[Bug 30720] New: Batch delete links from result list missing permission checks
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Bug ID: 30720 Summary: Batch delete links from result list missing permission checks Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard@myacpl.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org When several records are selected from the result list in the staff interface, it unlocks a button with several batch options. The batch delete and batch edit tools have separate permissions independent from the edit_catalogue permission, so this should be updated to check for each of them separately for displaying the button and the separate entries. [% IF ( CAN_user_editcatalogue_edit_catalogue ) %] <div class="btn-group"> <a class="btn btn-default btn-xs" id="z3950submit" href="#"><i class="fa fa-search"></i> Z39.50/SRU search</a> </div> <div class="btn-group"> <button type="button" id="results_batch_ops" class="btn btn-default btn-xs dropdown-toggle disabled" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="fa fa-pencil"></i> Edit <span class="caret"></span> </button> <ul class="dropdown-menu"> <li><a class="results_batch_op" data-op="edit" href="#">Batch edit</a></li> <li><a class="results_batch_op" data-op="delete" href="#">Batch delete</a></li> <li><a class="results_batch_op" data-op="merge" href="#">Merge records</a></li> </ul> </div> [% END %] -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |katrin.fischer@bsz-bw.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 134965 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134965&action=edit Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #134965|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 134970 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134970&action=edit Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #134970|0 |1 is obsolete| | --- Comment #3 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 134995 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134995&action=edit Bug 30720: Batch action links in result list missing permission checks In the staff interface you can select records for merging, batch editing, and batch deleting from the result list. This fixes the code to check for the specific batch edit records and batch delete records permissions, so those actions are only shown if the user has the right permissions. As there is no merge record permission yet, it's assumed that edit_cataloge is needed as before (no change in behavior). To test: - Create a staff user with only catalogue and editcatalogue permissions. - Do a search in the catalog of the staff interface - Select a few records from result list to unlock the Edit button on top - Verify it shows all three options: edit, delete and merge - Apply patch - Verfiy now only merging is shown - Add the records_batchdel and records_batchmod permissions from the tools area one after another and verify the display changes accordingly. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Status|Signed Off |Passed QA --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Good catch Katrin, all works as expected and QA scripts are happy. PQA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Depends on| |23349 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23349 [Bug 23349] Add batch operations to staff interface catalog search results -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 --- Comment #5 from Fridolin Somers <fridolin.somers@biblibre.com> --- Those links have been added by Bug 23349 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |22.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30720 --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to master for 22.05, thanks to everybody involved 🦄 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org