gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38414: (follow-up) comprehensively cover ops with required permissions 

Test plan:
0. Apply the patch and restart_all

1. Using a user with only "create_reports", "execute_reports", or "delete_reports",
try to perform operations not covered by that permission.
That is, if you have "create_reports", try to run, export, and delete reports.
If you have "execute_reports", try to create, modify, and delete reports
If you have "delete_reports", try to create, modify, and run reports

2. Note that a user with each of these permissions can list and view SQL.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-04-23 02:20:36 +00:00 committed by Lucas Gass
parent b02e6c780b
commit 58dc77df6b
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
reports/guided_reports.pl
View File

@ -58,21 +58,38 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
my $op = $input->param('op') // '';
my $flagsrequired;
if ( $op eq 'add_form'
if (
$op eq 'add_form'
|| $op eq 'add_form_sql'
|| $op eq 'edit_form'
|| $op eq 'duplicate'
|| $op eq 'cud-report' #Guided wizard start
|| $op eq 'cud-choose_type'
|| $op eq 'cud-choose_columns'
|| $op eq 'cud-choose_criteria'
|| $op eq 'cud-choose_operations'
|| $op eq 'cud-build_report' #Guided wizard end
|| $op eq 'convert' #FIXME: This should be changed to cud-convert, although this feature is broken in main anyway
|| $op eq 'save' #FIXME: This appears to be unused currently. The template also has other unused ops in it...
|| $op eq 'cud-save'
|| $op eq
'cud-share' #FIXME: Sharing with Mana should probably have its own permission but this is the most logical one for now
|| $op eq 'cud-update_sql'
|| $op eq 'cud-update_and_run_sql' )
)
{
$flagsrequired = 'create_reports';
} elsif ( $op eq 'list' ) {
} elsif ( $op eq 'list' | $op eq 'show' ) {
$flagsrequired = [ 'create_reports', 'execute_reports', 'delete_reports' ]; #NOTE: "or" permissions
} elsif ( $op eq 'run' || $op eq 'export' || $op eq 'retrieve_results' ) {
$flagsrequired = 'execute_reports';
} elsif ( $op eq 'cud-update_and_run_sql' ) {
$flagsrequired = { 'create_reports' => 1, 'execute_reports' => 1 }; #NOTE: "and" permissions
} elsif ( $op eq 'cud-delete' ) {
$flagsrequired = 'delete_reports';
} else {
$flagsrequired = '*';
#NOTE: You should never get here
$flagsrequired = 1;
}
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(