[Koha-bugs] [Bug 30720] New: Batch delete links from result list missing permission checks

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720

            Bug ID: 30720
           Summary: Batch delete links from result list missing permission
                    checks
 Change sponsored?: ---
           Product: Koha
           Version: master
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5 - low
         Component: Templates
          Assignee: oleonard at myacpl.org
          Reporter: katrin.fischer at bsz-bw.de
        QA Contact: testopia at bugs.koha-community.org

When several records are selected from the result list in the staff interface,
it unlocks a button with several batch options.

The batch delete and batch edit tools have separate permissions independent
from the edit_catalogue permission, so this should be updated to check for each
of them separately for displaying the button and the separate entries.

                            [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
                                <div class="btn-group">
                                    <a class="btn btn-default btn-xs"
id="z3950submit" href="#"><i class="fa fa-search"></i> Z39.50/SRU search</a>
                                </div>
                                <div class="btn-group">
                                    <button type="button"
id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled"
data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                                        <i class="fa fa-pencil"></i> Edit <span
class="caret"></span>
                                    </button>
                                    <ul class="dropdown-menu">
                                        <li><a class="results_batch_op"
data-op="edit" href="#">Batch edit</a></li>
                                        <li><a class="results_batch_op"
data-op="delete" href="#">Batch delete</a></li>
                                        <li><a class="results_batch_op"
data-op="merge" href="#">Merge records</a></li>
                                    </ul>
                                </div>
                            [% END %]

-- 
You are receiving this mail because:
You are watching all bug changes.