https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Bug ID: 30720 Summary: Batch delete links from result list missing permission checks Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard@myacpl.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org When several records are selected from the result list in the staff interface, it unlocks a button with several batch options. The batch delete and batch edit tools have separate permissions independent from the edit_catalogue permission, so this should be updated to check for each of them separately for displaying the button and the separate entries. [% IF ( CAN_user_editcatalogue_edit_catalogue ) %] <div class="btn-group"> <a class="btn btn-default btn-xs" id="z3950submit" href="#"><i class="fa fa-search"></i> Z39.50/SRU search</a> </div> <div class="btn-group"> <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="fa fa-pencil"></i> Edit <span class="caret"></span> </button> <ul class="dropdown-menu"> <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li> <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li> <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li> </ul> </div> [% END %] -- You are receiving this mail because: You are watching all bug changes.