Add a separate permission for bulk exporting vs individual exports

Created on 9 February 2023, about 2 years ago
Updated 15 May 2024, 11 months ago

Problem/Motivation

The Bibcite Export module provides one permission "access bibcite export" that controls access to export an individual reference in a specific format, but also to access the bulk forms for exporting multiple or all references (which are in /admin paths).

As a result, there's no way to provide someone to access the individual export links (which appear as reference links when viewing a reference and are commonly accessed by anonymous visitors) without also giving them access to admin actions of bulk exports.

Proposed resolution

Introduce a new permission for bulk exports that's separate from the "access bibcite export" permission.

✨ Feature request
Status

Needs review

Version

2.0

Component

Code

Created by

πŸ‡¨πŸ‡¦Canada igorbiki

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @igorbiki
  • πŸ‡¨πŸ‡¦Canada igorbiki

    Had to introduce new permission, access to bulk export. Previoulsy, user was required to have two permissions to access mass export (administer bibcite AND access bibcite export) this meant you need to grant adminster bibcite permission which has security implications.

    With new permission, you have a control over single entity export and mass export.

  • First commit to issue fork.
  • πŸ‡ΊπŸ‡ΈUnited States bkosborne New Jersey, USA

    bkosborne β†’ changed the visibility of the branch 3340674-improved-export-control to hidden.

  • Status changed to Needs work 11 months ago
  • πŸ‡ΊπŸ‡ΈUnited States bkosborne New Jersey, USA

    There's two separate issues here.

    1. The permission to control accessing the exported formats is controlled by the same permission as bulk export. This is problematic as you may want anonymous users to access the individual reference export links but not the administrative action for bulk exporting
    2. There's no access check on the export links that appear on the reference. The links to export in various formats are displayed even if the user doesn't have permission to export them

    Let's scope this issue to only the first problem as it's the simplest to solve. I see the patch tried to solve both, but the solution in the patch is not correct as it hides ALL links from showing if the user lacks the export permission, even though the export permission is only applicable to some of the links.

  • πŸ‡ΊπŸ‡ΈUnited States bkosborne New Jersey, USA

    Created ✨ Bibcite link plugins should support access checks Needs work to handle the issue where links are shown even if user doesn't have access to them.

  • Status changed to Needs review 11 months ago
  • πŸ‡ΊπŸ‡ΈUnited States bkosborne New Jersey, USA

    Okay, added the permission for bulk operations in a merge request.

  • πŸ‡ΊπŸ‡ΈUnited States bkosborne New Jersey, USA
Production build 0.71.5 2024