https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 --- Comment #1 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 53723 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=53723&action=edit Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission.

From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability.

-- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA CC| |veron@veron.ch --- Comment #2 from Marc Véron <veron@veron.ch> --- Wanted to test, but sorry: - atomicupdate is missing, so I have no delete_reports in table permissions - a test plan would be nice -- You are receiving this mail because: You are watching all bug changes.

drop database ... create database ... -- totally blanks it for fresh web install

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- TEST PLAN --------- 1) back up db 2) apply patch 3) ./installer/data/mysql/updatedatabase.pl -- should run without issue. 4) in mysql: 5) run web install -- installing should have no issues 6) go to a patron 7) set permissions 8) expand the reports permission -- should have delete reports now 9) click help and scroll down to 'Granular Reports Permissions' right at the bottom. -- there should be a new delete_reports section 10) Head over to guided reports and build a few reports. -- as system account user, delete stuff should all be visible. 11) Find a patron, set all permissions, except delete reports. 12) log out and then log in as the modified patron 13) Head over the save reports -- none of the delete options should be available to the user. 14) run koha qa test tools 15) restore db -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 --- Comment #7 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Jonathan Druart from comment #6)

Mark, you must provide a SQL query to update the permissions of patrons. Actually everything should be ok for 95%, but if a patron has create_report but execute_report (ok that sounds weird), after this patch he won't be able to delete reports.

DOH! Thanks for catching that. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 --- Comment #8 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 53864 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=53864&action=edit Bug 16978: Followup - Copy create_report permissions for delete_report This patch should deal with comment #6's point of where a user who has create, but not execute permissions, would lose delete ability. Users with create and execute permissions would already have delete as well. TEST PLAN --------- 1) Back up db 2) drop database koha_library; 3) create database koha_library; 4) web install with all sample data with system user 6) log into staff client as system user 7) make sample koha admin user a superlibrarian 8) set username and password for sample koha admin user 9) log out and log in as koha admin 10) Create a user (USER_A) with permissions: create_reports and execute_reports. 11) Create a user (USER_B) with permissions: create_reports, but not execute_reports. 12) Create a user (USER_C) with permissions: execute_reports, but not create_reports. 13) Create a user (USER_D) with no report permissions. 14) Run the atomic update. 15) Check USER_A permissions -- should have delete_reports 16) Check USER_B -- should have delete_reports 17) Check USER_C -- should NOT have delete_reports 18) Check USER_D -- should NOT have delete_reports 19) run koha qa test tools 20) restore db -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #53864|0 |1 is obsolete| | --- Comment #9 from Frédéric Demians <frederic@tamil.fr> --- Created attachment 53871 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=53871&action=edit Bug 16978: Followup - Copy create_report permissions for delete_report This patch should deal with comment #6's point of where a user who has create, but not execute permissions, would lose delete ability. Users with create and execute permissions would already have delete as well. TEST PLAN --------- 1) Back up db 2) drop database koha_library; 3) create database koha_library; 4) web install with all sample data with system user 6) log into staff client as system user 7) make sample koha admin user a superlibrarian 8) set username and password for sample koha admin user 9) log out and log in as koha admin 10) Create a user (USER_A) with permissions: create_reports and execute_reports. 11) Create a user (USER_B) with permissions: create_reports, but not execute_reports. 12) Create a user (USER_C) with permissions: execute_reports, but not create_reports. 13) Create a user (USER_D) with no report permissions. 14) Run the atomic update. 15) Check USER_A permissions -- should have delete_reports 16) Check USER_B -- should have delete_reports 17) Check USER_C -- should NOT have delete_reports 18) Check USER_D -- should NOT have delete_reports 19) run koha qa test tools 20) restore db Signed-off-by: Frédéric Demians <f.demians@tamil.fr> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #53741|0 |1 is obsolete| | Attachment #53871|0 |1 is obsolete| | --- Comment #10 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 53887 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=53887&action=edit Bug 16978: Add delete reports user permission This splits off the delete capability from the create reports permission.

From a UI perspective there were CSS issues, that this patch set hackily bypasses. Perhaps someone else can amend this enhancement with the required changes so that the extra column at the beginning of the table can be removed when the user does not have delete capability.

drop database ... create database ... -- totally blanks it for fresh web install

TEST PLAN --------- 1) back up db 2) apply patch 3) ./installer/data/mysql/updatedatabase.pl -- should run without issue. 4) in mysql: 5) run web install -- installing should have no issues 6) go to a patron 7) set permissions 8) expand the reports permission -- should have delete reports now 9) click help and scroll down to 'Granular Reports Permissions' right at the bottom. -- there should be a new delete_reports section 10) Head over to guided reports and build a few reports. -- as system account user, delete stuff should all be visible. 11) Find a patron, set all permissions, except delete reports. 12) log out and then log in as the modified patron 13) Head over the save reports -- none of the delete options should be available to the user. 14) run koha qa test tools 15) restore db Followed test plan. Additionally tried to delete using params in URL (not possible, OK) Signed-off-by: Marc <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16978 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |kyle@bywatersolutions.com --- Comment #12 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to master for 16.11, thanks Mark! -- You are receiving this mail because: You are watching all bug changes.