August 2016 - Koha-bugs - lists.koha-community.org

[Bug 10126] C4::Reports::Guided is not Plack safe
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10126 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |7172 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7172 [Bug 7172] Omnibus for Plack variable scoping problems -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7172] Omnibus for Plack variable scoping problems
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7172 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |10126 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10126 [Bug 10126] C4::Reports::Guided is not Plack safe -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #27 from Lari Taskula <larit(a)student.uef.fi> --- The patches went through heavy rebasing (now on top of master) and modifications. These patches fix wrong error messages, extend "allow-owner" functionality to be able to find out object owner from any parameter (not just borrowernumber like before), adds "allow-guarantor" that works similar to "allow-owner" but checks access for guarantor of the owner of the object instead, and adds some more tests that cover these changes. Meanwhile I also squashed "Rename 'x-koha-permission' to 'x-koha-authorization'" into "Give users possibility to request their own object". Because of heavy changes, I had to remove the sign-offs and would now be very interested to hear comments especially on the solution to find out object ownership from any parameter, and of course suggestions for a better solution if someone can come up with one. I think it's very useful to be able to define permissions in Swagger because it is now documented in your specification, and also permission checking is centralized into one place instead of duplicating it for nearly every operation in each controller. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14797] Cancelling orders with no alert to existing holds
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14797 --- Comment #3 from Ray Delahunty <r.delahunty(a)arts.ac.uk> --- This remains a problem in 3.20 (we move to 16.05 soon). As a workaround we have set up a report to be run whenever an order is cancelled, to look for reservations. We have added this to the homepage, and our cataloging / acquisitions staff can easily access it. SELECT o.ordernumber, b.title, b.author, p.surname, p.firstname, r.reservedate, r.cancellationdate, r.branchcode FROM reserves r LEFT JOIN borrowers p USING (borrowernumber) LEFT JOIN biblio b USING (biblionumber) LEFT JOIN aqorders o USING (biblionumber) LEFT JOIN aqbasket n using (basketno) WHERE o.ordernumber=<<Order number>> Better than nothing I suppose. Ray Delahunty University of the Arts London -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Lari Taskula <larit(a)student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52994|0 |1 is obsolete| | Attachment #52996|0 |1 is obsolete| | --- Comment #26 from Lari Taskula <larit(a)student.uef.fi> --- Created attachment 54459 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54459&action=ed… Bug 14868: Use x-koha-authorization in current routes To test: 1. Run t/db_dependent/api/v1/holds.t 2. Run t/db_dependent/api/v1/patrons.t -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Lari Taskula <larit(a)student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Lari Taskula <larit(a)student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52993|0 |1 is obsolete| | --- Comment #25 from Lari Taskula <larit(a)student.uef.fi> --- Created attachment 54458 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54458&action=ed… Bug 14868: Give users possibility to request their own object Allow access to user's own objects even if they do not have required permissions. This will be very useful in many cases where an user wants to request their own object, for example renewing their checkouts or placing a hold for themselves. First, this patch renames "x-koha-permission" to "x-koha-authorization" in order to describe the new functionality better. Second, we can now add two extra parameters under "x-koha-authorization": - "allow-owner"; Allows the owner of object to access it (without permission) - "allow-guarantor"; Allows guarantor of the owner of object to access it (without permission) Third, since permission checking is outside of actual controller, we need a way to find out ownership from different types of parameters, e.g. checkout_id from /checkouts/{checkout_id}, borrowernumber from /patrons/{borrowernumber} etc. A solution is to match the parameter with a subroutine that is designed to verify the ownership for that object. See the new subroutines in Koha::REST::V1. To use this functionality you will simply define it in Swagger: "/patrons/{borrowernumber}": { "get": { ..., "x-koha-authorization": { "allow-owner": true, "permissions": { "borrowers": "1" } } } } If a parameter that is not yet defined in Koha::REST::V1::check_object_ownership, you also need to define it and implement a subroutine that determines ownership. Tests are provided in a following patch that adds this functionality for current API operations. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Lari Taskula <larit(a)student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52992|0 |1 is obsolete| | --- Comment #24 from Lari Taskula <larit(a)student.uef.fi> --- Created attachment 54457 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54457&action=ed… Bug 14868: Swagger2-driven Permission checking Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically authorize against the required permissions. This way we immediately tell the API consumer in the Swagger2-definition, which permissions are needed to access defined resources. Also we don't need to maintain permissions in multiple locations and we can build a smart testing framework to help a lot in creating tests for the new REST API. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14434] OPAC should indicate to patrons that auto renewal will not work because hold has been placed
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14434 Holger Meißner <h.meissner.82(a)web.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |h.meissner.82(a)web.de Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14434] OPAC should indicate to patrons that auto renewal will not work because hold has been placed
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '16

15 Aug '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14434 --- Comment #3 from Holger Meißner <h.meissner.82(a)web.de> --- Created attachment 54455 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54455&action=ed… Bug 14434: Display "On hold" in OPAC for auto renewed items This patch makes the OPAC display "On hold" instead of "Automatic renewal" when a hold is placed. Test plan: 1) Issue an item with automatic renewal. 2) Place a hold on the item. 3) Log in as patron and note that the column "Renew" says "Automatic renewal (x of y renewals remaining)." 4) Apply patch. 5) Refresh OPAC and note that now "On hold" is displayed. 6) Cancel the hold, then log in as patron again and note that now "Automatic renewal (x of y renewals remaining)" is displayed once again. Sponsored-by: Hochschule für Gesundheit (hsg), Germany -- You are receiving this mail because: You are watching all bug changes.

1 0