diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt index 166c8fac65..aeba39d2f5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt @@ -261,6 +261,9 @@ [% WRAPPER 'main-container.inc' aside_block=aside %] [% INCLUDE "reports-toolbar.inc" %] + [% INCLUDE 'messages.inc' %] + [% INCLUDE 'blocking_errors.inc' %] + [% IF access_denied %]

Access denied

diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl index b92f92750b..410752d13c 100755 --- a/reports/guided_reports.pl +++ b/reports/guided_reports.pl @@ -36,6 +36,7 @@ use Koha::AuthorisedValues; use Koha::BiblioFrameworks; use Koha::Libraries; use Koha::Patron::Categories; +use Koha::Patrons; use Koha::SharedContent; use Koha::Util::OpenDocument qw( generate_ods ); use Koha::Notice::Templates; @@ -109,6 +110,16 @@ my $can_manage_report_limits = $logged_in_user && Koha::Report->can_manage_limit $template->param( templates => Koha::Notice::Templates->search( { module => 'report' } ) ); +# Editing a report owned by another librarian, or an ownerless report, +# requires the edit_all_reports permission +if ( $op eq 'edit_form' || $op eq 'cud-update_sql' || $op eq 'cud-update_and_run_sql' ) { + my $report = Koha::Reports->find( scalar $input->param('id') ); + if ( $report && ( !$report->borrowernumber || $report->borrowernumber != $borrowernumber ) ) { + output_and_exit( $input, $cookie, $template, 'insufficient_permission' ) + unless Koha::Patrons->find($borrowernumber)->has_permission( { reports => 'edit_all_reports' } ); + } +} + my $filter; if ( $input->param("filter_set") or $input->param('clear_filters') ) { $filter = {};