gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42667: Require edit_all_reports to edit other librarian's reports 

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
Kyle M Hall 2026-05-21 12:12:55 -04:00 committed by Pedro Amorim
parent d2fa6156fd
commit df282a5f89
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
View File

@ -261,6 +261,9 @@
[% WRAPPER 'main-container.inc' aside_block=aside %]
[% INCLUDE "reports-toolbar.inc" %]
[% INCLUDE 'messages.inc' %]
[% INCLUDE 'blocking_errors.inc' %]
[% IF access_denied %]
<div>
<h1>Access denied</h1>

11
reports/guided_reports.pl
View File

@ -36,6 +36,7 @@ use Koha::AuthorisedValues;
use Koha::BiblioFrameworks;
use Koha::Libraries;
use Koha::Patron::Categories;
use Koha::Patrons;
use Koha::SharedContent;
use Koha::Util::OpenDocument qw( generate_ods );
use Koha::Notice::Templates;
@ -109,6 +110,16 @@ my $can_manage_report_limits = $logged_in_user && Koha::Report->can_manage_limit
$template->param( templates => Koha::Notice::Templates->search( { module => 'report' } ) );
# Editing a report owned by another librarian, or an ownerless report,
# requires the edit_all_reports permission
if ( $op eq 'edit_form' || $op eq 'cud-update_sql' || $op eq 'cud-update_and_run_sql' ) {
my $report = Koha::Reports->find( scalar $input->param('id') );
if ( $report && ( !$report->borrowernumber || $report->borrowernumber != $borrowernumber ) ) {
output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
unless Koha::Patrons->find($borrowernumber)->has_permission( { reports => 'edit_all_reports' } );
}
}
my $filter;
if ( $input->param("filter_set") or $input->param('clear_filters') ) {
$filter = {};