privilege "edit concepts" not in core

teleivo · September 12, 2016, 2:11pm

Hello!

in the legacyui I see that the privilege “Edit Concepts” is often required to access a page.

openmrs/openmrs-module-legacyui/blob/master/omod/src/main/webapp/admin/concepts/conceptSetDerivedForm.jsp#L3


<%@ include file="/WEB-INF/view/module/legacyui/template/include.jsp" %>


<openmrs:require privilege="Manage Concepts" otherwise="/login.htm" redirect="/admin/concepts/conceptSetDerived.form" />


<%@ include file="/WEB-INF/view/module/legacyui/template/header.jsp" %>
<%@ include file="localHeader.jsp" %>


<h2><openmrs:message code="ConceptSetDerived.title"/></h2>


<form method="post">
	<openmrs:message code="ConceptSetDerived.instructions"/>
	<br/><br/>
	<openmrs:message code="ConceptSetDerived.conceptId"/> <input type="text" name="conceptId"> <openmrs:message code="ConceptSetDerived.conceptId.optional"/><br/><br/>

However its not added via the https://github.com/openmrs/openmrs-core/blob/2.0.x/api/src/main/java/org/openmrs/util/PrivilegeConstants.java

Should it be? Or is adding the privilege part of the implementers job?

darius · September 12, 2016, 3:24pm

I don’t ever remember there being an “Edit Concepts” privilege; it’s supposed to be “Manage Concepts”.

(Searching github implies that maybe Edit Concepts did exist from versions 1.3.0.12 to 1.3.0.14 of the platform, back in 2008…)

So, I think the fix is to change the UI code to check for Manage Concepts rather than Edit Concepts.

teleivo · September 13, 2016, 8:38am

Thanks @darius !!

Do you also know why the “Purge xxx” privileges do not have the @AddOnStartup in

github.com

openmrs/openmrs-core/blob/2.0.x/api/src/main/java/org/openmrs/util/PrivilegeConstants.java#L351-L353


	public static final String PURGE_CONCEPT_REFERENCE_TERMS = "Purge Concept Reference Terms";
	
	public static final String PURGE_CONCEPT_SOURCES = "Purge Concept Sources";

?

They are required in the API to purge concepts, - sources, - reference terms.

So giving a user the “Manage xxx” privileges is enough to add/edit/retire but not to purge. The implementer would need to add this privilege himself at the moment.

darius · September 13, 2016, 1:53pm

Sorry, I don’t remember the exact reasoning behind this.

Speculating, we were probably thinking that we want to make purging hard to do, and nudge people to just retire/delete, so this was an extra hoop that people would have to jump through.

-Darius

dkayiwa · September 13, 2016, 2:07pm

Just in case: https://marc.info/?l=openmrs-dev&m=139455164015860&q=raw

teleivo · September 13, 2016, 2:09pm

nice! good to know