Bug 38414: Fix permission controller-side
This bug refactors the preview sql buttons to pass the permissions granted for each report to the javascript that clones and updates the modal. That allows us to check for the appropriate permissions when preparing the buttons for the modal and to remove any that are not allowed. This allows for different permissions per report for future devs (see bugs 42406, 16631) To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports We also fix some error in the script, several wrong things there: * delete was not replaced with cud-delete * missing op for the creation of new reports * update and run requires two permssions Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Scott Barter <sbarter@aacpl.net> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart
Lucas Gass
parent
6a5b68552c
commit
e472a7607f
|
|
@ -421,7 +421,16 @@
|
|||
></li
|
||||
>
|
||||
<li>
|
||||
<a href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show" class="dropdown-item preview_sql" data-reportid="[% savedreport.id | html %]">
|
||||
<a
|
||||
[% # tags below to remove extra whitespace added for readability %]
|
||||
[%- " "|$raw -%]href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show"
|
||||
[%- " "|$raw -%]class="dropdown-item preview_sql"
|
||||
[%- " "|$raw -%]data-reportid="[% savedreport.id | html %]"
|
||||
[%- " "|$raw -%]data-create="[% CAN_user_reports_create_reports || 0 | html %]"
|
||||
[%- " "|$raw -%]data-delete="[% CAN_user_reports_delete_reports || 0 | html %]"
|
||||
[%- " "|$raw -%]data-run="[% CAN_user_reports_execute_reports || 0 | html %]"
|
||||
[%- ""|$raw -%]
|
||||
>
|
||||
<i class="fa-solid fa-eye" aria-hidden="true"></i> Preview SQL
|
||||
</a>
|
||||
</li>
|
||||
|
|
@ -1611,7 +1620,9 @@
|
|||
|
||||
<fieldset class="action">
|
||||
<button class="btn btn-primary" type="submit" name="op" value="cud-update_sql">Update SQL</button>
|
||||
[% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %]
|
||||
[% IF ( CAN_user_reports_create_reports && CAN_user_reports_execute_reports ) %]
|
||||
[% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %]
|
||||
[% END %]
|
||||
<a href="/cgi-bin/koha/reports/guided_reports.pl?op=list" class="cancel">Cancel</a>
|
||||
</fieldset>
|
||||
</form>
|
||||
|
|
@ -2541,8 +2552,8 @@
|
|||
|
||||
$("body").on("click", ".preview_sql", function (e) {
|
||||
e.preventDefault();
|
||||
var reportid = $(this).data("reportid");
|
||||
previewSql(reportid);
|
||||
var report_data = $(this).data();
|
||||
previewSql(report_data);
|
||||
});
|
||||
$(".limitselect").on("click", function () {
|
||||
var limit = $(this).data("limit");
|
||||
|
|
@ -2690,7 +2701,11 @@
|
|||
}
|
||||
|
||||
// Adapted from https://gist.github.com/jnormore/7418776
|
||||
function previewSql(reportid) {
|
||||
function previewSql(report_data) {
|
||||
var reportid = report_data.reportid;
|
||||
var can_create = report_data.create;
|
||||
var can_delete = report_data.delete;
|
||||
var can_run = report_data.run;
|
||||
var message = $("#previewSql" + reportid).val();
|
||||
var title = $("#previewSql" + reportid).data("title");
|
||||
if ($("#preview-sql-modal").length > 0) {
|
||||
|
|
@ -2709,18 +2724,32 @@
|
|||
textContent: message,
|
||||
});
|
||||
|
||||
clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form";
|
||||
clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid);
|
||||
clone.querySelector('[data-placeholder="schedule-href"]').href = "/cgi-bin/koha/tools/scheduler.pl?id=" + encodeURIComponent(reportid);
|
||||
if (can_run) {
|
||||
clone.querySelector('[data-placeholder="run-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=run";
|
||||
clone.querySelector('[data-placeholder="schedule-href"]').href = "/cgi-bin/koha/tools/scheduler.pl?id=" + encodeURIComponent(reportid);
|
||||
} else {
|
||||
clone.querySelector("#preview-modal-runreport").remove();
|
||||
clone.querySelector("#preview-modal-schedule").remove();
|
||||
}
|
||||
|
||||
Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, {
|
||||
id: reportid,
|
||||
action: "guided_reports.pl",
|
||||
method: "post",
|
||||
op: "cud-delete",
|
||||
});
|
||||
if (can_create) {
|
||||
clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form";
|
||||
clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid);
|
||||
} else {
|
||||
clone.querySelector("#preview-modal-editreport").remove();
|
||||
clone.querySelector("#preview-modal-duplicate").remove();
|
||||
}
|
||||
|
||||
clone.querySelector('[data-placeholder="run-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=run";
|
||||
if (can_delete) {
|
||||
Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, {
|
||||
id: reportid,
|
||||
action: "guided_reports.pl",
|
||||
method: "post",
|
||||
op: "cud-delete",
|
||||
});
|
||||
} else {
|
||||
clone.querySelector("#preview-modal-delete").remove();
|
||||
}
|
||||
|
||||
document.body.appendChild(clone);
|
||||
|
||||
|
|
@ -2751,7 +2780,7 @@
|
|||
<a id="preview-modal-editreport" class="btn btn-default" data-placeholder="edit-href"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
|
||||
<a id="preview-modal-duplicate" class="btn btn-default" data-placeholder="duplicate-href"><i class="fa fa-copy" aria-hidden="true"></i> Duplicate</a>
|
||||
<a id="preview-modal-schedule" class="btn btn-default" data-placeholder="schedule-href"><i class="fa-solid fa-clock" aria-hidden="true"></i> Schedule</a>
|
||||
<a class="btn btn-default submit-form-link" href="#" data-placeholder="delete-attrs" data-confirmation-msg="[% t('Are you sure you want to delete this report?') | html %]"
|
||||
<a id="preview-modal-delete" class="btn btn-default submit-form-link" href="#" data-placeholder="delete-attrs" data-confirmation-msg="[% t('Are you sure you want to delete this report?') | html %]"
|
||||
><i class="fa fa-trash-can" aria-hidden="true"></i> Delete</a
|
||||
>
|
||||
[% INCLUDE 'throttled-button.inc' element_type='link' id='preview-modal-runreport' classes='btn btn-default' label=t('Run report') attrs={ 'data-placeholder' => 'run-href' } %]
|
||||
|
|
|
|||
|
|
@ -58,15 +58,18 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
|
|||
|
||||
my $op = $input->param('op') // '';
|
||||
my $flagsrequired;
|
||||
if ( ( $op eq 'add_form' )
|
||||
|| ( $op eq 'add_form_sql' )
|
||||
|| ( $op eq 'edit_form' )
|
||||
|| ( $op eq 'duplicate' ) )
|
||||
if ( $op eq 'add_form'
|
||||
|| $op eq 'add_form_sql'
|
||||
|| $op eq 'edit_form'
|
||||
|| $op eq 'duplicate'
|
||||
|| $op eq 'cud-save'
|
||||
|| $op eq 'cud-update_sql'
|
||||
|| $op eq 'cud-update_and_run_sql' )
|
||||
{
|
||||
$flagsrequired = 'create_reports';
|
||||
} elsif ( $op eq 'list' ) {
|
||||
$flagsrequired = 'execute_reports';
|
||||
} elsif ( $op eq 'delete' ) {
|
||||
} elsif ( $op eq 'cud-delete' ) {
|
||||
$flagsrequired = 'delete_reports';
|
||||
} else {
|
||||
$flagsrequired = '*';
|
||||
|
|
|
|||
Loading…
Reference in New Issue