Koha-clms/reports
David Cook 5af39bac74 Bug 18898 - Some permissions for Reports can be bypassed
If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2fdfbaf0dd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4b71c92397)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Conflicts:
	reports/guided_reports.pl
2017-09-20 14:00:04 +12:00
..
acquisitions_stats.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
bor_issues_top.pl Bug 17925: Disable debugging in reports/bor_issues_top.pl 2017-05-24 14:26:25 +12:00
borrowers_out.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
borrowers_stats.pl Bug 8306: Patrons statistics, fix for patron activity choice 2017-02-23 09:36:22 +13:00
cat_issues_top.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
catalogue_out.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
catalogue_stats.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
dictionary.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
guided_reports.pl Bug 18898 - Some permissions for Reports can be bypassed 2017-09-20 14:00:04 +12:00
issues_avg_stats.pl Bug 13452: Fix for plack 2017-07-31 01:02:05 +12:00
issues_by_borrower_category.plugin Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
issues_stats.pl Bug 16760: fix Circulation Statistics wizard under Plack 2016-08-01 10:37:35 +02:00
itemslost.pl Bug 14965: Remove C4::Dates from 'lists' in folder reports 2015-11-05 09:56:52 -03:00
itemtypes.plugin Bug 14100: (follow-up) Language overlay for item types 2015-10-27 12:34:06 -03:00
manager.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
orders_by_fund.pl Bug 16594: Fix obvious QA issues from bug 11371 2016-06-24 07:30:29 +02:00
reports-home.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
reserves_stats.pl Bug 17931: Remove unused vars from reserves_stats 2017-01-25 14:40:02 +13:00
serials_stats.pl Bug 14961: Remove C4::Dates from files reports/*_stats.pl 2015-10-26 11:19:36 -03:00
stats.print.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
stats.screen.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00