two reports
    a) select borrowernumber, cardnumber from borrowers limit 100
    b) select itemnumber, biblionumber from items limit 100
2. Create a user with only catalogue and reports permissions
3. Run each report as the user with minimal permissions
3. Verify the batch operations button is disabled
4. Verify there is no link to edit, view or checkout patron in borrowernumber columns
5. Verify there is no link to edit record in itemnumber and biblionumber columns
6. Add the following permissions one at a time and re run the reports
    tools_items_batchmod
    tools_items_batchdel
    tools_records_batchmod
    tools_records_batchdel
    tools_edit_patrons
    editcatalogue_edit_catalogue
    editcatalogue_edit_items
    borrowers_edit_borrowers
7. Verify the batch operations button is enabled and displays the correct links
8. Verify the links in borrowernumber and cardnumber columns
    to view, edit and checkout patron are displayed correctly
9. Verify the links in itemnumber and biblionumber columns
    to edit record are displayed correctly

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Comment 18 Marcel de Rooy 2024-11-15 07:41:59 UTC
+                                        [% IF ( batch_biblionumbers || batch_itemnumbers ) || ( batch_cardnumbers || batch_borrowernumbers && (CAN_user_borrowers_list_borrowers || CAN_user_borrowers_edit_borrowers || CAN_user_circulate_circulate_remaining_permissions ) ) %]
Please explain this change. Why didnt we have batch_borrowernumbers before? Are you missing parentheses around batch_card OR batch_borrower ?


-                                                [% ELSIF header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %]
+                                                [% ELSIF CAN_user_circulate_circulate_remaining_permissions && header_row.$place.cell == 'cardnumber' || header_types.item(header_row.$place.cell) == 'cardnumber' %]
Are we missing parentheses here ?