[Bug 42667] New: Split the ability to edit other librarian's reports into a separate permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Bug ID: 42667 Summary: Split the ability to edit other librarian's reports into a separate permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: lisette@bywatersolutions.com My work on bug 42108 has lead me to realize that being able to edit anyone's reports creates a loophole that allows anyone who can create reports to bypass 42108 by simply editing someone else's existing report. Aside from that, this seems like a good idea in general. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42108 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42108 [Bug 42108] Add ability to specify that a report can only be run as a foreground or background report -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199488 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199488&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #2 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199489 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199489&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #3 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199490 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199490&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #4 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199491 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199491&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |41921 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41921 [Bug 41921] Add ability to run reports as background jobs -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199488|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199489|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199490|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199491|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #5 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199563 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199563&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #6 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199564 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199564&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #7 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199565&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #8 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 199566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199566&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #9 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- *** Bug 42622 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Comma delimited| |CLAMS list of Sponsors| | Status|Needs Signoff |Signed Off Sponsorship status|--- |Sponsored -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199563|0 |1 is obsolete| | Attachment #199564|0 |1 is obsolete| | Attachment #199565|0 |1 is obsolete| | Attachment #199566|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #10 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200191 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200191&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #11 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200192 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200192&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #12 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200193 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200193&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #13 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 200194 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200194&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@openfifth.c | |o.uk QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200191|0 |1 is obsolete| | Attachment #200192|0 |1 is obsolete| | Attachment #200193|0 |1 is obsolete| | Attachment #200194|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #14 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200266 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200266&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #15 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200267 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200267&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #16 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200268 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200268&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #17 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200269 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200269&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #18 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200270 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200270&action=edit Bug 42667: (QA follow-up) Fix null guard and exception description - Add null check around Koha::Patrons->find() in guided_reports.pl before calling ->has_permission, matching the defensive pattern already used in Koha::Report::check_edit_permission - Add missing description to Koha::Exceptions::Report base class for consistency with its sub-exceptions Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #19 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 200271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200271&action=edit Bug 42667: (QA follow-up) Test edit permission on ownerless reports Add two test cases covering reports with no borrowernumber (NULL owner): a patron without edit_all_reports should be denied, one with the permission should succeed. The POD documents this case but it was not previously exercised. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42826 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42826 [Bug 42826] Reports: Allow transfer/adoption of report ownership -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blawlor@clamsnet.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Patch doesn't apply CC| |pedro.amorim@openfifth.co.u | |k -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200266|0 |1 is obsolete| | Attachment #200267|0 |1 is obsolete| | Attachment #200268|0 |1 is obsolete| | Attachment #200269|0 |1 is obsolete| | Attachment #200270|0 |1 is obsolete| | Attachment #200271|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #20 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203099 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203099&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #21 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203100 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203100&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #22 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203101 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203101&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #23 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203102 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203102&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #24 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203103 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203103&action=edit Bug 42667: (QA follow-up) Fix null guard and exception description - Add null check around Koha::Patrons->find() in guided_reports.pl before calling ->has_permission, matching the defensive pattern already used in Koha::Report::check_edit_permission - Add missing description to Koha::Exceptions::Report base class for consistency with its sub-exceptions Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #25 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203104 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203104&action=edit Bug 42667: (QA follow-up) Test edit permission on ownerless reports Add two test cases covering reports with no borrowernumber (NULL owner): a patron without edit_all_reports should be denied, one with the permission should succeed. The POD documents this case but it was not previously exercised. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #26 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203105 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203105&action=edit Bug 42667: (follow-up) Adjust number of tests Patch from commit 351610e -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #203099|0 |1 is obsolete| | Attachment #203100|0 |1 is obsolete| | Attachment #203101|0 |1 is obsolete| | Attachment #203102|0 |1 is obsolete| | Attachment #203103|0 |1 is obsolete| | Attachment #203104|0 |1 is obsolete| | Attachment #203105|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #27 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205393 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205393&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #28 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205394 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205394&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #29 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205395 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205395&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #30 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205396 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205396&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #31 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205397 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205397&action=edit Bug 42667: (QA follow-up) Fix null guard and exception description - Add null check around Koha::Patrons->find() in guided_reports.pl before calling ->has_permission, matching the defensive pattern already used in Koha::Report::check_edit_permission - Add missing description to Koha::Exceptions::Report base class for consistency with its sub-exceptions Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #32 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205398 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205398&action=edit Bug 42667: (QA follow-up) Test edit permission on ownerless reports Add two test cases covering reports with no borrowernumber (NULL owner): a patron without edit_all_reports should be denied, one with the permission should succeed. The POD documents this case but it was not previously exercised. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #33 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 205399 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205399&action=edit Bug 42667: (follow-up) Adjust number of tests Patch from commit defbfbb -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off --- Comment #34 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- rebased for current main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #35 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Double-checking here: This was PQA then "Doesn't apply", after rebase to apply nicely is now Signed-off. Please confirm Lucas i.e. should this not be back in PQA? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #36 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- (In reply to Pedro Amorim (ammopt) from comment #35)
Double-checking here: This was PQA then "Doesn't apply", after rebase to apply nicely is now Signed-off. Please confirm Lucas i.e. should this not be back in PQA?
