From 1da4dcec000ba4cef13d4e66c6ccfeadf41824f0 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 21 May 2026 12:23:06 -0400
Subject: [PATCH] Bug 42667: Hide edit controls as needed

Test plan:
1) Apply this patch set
2) Run updatedatabase.pl
3) Restart all the things!
4) Create 2 users with create_reports and not edit_all_reports
5) Create reports with each
6) Note that each cannot edit the others reports
7) Create a user with create_reports and edit_all_reports
8) Note the this user can edit reports from the previous two users

Edit button placements to look for:
* Reports table row
* Actions menu
* Toolbar

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 .../intranet-tmpl/prog/en/includes/reports-toolbar.inc   | 8 +++++---
 .../prog/en/modules/reports/guided_reports_start.tt      | 9 +++++++--
 reports/guided_reports.pl                                | 1 +
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
index 3181e8c28c..2d39bfe6f6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
@@ -28,9 +28,11 @@
                     <ul class="dropdown-menu">
                         [% IF ( CAN_user_reports_create_reports ) %]
                             [% UNLESS ( editsql ) # Do not show edit button on edit page %]
-                                <li>
-                                    <a class="dropdown-item" id="editreport" href="/cgi-bin/koha/reports/guided_reports.pl?id=[% id | html %]&amp;op=edit_form"> Edit </a>
-                                </li>
+                                [% IF ( CAN_user_reports_edit_all_reports || report_creator == loggedinusernumber ) %]
+                                    <li>
+                                        <a class="dropdown-item" id="editreport" href="/cgi-bin/koha/reports/guided_reports.pl?id=[% id | html %]&amp;op=edit_form"> Edit </a>
+                                    </li>
+                                [% END %]
                             [% END %]
                             <li>
                                 <a class="dropdown-item" title="Duplicate this saved report" href="/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&amp;id=[% id | uri %]"> Duplicate </a>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index aeba39d2f5..dbdc4cbc4e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -2764,6 +2764,7 @@
         function previewSql(report_data) {
             var reportid = report_data.reportid;
             var can_create = report_data.create;
+            var can_edit = report_data.edit;
             var can_delete = report_data.delete;
             var can_run = report_data.run;
             var message = $("#previewSql" + reportid).val();
@@ -2792,11 +2793,15 @@
                 clone.querySelector("#preview-modal-schedule").remove();
             }
 
-            if (can_create) {
+            if (can_edit) {
                 clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form";
-                clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid);
             } else {
                 clone.querySelector("#preview-modal-editreport").remove();
+            }
+
+            if (can_create) {
+                clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid);
+            } else {
                 clone.querySelector("#preview-modal-duplicate").remove();
             }
 
diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl
index 410752d13c..124f53e29d 100755
--- a/reports/guided_reports.pl
+++ b/reports/guided_reports.pl
@@ -912,6 +912,7 @@ if ( $op eq 'run' ) {
         $sql   = $original_sql = $report->savedsql;
         $name  = $report->report_name;
         $notes = $report->notes;
+        $template->param( report_creator => $report->borrowernumber );
 
         my @rows    = ();
         my @allrows = ();