[Koha-bugs] [Bug 35800] New: edit_any_item permission required to see patron name in detail page

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35800

            Bug ID: 35800
           Summary: edit_any_item permission required to see patron name
                    in detail page
 Change sponsored?: ---
           Product: Koha
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5 - low
         Component: Staff interface
          Assignee: koha-bugs at lists.koha-community.org
          Reporter: caroline.cyr-la-rose at inlibro.com
        QA Contact: testopia at bugs.koha-community.org
                CC: gmcharlt at gmail.com

A staff member with limited permissions (mostly circulation-related) cannot see
the name of the patron who has checked out an item from the detail page, if the
patron is from another library, even if the staff member has
view_borrower_infos_from_any_libraries.

To recreate:
1. Check out an item to a patron from library A
2. Give permissions to a patron from library B
   (example of a circulation staff account)
     - circulate
     - catalogue
     - borrowers
     - reserveforothers
     - updatecharges
     - suggestions
     - lists
     - clubs -> enroll
3. If necessary, change the username and password of that staff member in order
to be able to log in
4. In a private browser window, log in as the staff member
5. View the record with the checked out item

--> Notice that it only says "Checked out" without any patron name

6. Back in the normal browser, give the additional permission "edit_any_item"
to the staff member
7. Refresh the page in the private window (Ctrl+F5)

--> Notice the name of the patron now appears

I don't think not having the option to edit items from any library should
impact the visibility of patron information. This should be managed by
view_borrower_infos_from_any_libraries.

With git bisect, I found that it was related to bug 33167, although I don't
understand what happened...

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.