[Bug 38414] New: Can delete reports with only execute_report permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Bug ID: 38414 Summary: Can delete reports with only execute_report permission Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: andrew@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org There's a "delete" button within the report preview popup that remains exposed and operable for users with only execute_reports permission. This button should be removed unless one has delete_reports. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #1 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Still valid in main. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #2 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 188040 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188040&action=edit Bug 38414: Check for permissions in reports preview sql modal This bug refactors the preview sql modal so that it is mostly rendered by the template without js. That allows us to check for the appropriate permissions before adding the buttons to the modal. To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |blawlor@clamsnet.org |ity.org | Patch complexity|--- |Small patch CC| |blawlor@clamsnet.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Koha |Reports Group|Koha security | Product|Koha security |Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Emmi Takkinen <emmi.takkinen@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emmi.takkinen@koha-suomi.fi --- Comment #45 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- This isn't working as intented in version 25.05.11. Most of the Javascript code from first patch is missing and buttons are still shown when patron doesn't have create_reports or delete_reports permissions. Link to commit in GitHub https://github.com/Koha-Community/Koha/commit/b02e6c780b83b8c7f7cb89087920a8.... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #46 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #45)
This isn't working as intented in version 25.05.11. Most of the Javascript code from first patch is missing and buttons are still shown when patron doesn't have create_reports or delete_reports permissions. Link to commit in GitHub https://github.com/Koha-Community/Koha/commit/ b02e6c780b83b8c7f7cb89087920a8bd7a09c016.
That is interesting. I'd say the controller change is the key one though. Are you able to perform unauthorized actions? Or is it just the buttons presentation isn't as expected? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #47 from David Cook <dcook@prosentient.com.au> --- Yeah how odd that first patch is different... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #48 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- (In reply to David Cook from comment #46)
(In reply to Emmi Takkinen from comment #45)
This isn't working as intented in version 25.05.11. Most of the Javascript code from first patch is missing and buttons are still shown when patron doesn't have create_reports or delete_reports permissions. Link to commit in GitHub https://github.com/Koha-Community/Koha/commit/ b02e6c780b83b8c7f7cb89087920a8bd7a09c016.
That is interesting. I'd say the controller change is the key one though. Are you able to perform unauthorized actions?
Or is it just the buttons presentation isn't as expected?
All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.". -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #49 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #48)
All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.".
That sounds odd as the following should prevent that from happening: https://github.com/Koha-Community/Koha/commit/b02e6c780b83b8c7f7cb89087920a8... https://github.com/Koha-Community/Koha/commit/58dc77df6be100bc6592c60447af30... Can you double-check the code for reports/guided_reports.pl on your installed 25.05.11? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #50 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #49)
(In reply to Emmi Takkinen from comment #48)
All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.".
That sounds odd as the following should prevent that from happening: https://github.com/Koha-Community/Koha/commit/ b02e6c780b83b8c7f7cb89087920a8bd7a09c016
https://github.com/Koha-Community/Koha/commit/ 58dc77df6be100bc6592c60447af30b477b4dad5
Can you double-check the code for reports/guided_reports.pl on your installed 25.05.11?
The tarball looks all right https://debian.koha-community.org/koha/pool/main/k/koha/koha_25.05.11.orig.t... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #51 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- (In reply to David Cook from comment #49)
(In reply to Emmi Takkinen from comment #48)
All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.".
That sounds odd as the following should prevent that from happening: https://github.com/Koha-Community/Koha/commit/ b02e6c780b83b8c7f7cb89087920a8bd7a09c016
https://github.com/Koha-Community/Koha/commit/ 58dc77df6be100bc6592c60447af30b477b4dad5
Can you double-check the code for reports/guided_reports.pl on your installed 25.05.11?
Had to restart my services couple times to get this to work but now deleting also fails as it should. So there is a problem just with the button display. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #52 from Brendan Lawlor <blawlor@clamsnet.org> --- Just a bug fix. No functional changes, no documentation needed. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org