https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #1 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Still valid in main. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #2 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 188040 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188040&action=edit Bug 38414: Check for permissions in reports preview sql modal This bug refactors the preview sql modal so that it is mostly rendered by the template without js. That allows us to check for the appropriate permissions before adding the buttons to the modal. To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Koha |Reports Group|Koha security | Product|Koha security |Koha -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 Emmi Takkinen <emmi.takkinen@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emmi.takkinen@koha-suomi.fi --- Comment #45 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- This isn't working as intented in version 25.05.11. Most of the Javascript code from first patch is missing and buttons are still shown when patron doesn't have create_reports or delete_reports permissions. Link to commit in GitHub https://github.com/Koha-Community/Koha/commit/b02e6c780b83b8c7f7cb89087920a8.... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #47 from David Cook <dcook@prosentient.com.au> --- Yeah how odd that first patch is different... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #49 from David Cook <dcook@prosentient.com.au> --- (In reply to Emmi Takkinen from comment #48)

All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.".

That sounds odd as the following should prevent that from happening: https://github.com/Koha-Community/Koha/commit/b02e6c780b83b8c7f7cb89087920a8... https://github.com/Koha-Community/Koha/commit/58dc77df6be100bc6592c60447af30... Can you double-check the code for reports/guided_reports.pl on your installed 25.05.11? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38414 --- Comment #51 from Emmi Takkinen <emmi.takkinen@koha-suomi.fi> --- (In reply to David Cook from comment #49)

(In reply to Emmi Takkinen from comment #48)

...

All buttons are still displayed on pop-up. I was able to delete a report with just execute_reports permission. Edit, Duplicate and Schedule buttons lead to "Error: You do not have permission to access this page.".

That sounds odd as the following should prevent that from happening: https://github.com/Koha-Community/Koha/commit/ b02e6c780b83b8c7f7cb89087920a8bd7a09c016

https://github.com/Koha-Community/Koha/commit/ 58dc77df6be100bc6592c60447af30b477b4dad5

Can you double-check the code for reports/guided_reports.pl on your installed 25.05.11?

Had to restart my services couple times to get this to work but now deleting also fails as it should. So there is a problem just with the button display. -- You are receiving this mail because: You are watching all bug changes.