https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18898 Bug ID: 18898 Summary: Some permissions for Reports can be bypassed Change sponsored?: --- Product: Koha Version: 16.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: bovinitydivinity@comcast.net QA Contact: testopia@bugs.koha-community.org In 16.11.05.000 If a user has permissions to run - but not create or edit reports - they can still create or edit reports by editing the the URL while running a report and changing the Phase parameter to "Edit SQL" or "Create report from SQL". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.