- Koha-bugs - lists.koha-community.org

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #6 from David Cook <dcook(a)prosentient.com.au> --- I think sometimes we've been a bit too abstract in the design of the API, and we don't really have a good authorization model for Koha anyway, so it's no surprise that we have wound up in this situation. -- Looking at the description of 'tools: "label_creator"' it says: "Create printable labels and barcodes from catalog and patron data (label_creator)" so maybe it's no surprise it has unlimited access to patron data... But 'serials: "routing"' and 'acquisition: "order_manage"' don't mention patrons at all in their permission descriptions. >From an API perspective, I think the end point should be something more like "/patrons/search" and then you send it a search and your view is dependent on your permissions. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #5 from David Cook <dcook(a)prosentient.com.au> --- This is an interesting one. Semes that the problem comes from bug 30055. It looks like you can also hack the UI to show things like dateofbirth, address, and phone: http://localhost:8081/cgi-bin/koha/members/search.pl?columns=checkbox,addre… koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc enumerates the options so in theory it could be controlled there. But the different modules are using the same generic Perl search script so it can't can't really lock it down. We could re-create different Perl controllers for the different searches. They can re-use the "members/search.tt" template to reduce code duplication. However... that would only fix the UI problem I note above. It still doesn't solve the issue Marcel notes. I think that different REST API endpoints need to be used so that we can have module by module authorizations. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas(a)bywatersolutions.com --- Comment #29 from Lucas Gass <lucas(a)bywatersolutions.com> --- This works well so I am signing off. In the future it would be nice to have a verbose mode and the ability to limit by branch. But as is this is good and should not have been 2 years in NSO. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #130103|0 |1 is obsolete| | --- Comment #28 from Lucas Gass <lucas(a)bywatersolutions.com> --- Created attachment 158292 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158292&action=e… Bug 15157: Add my $amount and fix options Variable my $amount was missing. Also option amount has to be declared as integer and option confirm is no longer string. Sponsored by: Koha-Suomi Oy Signed-off-by: Lucas Gass <lucas(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #129704|0 |1 is obsolete| | --- Comment #27 from Lucas Gass <lucas(a)bywatersolutions.com> --- Created attachment 158291 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158291&action=e… Bug 15157: (follow-up) Add ability to set lower limit Signed-off-by: Lucas Gass <lucas(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #129703|0 |1 is obsolete| | --- Comment #26 from Lucas Gass <lucas(a)bywatersolutions.com> --- Created attachment 158290 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158290&action=e… Bug 15157: Modernise and Update for bug 15156 This patch updates the script to use filter_by_amount_owed, renames it to debar_patrons_with_fines.pl and moves it to the cronjobs directory whilst also adding a copyright notice and POD. We could add a series of options to the script to allow more fine grained control. Signed-off-by: Lucas Gass <lucas(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #129702|0 |1 is obsolete| | --- Comment #25 from Lucas Gass <lucas(a)bywatersolutions.com> --- Created attachment 158289 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158289&action=e… Bug 15157: Update script This patch updates debarrBorrowersWithFines.pl script to match changes made in bug 15156. To test: 1. Have patron(s) with unpaid fines 2. Run e.g debarrBorrowersWithFines.pl --confirm -m "This is a description of you bad deeds" (test other options too) 3. Confirm patron(s) with fines has been debarred with the explanation Sponsored-by: Koha-Suomi Oy Signed-off-by: Lucas Gass <lucas(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #129701|0 |1 is obsolete| | --- Comment #24 from Lucas Gass <lucas(a)bywatersolutions.com> --- Created attachment 158288 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=158288&action=e… Bug 15157: Cronjob to debar Patrons with unpaid accountlines If your library wants to debar all Borrower who haven't paid their fines by the end of the year, this script will do that trick :) You can give the message from a file if the cronjob runner doesn't deal with quotes, or as a command-line parameter. Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> Signed-off-by: Lucas Gass <lucas(a)bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15157] Cronjob to automatically debar Borrowers/Patrons with pending/unpaid fines/accountlines
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15157 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 10744] ExpireReservesMaxPickUpDelay works with hold(s) over report
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10744 Lucas Gass <lucas(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |BLOCKED CC| |lucas(a)bywatersolutions.com --- Comment #14 from Lucas Gass <lucas(a)bywatersolutions.com> --- Marking this as BLOCKED until its dependencies can be resolved. -- You are receiving this mail because: You are watching all bug changes.

1 0