Bug 38297 - The "New vendor" button needs a permissions guard
Summary: The "New vendor" button needs a permissions guard
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Matt Blenkinsop
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-30 11:44 UTC by Matt Blenkinsop
Modified: 2025-02-03 16:34 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06,23.11.11
Circulation function:


Attachments
Bug 38297: Add a permissions check to the New vendor button (5.78 KB, patch)
2024-10-30 11:51 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38297: Add a permissions check to the New vendor button (2.05 KB, patch)
2024-10-30 11:52 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38297: Add a permissions check to the New vendor button (2.10 KB, patch)
2024-10-30 12:05 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 38297: Add a permissions check to the New vendor button (2.17 KB, patch)
2024-10-31 07:47 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Blenkinsop 2024-10-30 11:44:23 UTC
There is no check for the vendors_manage permission to render the New vendor button on the acquisitions homepage
Comment 1 Matt Blenkinsop 2024-10-30 11:51:23 UTC
Created attachment 173710 [details] [review]
Bug 38297: Add a permissions check to the New vendor button

Test plan:
1) Choose a staff patron and make sure they have permissions to log into the staff interface
2) Ensure that the patron does not have the vendors_manage permission but give them one other acquisitions permission so that they can see the link on the homepage (e.g. budget_manage)
3) In an incognito browser, log in with that patron and go to the acquisitions homepage
4) The New vendor button will be visible
5) Click on it and fill in the required fields. Submit the form and it will error for lack of permissions
6) Apply patch
7) Return to the acquisitions page and the New vendor button should no longer be visible
8) Back in your main browser, give the patron the vendors_manage permission and then refresh the incognito window - the button should be visible
Comment 2 Matt Blenkinsop 2024-10-30 11:52:36 UTC
Created attachment 173711 [details] [review]
Bug 38297: Add a permissions check to the New vendor button

Test plan:
1) Choose a staff patron and make sure they have permissions to log into the staff interface
2) Ensure that the patron does not have the vendors_manage permission but give them one other acquisitions permission so that they can see the link on the homepage (e.g. budget_manage)
3) In an incognito browser, log in with that patron and go to the acquisitions homepage
4) The New vendor button will be visible
5) Click on it and fill in the required fields. Submit the form and it will error for lack of permissions
6) Apply patch
7) Return to the acquisitions page and the New vendor button should no longer be visible
8) Back in your main browser, give the patron the vendors_manage permission and then refresh the incognito window - the button should be visible
Comment 3 Owen Leonard 2024-10-30 12:05:44 UTC
Created attachment 173713 [details] [review]
Bug 38297: Add a permissions check to the New vendor button

Test plan:
1) Choose a staff patron and make sure they have permissions to log
   into the staff interface
2) Ensure that the patron does not have the vendors_manage permission
   but give them one other acquisitions permission so that they can see
   the link on the homepage (e.g. budget_manage)
3) In an incognito browser, log in with that patron and go to the
   acquisitions homepage
4) The New vendor button will be visible
5) Click on it and fill in the required fields. Submit the form and it
   will error for lack of permissions
6) Apply patch
7) Return to the acquisitions page and the New vendor button should no
   longer be visible
8) Back in your main browser, give the patron the vendors_manage
   permission and then refresh the incognito window - the button should
   be visible

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 4 Martin Renvoize (ashimema) 2024-10-31 07:47:22 UTC
Created attachment 173763 [details] [review]
Bug 38297: Add a permissions check to the New vendor button

Test plan:
1) Choose a staff patron and make sure they have permissions to log
   into the staff interface
2) Ensure that the patron does not have the vendors_manage permission
   but give them one other acquisitions permission so that they can see
   the link on the homepage (e.g. budget_manage)
3) In an incognito browser, log in with that patron and go to the
   acquisitions homepage
4) The New vendor button will be visible
5) Click on it and fill in the required fields. Submit the form and it
   will error for lack of permissions
6) Apply patch
7) Return to the acquisitions page and the New vendor button should no
   longer be visible
8) Back in your main browser, give the patron the vendors_manage
   permission and then refresh the incognito window - the button should
   be visible

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Katrin Fischer 2024-10-31 10:04:13 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 6 Lucas Gass (lukeg) 2024-12-05 21:18:22 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 7 Fridolin Somers 2024-12-18 09:38:33 UTC
Pushed to 23.11.x for 23.11.11
Comment 8 Jesse Maseto 2025-02-03 16:34:37 UTC
Not pushed to LTS. Marked Resolved.

If you feel this should be in LTS please reply with your reason.