[Bug 24477] New: No permissions check for POS feature
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Bug ID: 24477 Summary: No permissions check for POS feature Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Fines and fees Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org At the moment it appears that POS can be used without any permission - This means a patron with no permissions can access the page! my ( $template, $loggedinuser, $cookie, $user_flags ) = get_template_and_user( { template_name => 'pos/pay.tt', query => $q, type => 'intranet', authnotrequired => 0, } ); -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |23354 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23354 [Bug 23354] Add a 'Pay' screen to allow anonymous payments in a POS fashion -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #1 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 97697 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97697&action=edit Bug 24477: Require `takepayment` permission in pos/pay.pl When adding the point of sale take payment page in bug 23354 we missed the permission check script side along with adding the permission at install time (update was caught). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Assignee|koha-bugs@lists.koha-commun |martin.renvoize@ptfs-europe |ity.org |.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97697|0 |1 is obsolete| | --- Comment #2 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 97727 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97727&action=edit Bug 24477: Require `takepayment` permission in pos/pay.pl When adding the point of sale take payment page in bug 23354 we missed the permission check script side along with adding the permission at install time (update was caught). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97727|0 |1 is obsolete| | --- Comment #3 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 97728 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97728&action=edit Bug 24477: Require `takepayment` permission in pos/pay.pl When adding the point of sale take payment page in bug 23354 we missed the permission check script side along with adding the permission at install time (update was caught). Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #4 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 97729 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97729&action=edit Bug 24478: Use `EnablePointOfSale` preference This patch adds the `EnablePointOfSale` preference to the accounting tab on the preferences editor and ties the display of the Point of Sale module to it. Test plan: 1) Enable both `UseCashRegisters` and `EnablePointOfSale` preferences. 2) Ensure you are a superuser or your user has the takepayment permission. 3) The Point of Sale module should be present on your staff home page with the above configuration, otherwhise it should not. Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97728|0 |1 is obsolete| | --- Comment #5 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 97730 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97730&action=edit Bug 24477: Require `takepayment` permission in pos/pay.pl When adding the point of sale take payment page in bug 23354 we missed the permission check script side along with adding the permission at install time (update was caught). Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #6 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Apologies for signoff confusion from sandboxes! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97729|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- No apology necessary, thanks for taking the time to look at it :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97730|0 |1 is obsolete| | --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 97780 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97780&action=edit Bug 24477: Require `takepayment` permission in pos/pay.pl When adding the point of sale take payment page in bug 23354 we missed the permission check script side along with adding the permission at install time (update was caught). Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Totally unrelated... but as I am running out of time: Would you be opposed to rename Purchase items to the "Debit types". I think "Purchase items" is quite confusing for translation (probably going to get mixed up with suggestions) and it seems strange to have 2 different names for the same thing. If you just go to admin, you won't find anything named this there. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |20.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work everyone! Pushed to master for 20.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Katrin Fischer from comment #9)
Totally unrelated... but as I am running out of time: Would you be opposed to rename Purchase items to the "Debit types". I think "Purchase items" is quite confusing for translation (probably going to get mixed up with suggestions) and it seems strange to have 2 different names for the same thing. If you just go to admin, you won't find anything named this there.
Hmm, feel free to open that as a new bug else I'll completely forget about it.. I can see where you're coming from though I'm not entirely sure about the change. What I'd rather do is try to match the term to the flag that sets whether a debit type can be sold via the POS system vs the patron accounts pages... 'Item can be sold' I think it is. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Martin Renvoize from comment #11)
(In reply to Katrin Fischer from comment #9)
Totally unrelated... but as I am running out of time: Would you be opposed to rename Purchase items to the "Debit types". I think "Purchase items" is quite confusing for translation (probably going to get mixed up with suggestions) and it seems strange to have 2 different names for the same thing. If you just go to admin, you won't find anything named this there.
Hmm, feel free to open that as a new bug else I'll completely forget about it..
I can see where you're coming from though I'm not entirely sure about the change. What I'd rather do is try to match the term to the flag that sets whether a debit type can be sold via the POS system vs the patron accounts pages... 'Item can be sold' I think it is.
No problem with opening a new bug - set this mostly as a reminder to myself. But not sure I can follow your line of thought there? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=24490 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #13 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- I opened bug 24490 for the wording of that link and then bug 24491 suggesting some filtering options on the debit types page. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Andrew Fuerste-Henry from comment #13)
I opened bug 24490 for the wording of that link and then bug 24491 suggesting some filtering options on the debit types page.
Thx! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 --- Comment #15 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks guys, this is all really helpful feedback :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |23355 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23355 [Bug 23355] Add 'cashup' process to the accounts system -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Joy Nelson <joy@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |joy@bywatersolutions.com --- Comment #16 from Joy Nelson <joy@bywatersolutions.com> --- does not apply to 19.11.x. Not backported -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24477 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to stable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org