From 139e119a164de7fb44ec625651bc1da5406c8a9e Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 17 Oct 2025 05:46:13 +0200 Subject: [PATCH] Bug 38414: [22.11] backport to 22.11 Bug 38414: Fix permission controller-side This bug refactors the preview sql buttons to pass the permissions granted for each report to the javascript that clones and updates the modal. That allows us to check for the appropriate permissions when preparing the buttons for the modal and to remove any that are not allowed. This allows for different permissions per report for future devs (see bugs 42406, 16631) To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports We also fix some error in the script, several wrong things there: * delete was not replaced with cud-delete * missing op for the creation of new reports * update and run requires two permssions Signed-off-by: David Cook Signed-off-by: Nick Clemens Signed-off-by: Scott Barter Bug 38414: (follow-up) comprehensively cover ops with required permissions Test plan: 0. Apply the patch and restart_all 1. Using a user with only "create_reports", "execute_reports", or "delete_reports", try to perform operations not covered by that permission. That is, if you have "create_reports", try to run, export, and delete reports. If you have "execute_reports", try to create, modify, and delete reports If you have "delete_reports", try to create, modify, and run reports 2. Note that a user with each of these permissions can list and view SQL. Signed-off-by: David Cook Signed-off-by: Nick Clemens Bug 38414: (QA follow-up) Adjust templates Now that we can explicitly list reports with any one of the permissions we need to adjust some displays to ensure we can get to the list view. Additionally I change 'Use saved' to 'View saved' since we may not be able to run. I also fix the action buttons to show 'View' instead of 'Run' if user cannot execute. I adjust reports home to check if the user can use report plugins before showing that link as well Signed-off-by: Nick Clemens Bug 38414: (follow-up) Fix OR operator Signed-off-by: wainuiwitikapark --- .../prog/en/includes/guided-reports-view.inc | 4 ++-- .../prog/en/includes/reports-menu.inc | 2 +- .../en/modules/reports/guided_reports_start.tt | 7 +++++-- .../prog/en/modules/reports/reports-home.tt | 4 ++-- reports/guided_reports.pl | 18 +++++++++++------- 5 files changed, 21 insertions(+), 14 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/guided-reports-view.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/guided-reports-view.inc index 94b73fd44e..193fec1ad6 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/guided-reports-view.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/guided-reports-view.inc @@ -2,9 +2,9 @@