That's my bad, should be back to PQA. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #37 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi guys, a few gaps here worth addressing: Issue 1: Reports table row still shows "Edit" to unauthorized users 1) Create two staff patrons with only create_reports (not edit_all_reports), e.g. Alice and Bob. 2) Log in as Alice, go to Reports → Create from SQL, add a name and 'select 1' as the query. Save it. 3) Log in as Bob: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl 4) Find Alice's report in the list, open its row actions dropdown. => Expected: no "Edit" option (Bob doesn't own it, no edit_all_reports). Actual: "Edit" is shown, clicking it lands on "insufficient permission", proving it should never have been shown. Issue 2: Preview modal's edit button missing even for the report's owner (confirmed regression) 1) Log in as any staff patron with create_reports. 2) Go to Reports → Create from SQL, add a name and select 1 as the query. Save it. 3) Go to the reports list: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl 4) On your own report's row, click "Preview SQL". 5) Look inside the preview modal for an "Edit" option. => Expected: since you own the report, Edit should be there (and did show, for anyone with create_reports, before this patchset). Actual: it's missing, for every user, including superlibrarian. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #205399|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #205393|0 |1 is obsolete| | Attachment #205394|0 |1 is obsolete| | Attachment #205395|0 |1 is obsolete| | Attachment #205396|0 |1 is obsolete| | Attachment #205397|0 |1 is obsolete| | Attachment #205398|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #38 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206067 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206067&action=edit Bug 42667: Add new edit_all_reports permission Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #39 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206068 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206068&action=edit Bug 42667: Require edit_all_reports to edit other librarian's reports Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #40 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206069 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206069&action=edit Bug 42667: Hide edit controls as needed Test plan: 1) Apply this patch set 2) Run updatedatabase.pl 3) Restart all the things! 4) Create 2 users with create_reports and not edit_all_reports 5) Create reports with each 6) Note that each cannot edit the others reports 7) Create a user with create_reports and edit_all_reports 8) Note the this user can edit reports from the previous two users Edit button placements to look for: * Reports table row * Actions menu * Toolbar Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #41 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206070 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206070&action=edit Bug 42667: Enforce permission in Koha::Report Prevents possible template bugs from allowing editing of reports by others without the proper permissions. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #42 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206071 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206071&action=edit Bug 42667: (QA follow-up) Fix null guard and exception description - Add null check around Koha::Patrons->find() in guided_reports.pl before calling ->has_permission, matching the defensive pattern already used in Koha::Report::check_edit_permission - Add missing description to Koha::Exceptions::Report base class for consistency with its sub-exceptions Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #43 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206072 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206072&action=edit Bug 42667: (QA follow-up) Test edit permission on ownerless reports Add two test cases covering reports with no borrowernumber (NULL owner): a patron without edit_all_reports should be denied, one with the permission should succeed. The POD documents this case but it was not previously exercised. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #44 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- rebased for current main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #45 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206075 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206075&action=edit Bug 42667: (follow-up) Update dropdown so users can only choose to edit own report Patch from commit f684765 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #46 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 206076 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206076&action=edit Bug 42667: (follow-up) Fix edit button inside of preview SQL modal Patch from commit 84ac8b9 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA --- Comment #47 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- (In reply to Pedro Amorim (ammopt) from comment #37)
Hi guys, a few gaps here worth addressing:
Issue 1: Reports table row still shows "Edit" to unauthorized users 1) Create two staff patrons with only create_reports (not edit_all_reports), e.g. Alice and Bob. 2) Log in as Alice, go to Reports → Create from SQL, add a name and 'select 1' as the query. Save it. 3) Log in as Bob: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl 4) Find Alice's report in the list, open its row actions dropdown. => Expected: no "Edit" option (Bob doesn't own it, no edit_all_reports). Actual: "Edit" is shown, clicking it lands on "insufficient permission", proving it should never have been shown.
Issue 2: Preview modal's edit button missing even for the report's owner (confirmed regression) 1) Log in as any staff patron with create_reports. 2) Go to Reports → Create from SQL, add a name and select 1 as the query. Save it. 3) Go to the reports list: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl 4) On your own report's row, click "Preview SQL". 5) Look inside the preview modal for an "Edit" option. => Expected: since you own the report, Edit should be there (and did show, for anyone with create_reports, before this patchset). Actual: it's missing, for every user, including superlibrarian.
Thanks Pedro, I've addressed each issue with a follow-up. Setting back to PQA. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #48 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #49 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- This is now causing a failure in: prove xt/author/pod_coverage.t Can we please follow-up when convenient? Thanks in advance! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 --- Comment #50 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 207022 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207022&action=edit Bug 42667: (follow-up) Fix POD coverage Patch from commit 3d67fa2 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42667 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #51 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- (In reply to Lucas Gass (lukeg) from comment #50)
Created attachment 207022 [details] [review] Bug 42667: (follow-up) Fix POD coverage
Patch from commit 3d67fa2
Follow-up pushed. Thanks! -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org