From e472a7607f0672bb8cf497d656398abb34557078 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 17 Oct 2025 05:46:13 +0200 Subject: [PATCH] Bug 38414: Fix permission controller-side This bug refactors the preview sql buttons to pass the permissions granted for each report to the javascript that clones and updates the modal. That allows us to check for the appropriate permissions when preparing the buttons for the modal and to remove any that are not allowed. This allows for different permissions per report for future devs (see bugs 42406, 16631) To test: 1. Create some reports 2. Create a user with only execute_reports permissions 3. Login as that user and go to Reports > use saved 4. In the actions column click the ^ and select 'Preview sql' 5. Notice delete button renders and works to delete 6. Apply patch and restart_all 7. Repeat step 4, now only the Run report button renders and works 8. Add permissions for create_reports 9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work 10. Add permissions for delete_reports 11. Repeat step 4, confirm the delete button renders and works 12. Confirm the preview sql button works to preview different reports We also fix some error in the script, several wrong things there: * delete was not replaced with cud-delete * missing op for the creation of new reports * update and run requires two permssions Signed-off-by: David Cook Signed-off-by: Nick Clemens Signed-off-by: Scott Barter Signed-off-by: Lucas Gass --- .../modules/reports/guided_reports_start.tt | 61 ++++++++++++++----- reports/guided_reports.pl | 13 ++-- 2 files changed, 53 insertions(+), 21 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt index e5f543a3a5..494438dd9e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt @@ -421,7 +421,16 @@ >
  • - + Preview SQL
    • @@ -1611,7 +1620,9 @@
    - [% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %] + [% IF ( CAN_user_reports_create_reports && CAN_user_reports_execute_reports ) %] + [% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %] + [% END %] Cancel
    @@ -2541,8 +2552,8 @@ $("body").on("click", ".preview_sql", function (e) { e.preventDefault(); - var reportid = $(this).data("reportid"); - previewSql(reportid); + var report_data = $(this).data(); + previewSql(report_data); }); $(".limitselect").on("click", function () { var limit = $(this).data("limit"); @@ -2690,7 +2701,11 @@ } // Adapted from https://gist.github.com/jnormore/7418776 - function previewSql(reportid) { + function previewSql(report_data) { + var reportid = report_data.reportid; + var can_create = report_data.create; + var can_delete = report_data.delete; + var can_run = report_data.run; var message = $("#previewSql" + reportid).val(); var title = $("#previewSql" + reportid).data("title"); if ($("#preview-sql-modal").length > 0) { @@ -2709,18 +2724,32 @@ textContent: message, }); - clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form"; - clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid); - clone.querySelector('[data-placeholder="schedule-href"]').href = "/cgi-bin/koha/tools/scheduler.pl?id=" + encodeURIComponent(reportid); + if (can_run) { + clone.querySelector('[data-placeholder="run-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=run"; + clone.querySelector('[data-placeholder="schedule-href"]').href = "/cgi-bin/koha/tools/scheduler.pl?id=" + encodeURIComponent(reportid); + } else { + clone.querySelector("#preview-modal-runreport").remove(); + clone.querySelector("#preview-modal-schedule").remove(); + } - Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, { - id: reportid, - action: "guided_reports.pl", - method: "post", - op: "cud-delete", - }); + if (can_create) { + clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form"; + clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid); + } else { + clone.querySelector("#preview-modal-editreport").remove(); + clone.querySelector("#preview-modal-duplicate").remove(); + } - clone.querySelector('[data-placeholder="run-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=run"; + if (can_delete) { + Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, { + id: reportid, + action: "guided_reports.pl", + method: "post", + op: "cud-delete", + }); + } else { + clone.querySelector("#preview-modal-delete").remove(); + } document.body.appendChild(clone); @@ -2751,7 +2780,7 @@ Edit Duplicate Schedule - Delete [% INCLUDE 'throttled-button.inc' element_type='link' id='preview-modal-runreport' classes='btn btn-default' label=t('Run report') attrs={ 'data-placeholder' => 'run-href' } %] diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl index ec42f0f5ae..bc83de65df 100755 --- a/reports/guided_reports.pl +++ b/reports/guided_reports.pl @@ -58,15 +58,18 @@ my $usecache = Koha::Caches->get_instance->memcached_cache; my $op = $input->param('op') // ''; my $flagsrequired; -if ( ( $op eq 'add_form' ) - || ( $op eq 'add_form_sql' ) - || ( $op eq 'edit_form' ) - || ( $op eq 'duplicate' ) ) +if ( $op eq 'add_form' + || $op eq 'add_form_sql' + || $op eq 'edit_form' + || $op eq 'duplicate' + || $op eq 'cud-save' + || $op eq 'cud-update_sql' + || $op eq 'cud-update_and_run_sql' ) { $flagsrequired = 'create_reports'; } elsif ( $op eq 'list' ) { $flagsrequired = 'execute_reports'; -} elsif ( $op eq 'delete' ) { +} elsif ( $op eq 'cud-delete' ) { $flagsrequired = 'delete_reports'; } else { $flagsrequired = '*';