[Bug 13910] New: Prevent delete of one's own patron account
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Bug ID: 13910 Summary: Prevent delete of one's own patron account Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com When deleting accounts, it should be impossible to delete one's own borrower account. Over the years, I've had a few librarians accidentally delete themselves and lock themselves out of Koha. I suppose there are quite a few ways this could be implemented. I don't have a patch yet, but this report here is mostly a placeholder for when I do... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Sheila Kearns <sheila.kearns@state.vt.us> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sheila.kearns@state.vt.us --- Comment #1 from Sheila Kearns <sheila.kearns@state.vt.us> --- It may be a different area of permissions, but it would also be useful if permission to delete patrons was separate from permissions to add and modify patrons. Circulation staff need to add and modify, but an option to prevent them from deleting patrons would be usefuo. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #2 from Marc Véron <veron@veron.ch> --- Created attachment 38469 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38469&action=edit Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff CC| |veron@veron.ch Assignee|koha-bugs@lists.koha-commun |veron@veron.ch |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=10910 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=10909 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA CC| |jonathan.druart@biblibre.co | |m --- Comment #3 from Jonathan Druart <jonathan.druart@biblibre.com> --- Set ExportWithCsvProfile and the export column won't appear anymore with your patch. It's certainly related to this change: +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ -1,4 +1,4 @@ -[% USE Koha %] + Why did you remove that? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #38469|0 |1 is obsolete| | --- Comment #4 from Marc Véron <veron@veron.ch> --- Created attachment 38629 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38629&action=edit Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. --- Amended to restore accidentally removed line in moremember.tt, see comment #3 /mv -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #38629|0 |1 is obsolete| | --- Comment #5 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 38638 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38638&action=edit Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #6 from Jonathan Druart <jonathan.druart@biblibre.com> --- Comment on attachment 38638 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38638 Bug 13910 - Prevent delete of one's own patron account Review of attachment 38638: --> (http://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=13910&attachment=38638) ----------------------------------------------------------------- ::: koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ +144,3 @@
[% IF ( error ) %] <div class="dialog alert"> + [% IF ( error == 'AUTH_UPDATE_FAILED' ) %]
I don't manager to trigger this one. Looking at the code, it is never set. I would prefer not to see this one changed in this bug report but remove in its own bug. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #7 from Marc Véron <veron@veron.ch> --- Created attachment 38650 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38650&action=edit [Follow-up] Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #38638|0 |1 is obsolete| | Attachment #38650|0 |1 is obsolete| | --- Comment #8 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 38651 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38651&action=edit Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #9 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 38652 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38652&action=edit Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6 Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> This should be fixed in a separate patch, this error is not sent to the template and the related code could be removed. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |14077 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=14077 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #10 from Marc Véron <veron@veron.ch> --- (In reply to Jonathan Druart from comment #9) (...)
This should be fixed in a separate patch, this error is not sent to the template and the related code could be removed.
See Bug 14077 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #38651|0 |1 is obsolete| | Attachment #38652|0 |1 is obsolete| | --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 38678 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38678&action=edit [PASSED QA] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 38679 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=38679&action=edit [PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6 Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> This should be fixed in a separate patch, this error is not sent to the template and the related code could be removed. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Status|Passed QA |Pushed to Master --- Comment #13 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patches pushed to master. Thanks Marc! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13910 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #14 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.18.x will be in 3.18.7 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org