[Bug 34971] New: Permission to close a serial subscription
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Bug ID: 34971 Summary: Permission to close a serial subscription Change sponsored?: --- Product: Koha Version: 22.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Serials Assignee: koha-bugs@lists.koha-community.org Reporter: pierre.genty@biblibre.com QA Contact: testopia@bugs.koha-community.org Hi, With only receive_serials permission it is possible to close a serial subscription. This should require edit_subscription permission. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal CC| |fridolin.somers@biblibre.co | |m -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=29608 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |baptiste.wojtkowski@biblibr | |e.com --- Comment #1 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- It looks like it has been corrected on main but I cannot figure out why -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #2 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 168461 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168461&action=edit Bug 34971: Permission to close a serial subscription (edit) TEST PLAN (for 22.11): Before applying patch : 1 - log in as a user with only receive_serial right 2 - Select a serial 3 - Try to close it -> you can 4 - try to reopen the closed serial -> you can 5 - Make sure you have one opened and one closed serial Apply patch 6 - Try to close a serial -> you cannot 7 - Try to reopen a closed serial -> you cannot As a user that has the right delete_subscription: 8 - Try to delete the subscription -> you can (non regression test) Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights. Note : this should also be tested for superior version -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37247 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Assignee|koha-bugs@lists.koha-commun |baptiste.wojtkowski@biblibr |ity.org |e.com --- Comment #3 from David Nind <david@davidnind.com> --- Added assignee. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #4 from David Nind <david@davidnind.com> --- Created attachment 175972 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175972&action=edit Screenshots - Close serials permissions I had a go at testing (using koha-testing-docker) on 22.11.22 and on main. What I found: 1. On 22.11.22: - there is a "Close" button only on the serial collection page - you can close a serial - I couldn't get the patch to apply on 22.11.22 (I got a weird error I've never seen before), so I couldn't test the patch 2. On main: - same as 22.11.22, there is "Close" button only on the serial collection page - you can close a serial - after the patch (which applies on main), the "Close" button is still there on the serial collection page - if you click "Close" you get the login screen with "Error: You do not have permission to access this page.” I've attached a document with screenshots, hopefully that will make it easier to see what I saw. I've changed to Failed QA, as: - It isn't fixed on main. - I think the "Close" button shouldn't be there on the serial collection page if you don't have the correct permissions. - As an aside, I don't think the "Manage frequencies" and "Manage numbering patterns" menu items should be shown if the staff patron doesn't have the correct permissions (this should probably be another bug). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #5 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 175997 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175997&action=edit Bug 34971: Fix reopen button display on serial-collection Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #6 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 175998 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175998&action=edit Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168461|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #7 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Note: No patch for 22.11 anymore since I could reproduce and test on main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|22.11 |Main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #175997|0 |1 is obsolete| | --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 176040 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176040&action=edit Bug 34971: Fix reopen button display on serial-collection Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #175998|0 |1 is obsolete| | --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 176041 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176041&action=edit Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes the serials release notes| |receiving (receive_serials) | |permission - staff that | |only have this permission | |can now only receive | |serials, and can no longer | |(incorrectly) close a | |subscription. Previously, | |the "Close" action was | |incorrectly shown on the | |subscription details page | |and this allowed staff to | |close (but not reopen) a | |subscription (Serials > | |Search > [select a serial | |from the results] > | |Subscriptions detail page | |for a serial). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #176040|0 |1 is obsolete| | Attachment #176041|0 |1 is obsolete| | --- Comment #10 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 177582 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177582&action=edit Bug 34971: Fix reopen button display on serial-collection Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #11 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 177583 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177583&action=edit Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #12 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 177584 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177584&action=edit Bug 34971: (QA follow-up) Op is now cud-reopen Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Permission to close a |Closing a subscription |serial subscription |should require | |edit_subscription | |permission QA Contact|testopia@bugs.koha-communit |nick@bywatersolutions.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00 |25.05.00,24.11.08 released in| | --- Comment #14 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Pushed into 24.11.x for 24.11.08 nice work everyone -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #15 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #16 from David Nind <david@davidnind.com> --- Bug fix, no updates to the manual required. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34971 Janusz Kaczmarek <januszop@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42681 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42681 [Bug 42681] (Bug 34971 follow-up) serials/serials-collection.pl generates error 500 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org