[Bug 13584] New: Able to view menu for Purchase Suggestions even when user does not have permission
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Bug ID: 13584 Summary: Able to view menu for Purchase Suggestions even when user does not have permission Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: tomsStudy@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Same problem as Bug 10943. The page requires borrowers to access but the menu item is still shown to users who do not have the borrowers permission.
From purchase-suggestions.pl we can see there is no check for which permissions are required to visit the linked page.
Yet in the include the only thing checked is: [% IF ( suggestionsview ) %] So a user who doesn't have permission to access Purchase suggestions can still see the menu item. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Thomas Wright <tomsStudy@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #1 from Thomas Wright <tomsStudy@gmail.com> --- I'm working on this. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 --- Comment #2 from Thomas Wright <tomsStudy@gmail.com> --- Created attachment 35267 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35267&action=edit Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Thomas Wright <tomsStudy@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Small patch -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35267|0 |1 is obsolete| | --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 35285 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35285&action=edit [SIGNED OFF] Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> The page requires borrowers permission, so the link should act accordingly. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Currently there is a second file for building the navigation that could be changed too, but this patch is correct and an improvement. / koha-tmpl / intranet-tmpl / prog / en / includes / circ-menu.tt There is a bug report to remove the file in favor of the .inc, as both have some differences right now. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35285|0 |1 is obsolete| | --- Comment #5 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 35298 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35298&action=edit Bug 13584 - Able to view menu for Purchase Suggestions even when user does not have permission Added check for borrowers that stops the Purchase Suggestions link being shown. This could be done through the css but that function currently appears to be broken Testing Plan: -Search for a patron with an account that does not have the 'borrowers' permission *Purchase suggestions item should not be seen in the menu. -Change the accounts permissions so they have the 'borrowers' permission *Purchase suggestions item should be present in the menu. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> The page requires borrowers permission, so the link should act accordingly. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Same problem for Fines, Circulation history, Notices and Statistics tabs. circ-menu.tt is only used from the Fines tab (which is not accessible), to it's not useful to add this check to it. But for the consistency, it makes sense. follow-up coming. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 --- Comment #6 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 35299 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35299&action=edit Bug 13584: (follow-up) Able to view menu for Purchase Suggestions even when user does not have permission Same changes as the previous patch, for the .tt file. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |tomsStudy@gmail.com |ity.org | CC| |jonathan.druart@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13584 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |tomascohen@gmail.com --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patch pushed to master. Thanks Thomas! -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org