Bug 38414: [22.11] backport to 22.11
Bug 38414: Fix permission controller-side This bug refactors the preview sql buttons to pass the permissions granted for each report to the javascript that clones and updates the modal. That allows us to check for the appropriate permissions when preparing the buttons for the modal and to remove any that are not allowed. This allows for different permissions per report for future devs (see bugs 42406, 16631) To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports We also fix some error in the script, several wrong things there: * delete was not replaced with cud-delete * missing op for the creation of new reports * update and run requires two permssions Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Scott Barter <sbarter@aacpl.net> Bug 38414: (follow-up) comprehensively cover ops with required permissions Test plan: 0. Apply the patch and restart_all 1. Using a user with only "create_reports", "execute_reports", or "delete_reports", try to perform operations not covered by that permission. That is, if you have "create_reports", try to run, export, and delete reports. If you have "execute_reports", try to create, modify, and delete reports If you have "delete_reports", try to create, modify, and run reports 2. Note that a user with each of these permissions can list and view SQL. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Bug 38414: (QA follow-up) Adjust templates Now that we can explicitly list reports with any one of the permissions we need to adjust some displays to ensure we can get to the list view. Additionally I change 'Use saved' to 'View saved' since we may not be able to run. I also fix the action buttons to show 'View' instead of 'Run' if user cannot execute. I adjust reports home to check if the user can use report plugins before showing that link as well Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Bug 38414: (follow-up) Fix OR operator Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jonathan Druart
Wainui Witika-Park
parent
d1f8eb6460
commit
139e119a16
|
|
@ -2,9 +2,9 @@
|
|||
<div id="navmenu">
|
||||
<div id="navmenulist">
|
||||
|
||||
<h5>Run reports</h5>
|
||||
<h5>View reports</h5>
|
||||
<ul>
|
||||
[% IF ( CAN_user_reports_execute_reports ) %]<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a></li>[% END %]
|
||||
[% IF ( CAN_user_reports_execute_reports || CAN_user_reports_create_reports || CAN_user_reports_delete_reports ) %]<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a></li>[% END %]
|
||||
</ul>
|
||||
<h5>Reports dictionary</h5>
|
||||
<ul>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Build%20new">Build new</a></li>
|
||||
[% END %]
|
||||
[% IF ( CAN_user_reports_execute_reports ) %]
|
||||
<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Use saved</a></li>
|
||||
<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">View saved</a></li>
|
||||
[% END %]
|
||||
[% IF ( CAN_user_reports_create_reports ) %]
|
||||
<li><a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL">Create from SQL</a></li>
|
||||
|
|
|
|||
|
|
@ -170,7 +170,7 @@
|
|||
[% IF ( CAN_user_reports_execute_reports ) %]
|
||||
<form action="/cgi-bin/koha/reports/guided_reports.pl">
|
||||
<input type="hidden" name="phase" value="Use saved"/>
|
||||
<input type="submit" name="submit" class="btn btn-primary" value="Use saved" />
|
||||
<input type="submit" name="submit" class="btn btn-primary" value="View saved" />
|
||||
</form>
|
||||
[% END %]
|
||||
|
||||
|
|
@ -356,9 +356,12 @@
|
|||
<td>
|
||||
<div class="btn-group dropup">
|
||||
[%# There should be no space between these two buttons, it would render badly %]
|
||||
[%- IF ( CAN_user_reports_execute_reports ) -%]
|
||||
<a class="btn btn-default btn-xs" role="button"
|
||||
href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id | html %]&phase=Run%20this%20report"><i
|
||||
class="fa fa-play"></i> Run</a><a
|
||||
class="fa fa-play"></i> Run</a>
|
||||
[% END %]
|
||||
<a
|
||||
class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-toggle="dropdown"
|
||||
href="#"><b class="caret"></b></a>
|
||||
<ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]">
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@
|
|||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
|
||||
[% IF ( CAN_user_reports_execute_reports || CAN_user_reports_create_reports ) %]
|
||||
[% IF ( CAN_user_reports_execute_reports || CAN_user_reports_create_reports || CAN_user_reports_delete_reports ) %]
|
||||
<form action="/cgi-bin/koha/reports/guided_reports.pl" method="get">
|
||||
<fieldset class="brief">
|
||||
<h2>Guided reports</h2>
|
||||
|
|
@ -39,7 +39,7 @@
|
|||
</p>
|
||||
[% END %]
|
||||
<p>
|
||||
<a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved"><i class="fa fa-list"></i> Use saved</a>
|
||||
<a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved"><i class="fa fa-list"></i> View saved</a>
|
||||
</p>
|
||||
<label for="filter_keyword">Search by keyword:</label> <input id="filter_keyword" name="filter_keyword" value="" size="16" type="text" /> <input type="submit" class="btn btn-primary" value="Search" />
|
||||
</fieldset>
|
||||
|
|
|
|||
|
|
@ -52,23 +52,27 @@ Script to control the guided report creation
|
|||
my $input = CGI->new;
|
||||
my $usecache = Koha::Caches->get_instance->memcached_cache;
|
||||
|
||||
my $phase = $input->param('phase') // '';
|
||||
my $phase = $input->param('phase') // 'Use saved';
|
||||
my $flagsrequired;
|
||||
if ( ( $phase eq 'Build new' ) || ( $phase eq 'Create report from SQL' ) || ( $phase eq 'Edit SQL' )
|
||||
|| ( $phase eq 'Build new from existing' ) || ( $phase eq 'Create report from existing' ) ) {
|
||||
|| ( $phase eq 'Build new from existing' ) || ( $phase eq 'Create report from existing' )
|
||||
|| ( $phase eq 'Build report' ) || ( $phase eq 'Choose these columns' ) || ( $phase eq 'Choose these criteria')
|
||||
|| ( $phase eq 'Choose these operations' ) || ( $phase eq 'Choose this type' )
|
||||
|| ( $phase eq 'Update SQL' ) || ( $phase eq 'Save' ) || ( $phase eq 'Save Report' ) || ( $phase eq 'Report on this Area' )
|
||||
) {
|
||||
$flagsrequired = 'create_reports';
|
||||
}
|
||||
elsif ( $phase eq 'Use saved' ) {
|
||||
$flagsrequired = 'execute_reports';
|
||||
elsif ( ( $phase eq 'Use saved' ) || ( $phase eq 'Show SQL' ) ) {
|
||||
$flagsrequired = [ 'create_reports', 'execute_reports', 'delete_reports' ]; #NOTE: "or" permissions
|
||||
}
|
||||
elsif ( $phase eq 'Delete Saved' ) {
|
||||
elsif ( ( $phase eq 'Delete Saved' ) || ( $phase eq 'Delete Multiple' ) ) {
|
||||
$flagsrequired = 'delete_reports';
|
||||
}
|
||||
elsif ( $phase eq 'Run this Report') {
|
||||
elsif ( ( $phase =~ /^Run this Report$/i) || ( $phase eq 'Export' ) || ( $phase eq 'retrieve results' ) ) {
|
||||
$flagsrequired = 'execute_reports';
|
||||
}
|
||||
else {
|
||||
$flagsrequired = '*';
|
||||
$flagsrequired = 1;
|
||||
}
|
||||
|
||||
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
|
||||
|
|
|
|||
Loading…
Reference in New Issue