[Bug 14244] New: viewing a bib item's circ history requires circulation permissions
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Bug ID: 14244 Summary: viewing a bib item's circ history requires circulation permissions Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Circulation Assignee: koha-bugs@lists.koha-community.org Reporter: nengard@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Tom Misilo <misilot@fit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |misilot@fit.edu -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #1 from Tom Misilo <misilot@fit.edu> --- Would catalogue => "*" make sense here? If so I can make a patch for it. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #2 from Tom Misilo <misilot@fit.edu> --- Created attachment 42622 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=42622&action=edit Change permissions of issue history -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Tom Misilo <misilot@fit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Nicole C. Engard <nengard@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Nicole C. Engard <nengard@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #42622|0 |1 is obsolete| | --- Comment #3 from Nicole C. Engard <nengard@gmail.com> --- Created attachment 43441 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43441&action=edit Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #43441|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 43495 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=43495&action=edit Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |misilot@fit.edu |ity.org | CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |In Discussion CC| |katrin.fischer@bsz-bw.de, | |tomascohen@gmail.com Keywords| |rel_3_22_candidate -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Clarification, just in case: this bug is passed-QA, I've just requested the QAM's opinion privately, but I also marked with the rel_3_22_candidate keyword to make it clear it will be pushed for 3.22. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #6 from Tom Misilo <misilot@fit.edu> --- Did this make it into 3.22? Or was it pushed back to the next release? I didn't notice it in the release notes. Thanks! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Tom Misilo from comment #6)
Did this make it into 3.22? Or was it pushed back to the next release? I didn't notice it in the release notes. Thanks!
No, it has not been pushed yet. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Signed Off Keywords|rel_3_22_candidate | --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Still waiting for QAM's opinion. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com --- Comment #9 from Kyle M Hall <kyle@bywatersolutions.com> --- Still waiting for QAM's opinion. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hm, at the risk of people not being happy with me... this is what I think: The circulation history tab includes information about borrowers - the patrons who have checked out items of the record. If you have access to the circulation module, it seems 'more ok' to see that, then if you just have catalog permission in order to be able to do some minor tasks in the staff interface. A suggestion: If someone has only catalog - don't show the information about the patrons. If someone has circulation permissions - show all the columns. Could that work? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |In Discussion -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #10)
Hm, at the risk of people not being happy with me... this is what I think:
The circulation history tab includes information about borrowers - the patrons who have checked out items of the record.
If you have access to the circulation module, it seems 'more ok' to see that, then if you just have catalog permission in order to be able to do some minor tasks in the staff interface.
A suggestion: If someone has only catalog - don't show the information about the patrons. If someone has circulation permissions - show all the columns.
Could that work?
That sounds like a good approach. So, to be clear about it, you are proposing that if the librarian does not have the circulation permission, the first column ( Patron ) should not be displayed, correct? This would need to be done at the template level so the data is not just hidden from view, but would not be in the HTML source at all. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Yep, that's what I was thinking. The page level permission could be catalog - which every staff member should have. Then adjust the datatable to hide the first column iirc in the template itself. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 47245 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=47245&action=edit Bug 14244: Does not display patron's info in the checkout history if not authorised The librarian needs CAN_user_circulate_circulate_remaining_permissions to see the checkouts patron's information. Test plan: The "Patron" column of the checkout history page should only be displayed of you have the circulate > circulate_remaining_permissions permission. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch --- Comment #14 from Marc Véron <veron@veron.ch> --- The patches work as described. However, I can still see patron information in the Normal view on ...cgi-bin/koha/catalogue/detail.pl?biblionumber=xxxxx, in column "Status". Example: Currently in local use by Edna Acosta : due 11/12/2015 23:59 ...and the link on the name leads to the "No permission" page. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Marc, I think this bug is only about the reading history - so the detail page/normal view woudl be better on another bug report. Do you agree with the general approach or would you like it to work differently? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 --- Comment #16 from Marc Véron <veron@veron.ch> --- Hi Katrin, no problem with fixing it with a separate bug. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #43495|0 |1 is obsolete| | --- Comment #17 from Marc Véron <veron@veron.ch> --- Created attachment 47257 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=47257&action=edit Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #47245|0 |1 is obsolete| | --- Comment #18 from Marc Véron <veron@veron.ch> --- Created attachment 47258 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=47258&action=edit Bug 14244: Does not display patron's info in the checkout history if not authorised The librarian needs CAN_user_circulate_circulate_remaining_permissions to see the checkouts patron's information. Test plan: The "Patron" column of the checkout history page should only be displayed of you have the circulate > circulate_remaining_permissions permission. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14244 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=15655 Patch complexity|--- |Trivial patch --- Comment #19 from Marc Véron <veron@veron.ch> --- (In reply to Katrin Fischer from comment #15)
Hi Marc, I think this bug is only about the reading history - so the detail page/normal view woudl be better on another bug report. Do you agree with the general approach or would you like it to work differently?
H Katrin, I filed a separate bug: Bug 15655 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org