- Koha-bugs - lists.koha-community.org

[Bug 35228] REST API: Restricted staff users can see patron extended attributes (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35228 --- Comment #1 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Look at the /patrons test in bug 35227. Now first add a patron attribute like bank account number. Now test with header x-koha-embed=extended_attributes Now Henry also gets: "extended_attributes": [ { "extended_attribute_id": 589, "type": "ACCTNO", "value": "123456" } Why did he get those? We are protecting our embeds now, right? to_api goes for the extended_attributes relation to _handle_to_api_child which will call to_api again for Koha/Patron/Attribute.pm. This module only has its own to_api_mapping, no more specific security there. Sub is_accessible from Object just returns 1. We need more protection for patron attributes. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #4 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Related thought: $patron->can_see_things_from feels too wide. We seem to need a context: which kind of things? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #3 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- What is the best way to move forward here? Some options to think about: [1] Just removing label_creator, routing and order_manage from GET patrons is probably too simple. We may need a list of patron IDs and a name for some of these associated forms. [2] Could we go via public_patrons.yaml somehow on those staff forms ? It sounds weird to do so for a staff form. [3] Be strictier in can_see_things_from. Currently, the can = 1 for own branch allows this to happen. But how to refine that check exactly ? What would be the impact on other calls ? Note: The following line on the set permissions forms is misleading: "View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. (view_borrower_infos_from_any_libraries)" This is not true. If you gave acevedo only the abovelisted permissions, he is not EVEN able to access his OWN account info on staff (but he can on OPAC). He cannot see other accounts at all. [4] Given that can_see_things_from should still return 1 when not touching that sub, could we refine with something similar to unredact_list that we do now only when is_accessible returns false ? We feel the need here to provide some columns for staff but not immediately all columns, say staff_read_list ? Your feedback is welcome. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #2 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Testing with user acevedo giving him label_creator and staff access. Fill few 'sensitive' fields like address, date_of_birth, email, mobile, staff_notes. Check results for /api/v1/patrons Acevedo received [partial output] for another patron (superlib): { "address": "Geheim adres", "cardnumber": "1", "category_id": "S", "check_previous_checkout": "inherit", "date_enrolled": "2023-11-02", "date_of_birth": "2000-11-01", "email": "secret(a)test.nl", "expiry_date": "2099-12-31", "firstname": "Koha", "lang": "default", "library_id": "MPL", "login_attempts": 0, "mobile": "p3", "patron_id": 1, "phone": "p1", "privacy": 1, "privacy_guarantor_checkouts": 0, "secondary_phone": "p2", "staff_notes": "circ_notes", "surname": "Admin", "updated_on": "2023-11-02T08:26:04+00:00", "userid": "koha.admin" }, How did the authorization go ? is_accessible => can_see_patron_infos => can_see_patrons_from => can_see_things_from + permission => 'borrowers', subpermission => 'view_borrower_infos_from_any_libraries', can_see_things_from RETURNS 1 for own branch ! In contrast to the POD line: Return true if the I<Koha::Patron> can perform some action on the given thing => The permission passed is only checked after if ( $self->branchcode eq $branchcode ) { $can = 1; -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 --- Comment #1 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Current API authorizations in this context: /patrons: get: x-koha-authorization: permissions: - borrowers: "edit_borrowers" - tools: "label_creator" - serials: "routing" - acquisition: "order_manage" post: x-koha-authorization: permissions: borrowers: edit_borrowers "/patrons/{patron_id}": get: x-koha-authorization: permissions: borrowers: edit_borrowers put: x-koha-authorization: permissions: borrowers: "1" delete: x-koha-authorization: permissions: borrowers: delete_borrowers -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 35228] REST API: Restricted staff users can see patron extended attributes (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35228 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=35227 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=35228 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 35228] REST API: Restricted staff users can see patron extended attributes (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35228 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|chris(a)bigballofwax.co.nz |koha-bugs(a)lists.koha-commun | |ity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35227] REST API: Restricted staff users can see patron info (not exposed via UI)
by bugzilla-daemon＠bugs.koha-community.org 02 Nov '23

02 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35227 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|chris(a)bigballofwax.co.nz |koha-bugs(a)lists.koha-commun | |ity.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 31077] New: Return claims won't load on details tab, when ClaimReturnedLostValue is empty
by bugzilla-daemon＠bugs.koha-community.org 01 Nov '23

01 Nov '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31077 Bug ID: 31077 Summary: Return claims won't load on details tab, when ClaimReturnedLostValue is empty Change sponsored?: --- Product: Koha Version: 20.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com When ClaimReturnedLostValue is empty, the tab with the number of open claims will show both on the checkouts and the details tab of the patron account in the staff interface, but on details, nothing will display when the tab is opened. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4