January 2018 - Koha-bugs - lists.koha-community.org

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 --- Comment #9 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 71093 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71093&action=ed… Bug 20100: Disallow access to superlibrarian privileges at client side This last patch activates the check at client side. If the pref ProtectSuperlibPrivs is enabled, non-superlibs should not be able to change superlibrarian privileges via the interface. Test plan: [1] Enable the pref. [2] Login as superlib and add/remove superlib privs to a staff user. [3] Login as another user (no superlib, but having borrowers, permissions and staff_access). Verify that you cannot add or remove superlib privs. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 --- Comment #8 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 71092 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71092&action=ed… Bug 20100: Disallow access to superlib privileges at server side Depends on pref ProtectSuperlibPrivs. If enabled, script member-flags.pl will not allow you to add or remove superlib privs when you are no superlibrarian. The follow-up patch will enable the check at client side. Test plan: [1] Enable the pref. Do not apply the third patch (client side). [2] Login as superlib and add/remove superlib privs to a staff user. [3] Login as another user (no superlib, but having borrowers, permissions and staff_access). Verify that you have an internal server error when you add or remove superlib privs. The log contains a warning. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 --- Comment #7 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 71091 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71091&action=ed… Bug 20100: Introduce preference ProtectSuperlibPrivs This pref allows you to block changes to superlibrarian privileges at client and server side for non-superlibrarians. This patch only contains the db rev and the preference description. Test plan: Run dbrev or new install. Check pref value. Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11827] Untranslatable "Cancel Rating" in jQuery rating plugin
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11827 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #2 from Owen Leonard <oleonard(a)myacpl.org> --- This looks fine, and works correctly. I request one small fix: Our capitalization rules (https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML4:_Upper_and_low…) say that only the first letter of the first word should be capitalized. I realize that the patch matches what the plugin has in its code, but we should follow the rules if we're adding it to our template. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 --- Comment #6 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Katrin Fischer from comment #5) > Hm, so you could only add one using the onboarding tool then or by > deactivating the pref? A superlib can always add another one. The point is that a non-superlib should not be able to do so (imo). -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 --- Comment #5 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Hm, so you could only add one using the onboarding tool then or by deactivating the pref? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12932] Web installer's Perl version check will not raise errors if all modules are installed
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12932 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #71073|0 |1 is obsolete| | --- Comment #4 from Owen Leonard <oleonard(a)myacpl.org> --- Created attachment 71087 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71087&action=ed… Bug 12932: When all modules installed, Perl version check ignored The description in comment #0 is quite true, because the scope of the $checkmodule variable is local to just the module checking. If we change the scope, we can include the perl check as part of the new scope, and thus properly set its value. As Debian Jessie, Stretch and Ubuntu Xenial all have good versions of Perl by default, the easiest way to test this is to: - make sure to have some optional modules not installed. - change the system preference 'Version' to one just under the current version in your SQL client. - modify the version check line to 5.030000 - restart_all and try going to the staff client. -- This should not inform you that your perl version is bad. - git reset hard back to origin/master - apply the patch - modify the version check line to 5.030000 - change the system preference 'Version' to one just under the current version in your SQL client. - restart_all and try going to the staff client. -- This should trigger the patch, and you should be informed your perl version is bad. - git reset hard back to origin/master - apply the patch - run koha qa test tools Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12932] Web installer's Perl version check will not raise errors if all modules are installed
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12932 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] Should a non-superlibrarian be able to add superlibrarian privileges?
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement Summary|A non-superlibrarian should |Should a non-superlibrarian |not be able to add |be able to add |superlibrarian privileges |superlibrarian privileges? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20100] A non-superlibrarian should not be able to add superlibrarian privileges
by bugzilla-daemon＠bugs.koha-community.org 31 Jan '18

31 Jan '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20100 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Koha |Patrons Product|Koha security |Koha QA Contact| |testopia(a)bugs.koha-communit | |y.org Group|Koha security | Version|unspecified |master CC| |gmcharlt(a)gmail.com, | |kyle.m.hall(a)gmail.com --- Comment #4 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Thx for responding, Jonathan and Katrin. Your response tell me at least that there is no need to keep this report under Security. I am thinking of an approach to hide superlib privs from non-superlibs based on a preference or so. -- You are receiving this mail because: You are watching all bug changes.

1 0