[Bug 36988] New: PUT for patrons requires full borrowers permission, but should only require 'edit_borrowers'
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Bug ID: 36988 Summary: PUT for patrons requires full borrowers permission, but should only require 'edit_borrowers' Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com CC: tomascohen@gmail.com On the staff side, a user with only edit_borrowers can make changes to a patron account - for PUT access we require borrowers=>1 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Rebecca Coert <rcoert@arlingtonva.us> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rcoert@arlingtonva.us -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #1 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 167270 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167270&action=edit Bug 36988: Change permission -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #2 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 167271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167271&action=edit Bug 36988: Update unit tests -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #3 from Kyle M Hall <kyle@bywatersolutions.com> --- Unit tests fail if given only edit_borrowers permission. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167270|0 |1 is obsolete| | Attachment #167271|0 |1 is obsolete| | --- Comment #4 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 167272 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167272&action=edit Bug 36988: Change permission -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #5 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 167273 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167273&action=edit Bug 36988: Update unit tests -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37228 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167273|0 |1 is obsolete| | --- Comment #6 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 188660 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188660&action=edit Bug 36988: Update unit tests These highlight why we may have made this choice. With only 'edit_borrowers' you can make changes, but you cannot view your changes as you aren't allowed to see other borrowers. Test now pass, but not sure if this answers the question of why we did it this way, or if there is more work here. Should you be able to get back the fields that you updated at the least, to confirm your changes? Or should we send a success with a message that you can't see the data? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | --- Comment #7 from David Nind <david@davidnind.com> --- Updated assignee to Kyle. Not sure if it should be Kyle or Nick. Not sure how to test, so leaving for someone who has a better understanding of permissions. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167272|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188660|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 198226 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198226&action=edit Bug 36988: Change permission Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 198227 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198227&action=edit Bug 36988: Update unit tests These highlight why we may have made this choice. With only 'edit_borrowers' you can make changes, but you cannot view your changes as you aren't allowed to see other borrowers. Test now pass, but not sure if this answers the question of why we did it this way, or if there is more work here. Should you be able to get back the fields that you updated at the least, to confirm your changes? Or should we send a success with a message that you can't see the data? Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #10 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. Before the patches, tests pass: prove t/db_dependent/api/v1/patrons.t 2. Apply the patches 3. yarn api:bundle (or yarn build?) 4. Restart everything: restart_all 5. Tests still pass 6. I guess I could have used an API client to test before and after, but not sure how to do that 7. Change back to needs signoff if this isn't sufficient -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch QA Contact| |lucas@bywatersolutions.com CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- simple patch w/ tests. no obvious regression. PQA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #198226|0 |1 is obsolete| | Attachment #198227|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #12 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 200475 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200475&action=edit Bug 36988: Change permission Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #13 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 200476 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200476&action=edit Bug 36988: Update unit tests These highlight why we may have made this choice. With only 'edit_borrowers' you can make changes, but you cannot view your changes as you aren't allowed to see other borrowers. Test now pass, but not sure if this answers the question of why we did it this way, or if there is more work here. Should you be able to get back the fields that you updated at the least, to confirm your changes? Or should we send a success with a message that you can't see the data? Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #14 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.11.00 |26.11.00,26.05.02 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 --- Comment #15 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to 26.05.x for the upcoming 26.05.02 release. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |baptiste.wojtkowski@biblibr | |e.com --- Comment #16 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Not backporting this permission change unless requested -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36988 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #17 from David Nind <david@davidnind.com> --- No changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org