[Bug 25572] New: Permissions for Mana Reports are currently linked to Permissions in Serials
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Bug ID: 25572 Summary: Permissions for Mana Reports are currently linked to Permissions in Serials Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Mana-kb Assignee: koha-bugs@lists.koha-community.org Reporter: kelly@bywatersolutions.com Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alex.arnaud@biblibre.com, | |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> ---
From svc/mana/search: 32 my ( $auth_status, $sessionID ) = 33 check_cookie_auth( $input->cookie('CGISESSID'), 34 { serials => 'create_subscription' } );
Not sure how we can fix this correctly. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jeff Gaines <jgaine@arlingtonva.us> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jgaine@arlingtonva.us -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com --- Comment #2 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- +1 on this, folks don't like having to give extra permissions for stuff like this to work. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 --- Comment #3 from Jeff Gaines <jgaine@arlingtonva.us> --- Yes, I have staff that do nothing with Serials but are heavy report users. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 113865 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=113865&action=edit Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |17047 Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17047 [Bug 17047] Mana Knowledge Base : Data sharing -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |27061 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27061 [Bug 27061] Double permission check in svc/mana/search -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Kelly McElligott <kelly@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Kelly McElligott <kelly@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #113865|0 |1 is obsolete| | --- Comment #5 from Kelly McElligott <kelly@bywatersolutions.com> --- Created attachment 113899 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=113899&action=edit Bug 25572: Fix permission check for mana (reports) Mana works with both Reports and Serials. Currently a staff member needs to have a serial permissions to be able to use the Mana function in the reporting module. If the staff member does not have the permission, "Create A New Subscription", the staff member can not use Mana in the reports module. Test plan: Enable Mana Create a patron with the "create new subscription" permission Create another patron with the "create new report" permission Confirm that both can use Mana in their respective module. Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com > -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net --- Comment #6 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Hi, I have a patron with just the catalogue and create_reports permissions. I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out. When giving the create_subscription permission, it works, the form is filled with the SQL of the report. Could I be missing a step? First time using Mana to create a report I think. Services where restarted after applying the patch. Logs look alright: 172.24.0.1 - - [25/Dec/2020:20:32:06 +0000] "POST /intranet/svc/mana/use HTTP/1.1" 200 0 "http://172.24.0.6:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Create%2..." "Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0" As for the subscriptions, it works with minimal permissions. BTW was there a simpler way to test with sample than to search the web for the ISSN of a famous newspaper then import (the right one) with Z39.50? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Victor Grousset/tuxayo from comment #6)
Hi, I have a patron with just the catalogue and create_reports permissions. I can't create a report from Mana, when clicking on "import" the button spins infinitely. When refreshing the page, I'm logged out. When giving the create_subscription permission, it works, the form is filled with the SQL of the report. Could I be missing a step? First time using Mana to create a report I think.
I followed those steps and it works ok for me. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |julian.maurice@biblibre.com Status|Signed Off |Failed QA --- Comment #8 from Julian Maurice <julian.maurice@biblibre.com> --- This patch only modifies svc/mana/search but all svc/mana/* scripts are affected by the same bug, so all of them should be fixed. Also, it is really weird that these scripts return a 200 OK response when permissions don't match. It should be a 403. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jonathan.druart@bugs.koha-c |alex.arnaud@biblibre.com |ommunity.org | --- Comment #9 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Alex, can you have a look please? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|27061 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27061 [Bug 27061] Double permission check in svc/mana/search -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25572 hebah@bywatersolutions.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hebah@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org