[Bug 42667] New: Split the ability to edit other librarian's reports into a separate permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Bug ID: 42667 Summary: Split the ability to edit other librarian's reports into a separate permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: lisette@bywatersolutions.com My work on bug 42108 has lead me to realize that being able to edit anyone's reports creates a loophole that allows anyone who can create reports to bypass 42108 by simply editing someone else's existing report. Aside from that, this seems like a good idea in general. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42108 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42108 [Bug 42108] Add ability to specify that a report can only be run as a foreground or background report -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199488 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199488&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #2 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199489 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199489&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #3 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199490 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199490&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #4 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199491 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199491&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |41921 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41921 [Bug 41921] Add ability to run reports as background jobs -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199488|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199489|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199490|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199491|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #5 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199563 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199563&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #6 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199564 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199564&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #7 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199565&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #8 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199566&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #9 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- *** Bug 42622 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Comma delimited| |CLAMS list of Sponsors| | Status|Needs Signoff |Signed Off Sponsorship status|--- |Sponsored -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199563|0 |1 is obsolete| | Attachment #199564|0 |1 is obsolete| | Attachment #199565|0 |1 is obsolete| | Attachment #199566|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #10 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200191 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200191&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #11 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200192 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200192&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #12 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200193 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200193&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #13 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200194 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200194&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@openfifth.c | |o.uk QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200191|0 |1 is obsolete| | Attachment #200192|0 |1 is obsolete| | Attachment #200193|0 |1 is obsolete| | Attachment #200194|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #14 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200266 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200266&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #15 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200267 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200267&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #16 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200268 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200268&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #17 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200269 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200269&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #18 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200270 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200270&action=edit Bug 42667: (QA follow-up) Fix null guard and exception description - Add null check around Koha::Patrons->find() in guided_reports.pl before calling ->has_permission, matching the defensive pattern already used in Koha::Report::check_edit_permission - Add missing description to Koha::Exceptions::Report base class for consistency with its sub-exceptions Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #19 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200271&action=edit Bug 42667: (QA follow-up) Test edit permission on ownerless reports Add two test cases covering reports with no borrowernumber (NULL owner): a patron without edit_all_reports should be denied, one with the permission should succeed. The POD documents this case but it was not previously exercised. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42826 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42826 [Bug 42826] Reports: Allow transfer/adoption of report ownership -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blawlor@clamsnet.org -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org