Bug 35905 - Missing permission check for "record batch delete" from reports
Summary: Missing permission check for "record batch delete" from reports
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-25 10:25 UTC by Katrin Fischer
Modified: 2024-01-25 10:25 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2024-01-25 10:25:08 UTC
If the user has reports permission, but is missing the "batch record delete" permission, it will still show up as link on top of the reports table.

To test:
* Create a report like:

select biblionumber from biblio limit 10

* Run the report
* Verify you have the batch delete option on top of the table
* Re-run with a user that is not a super librarian or has the permission
* Verify the link still shows, but leads to a 'permission denied' when clicked