gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38414: Fix permission controller-side 

This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.

That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.

This allows for different permissions per report for future devs
(see bugs 42406, 16631)

To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports

We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Scott Barter <sbarter@aacpl.net>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2025-10-17 05:46:13 +02:00 committed by Lucas Gass
parent 44483cab32
commit b02e6c780b
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
View File

@ -388,7 +388,16 @@
></li
>
<li>
<a href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show" class="dropdown-item preview_sql" data-reportid="[% savedreport.id | html %]">
<a
[% # tags below to remove extra whitespace added for readability %]
[%- " "|$raw -%]href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show"
[%- " "|$raw -%]class="dropdown-item preview_sql"
[%- " "|$raw -%]data-reportid="[% savedreport.id | html %]"
[%- " "|$raw -%]data-create="[% CAN_user_reports_create_reports || 0 | html %]"
[%- " "|$raw -%]data-delete="[% CAN_user_reports_delete_reports || 0 | html %]"
[%- " "|$raw -%]data-run="[% CAN_user_reports_execute_reports || 0 | html %]"
[%- ""|$raw -%]
>
<i class="fa-solid fa-eye" aria-hidden="true"></i> Preview SQL
</a>
</li>

13
reports/guided_reports.pl
View File

@ -58,15 +58,18 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
my $op = $input->param('op') // '';
my $flagsrequired;
if ( ( $op eq 'add_form' )
|| ( $op eq 'add_form_sql' )
|| ( $op eq 'edit_form' )
|| ( $op eq 'duplicate' ) )
if ( $op eq 'add_form'
|| $op eq 'add_form_sql'
|| $op eq 'edit_form'
|| $op eq 'duplicate'
|| $op eq 'cud-save'
|| $op eq 'cud-update_sql'
|| $op eq 'cud-update_and_run_sql' )
{
$flagsrequired = 'create_reports';
} elsif ( $op eq 'list' ) {
$flagsrequired = 'execute_reports';
} elsif ( $op eq 'delete' ) {
} elsif ( $op eq 'cud-delete' ) {
$flagsrequired = 'delete_reports';
} else {
$flagsrequired = '*';