https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41921
--- Comment #95 from Lucas Gass (lukeg) <[email protected]> --- (In reply to Andrew Fuerste-Henry from comment #76) > Test plans do include testing the new permissions execute_reports_foreground > and execute_reports_background. These do not seem to be enforcing correctly. > > To recreate: > - set ReportsRunInBackground to "let the user choose" > - log in as a user with execute_reports_foreground but not > execute_reports_background > - run a report, see you are given both foreground and background options > ** we should not present the user with the background option when they don't > have the background permission. Ideally, they'd bypass the choice of run > method entirely as they only have one option ** > - click "Queue background job," not the job enqueues and runs successfully > ** in addition to not giving the user the background option, we should block > the job from enqueueing if they try to sneak it in by entering the url or > something ** > > - reverse your user's permissions so they do have background permissions but > do not have foreground permissions > - observe they are still able to run foreground reports > ** again, we should not present them with a choice of how to run and we > should block foreground reports that they attempt to run by some other means > ** > > - set ReportsRunInBackground to "always run in the foreground" > - your user still has background permission but not foreground > - confirm that they get a Run button and reports run in the foreground when > they click it > ** if the syspref is set to always foreground, users without foreground > permissions should not get a Run button and not be able to run any reports ** > > - set ReportsRunInBackground to "always run in the background" > - edit your user to have foreground permissions but not background > - confirm that they get a Run button and reports run in the foreground when > they click it > ** if the syspref is set to always background, users without background > permissions should not get a Run button and not be able to run any reports ** I should have read this all before supplying a patch. Maybe we need a subroutine to work out who can run a report based on the sys pref + the permissions. Then we could cover with unit test also -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
