[Bug 30207] New: Librarians with only "place_holds" permission can no longer update hold pickup locations
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Bug ID: 30207 Summary: Librarians with only "place_holds" permission can no longer update hold pickup locations Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #1 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 131203 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131203&action=edit Bug 30207: Librarians with only "place_holds" permission can no longer update hold pickup locations Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. Test Plan: 1) Create a librarian with "place_holds" permissions, but not "modify_holds_priority". 2) Place a hold for a patron 3) Attempt to change the pickup location from request.pl 4) Note you get logged out with a permissions error 5) Apply this patch 6) Restart all the things! 7) Attempt to change the pickup location from request.pl 8) This time it should succeed! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131203|0 |1 is obsolete| | --- Comment #2 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 131205 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=131205&action=edit Bug 30207: Librarians with only "place_holds" permission can no longer update hold pickup locations Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. Test Plan: 1) Create a librarian with "place_holds" permissions, but not "modify_holds_priority". 2) Place a hold for a patron 3) Attempt to change the pickup location from request.pl 4) Note you get logged out with a permissions error 5) Apply this patch 6) Restart all the things! 7) Attempt to change the pickup location from request.pl 8) This time it should succeed! Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |cbrannon@cdalibrary.org --- Comment #3 from Christopher Brannon <cbrannon@cdalibrary.org> --- Works as described. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #4 from Owen Leonard <oleonard@myacpl.org> --- When I try this, a user with only "place_holds" permission can add, suspend, or delete a hold. The user cannot change the hold date, the expiration date, or the pickup location. Is this to be expected? I would have expected that a user with "place_holds" but NOT "modify_holds_priority" would be able to make any change EXCEPT change priority. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #5 from Owen Leonard <oleonard@myacpl.org> --- Never mind, I wasn't on the branch I thought I was! Sorry for the noise. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30213 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30213 [Bug 30213] Hide Delete (aka Priority) column when user only has place_hold permission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Kyle, quick question: could it make sense to use: flagsrequired => { reserveforothers => '*' }, As I understand it, that means "module level or any sub permission". So that could be more fail save if we added more sub perms. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Amanda Campbell <acampbell@hmcpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |acampbell@hmcpl.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |29540 CC| |jonathan.druart+koha@gmail. | |com --- Comment #7 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- I don't think this is 100% accurate. The script is also about cancellation, suspend, modifying pickup library, etc. In my understanding if you have modify_holds_priority you should only be allowed to modify the priority. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29540 [Bug 29540] Accounts with just 'catalogue' permission can modify/delete holds -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #8 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Jonathan Druart from comment #7)
I don't think this is 100% accurate. The script is also about cancellation, suspend, modifying pickup library, etc.
In my understanding if you have modify_holds_priority you should only be allowed to modify the priority.
This patch should not be touching any other aspect of holds. If it is, it wasn't caught through the testing plan. If it is allowing more that changing priorities, then it should fail. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Anneli Österman <anneli.osterman@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |anneli.osterman@koha-suomi. | |fi --- Comment #9 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- Does this fix the problem that staff cannot cancel holds from the patron detail page / checkout page if they have only place_hold permission? The test plan only mentions request.pl page. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Michael Adamyk <madamyk@ckls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |madamyk@ckls.org --- Comment #10 from Michael Adamyk <madamyk@ckls.org> --- +1 to Anneli's comment. This appears to have also broken hold cancellation; where staff can no longer cancel holds from the patron details unless they have modify_holds_priority permission. We want that permission to be very rare in our system, but we want most staff to have the ability to cancel holds. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 134808 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134808&action=edit Bug 30207: Allow any reserveforothers subpermission to access the page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Anneli Österman <anneli.osterman@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #12 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- I tested the new patch and now you can delete hold from patron details or check out pages with the permission place_holds. So that is ok now. However, I noticed that the suspend/resume functions doesn't work correctly on patron details/check out pages. When I tried to suspend or resume one hold, Koha showed me a pop up "Your request could not be processed. Check the logs" and OK button. When I tried to suspend or resume all holds, Koha gave me log in page with the message "Error: You do not have permission to access this page." Suspend/resume works fine at the request.pl page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #13 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Anneli Österman from comment #12)
I tested the new patch and now you can delete hold from patron details or check out pages with the permission place_holds. So that is ok now.
However, I noticed that the suspend/resume functions doesn't work correctly on patron details/check out pages.
When I tried to suspend or resume one hold, Koha showed me a pop up "Your request could not be processed. Check the logs" and OK button.
When I tried to suspend or resume all holds, Koha gave me log in page with the message "Error: You do not have permission to access this page."
Suspend/resume works fine at the request.pl page
Good catch! What you are seeing is not related to request.pl. Instead it has something to do with modrequest_suspendall.pl and is outside the scope of this bug report. I'll file a separate bug for that issue and link it to this one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30732 --- Comment #14 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Anneli Österman from comment #12)
I tested the new patch and now you can delete hold from patron details or check out pages with the permission place_holds. So that is ok now.
However, I noticed that the suspend/resume functions doesn't work correctly on patron details/check out pages.
When I tried to suspend or resume one hold, Koha showed me a pop up "Your request could not be processed. Check the logs" and OK button.
When I tried to suspend or resume all holds, Koha gave me log in page with the message "Error: You do not have permission to access this page."
Suspend/resume works fine at the request.pl page
Good catch! What you are seeing is not related to request.pl. Instead it has something to do with modrequest_suspendall.pl and is outside the scope of this bug report. I'll file a separate bug for that issue and link it to this one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #131205|0 |1 is obsolete| | --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 134977 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134977&action=edit Bug 30207: Librarians with only "place_holds" permission can no longer update hold pickup locations Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. Test Plan: 1) Create a librarian with "place_holds" permissions, but not "modify_holds_priority". 2) Place a hold for a patron 3) Attempt to change the pickup location from request.pl 4) Note you get logged out with a permissions error 5) Apply this patch 6) Restart all the things! 7) Attempt to change the pickup location from request.pl 8) This time it should succeed! Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #134808|0 |1 is obsolete| | --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 134978 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=134978&action=edit Bug 30207: Allow any reserveforothers subpermission to access the page Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |22.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 --- Comment #17 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to master for 22.05, thanks to everybody involved 🦄 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30780 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wizzyrea@gmail.com --- Comment #18 from Liz Rea <wizzyrea@gmail.com> --- Hi, Possible to backport this one into 21.11? Thanks! Liz -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |arthur.suzuki@biblibre.com Version(s)|22.05.00 |22.05.00, 21.11.11 released in| | --- Comment #19 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- Hi, Applied to 21.11.x for 21.11.11 :) thx! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net --- Comment #20 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Not backported to oldoldstable (21.05.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|FIXED |--- Status|RESOLVED |Needs documenting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Aude Charillon <aude.charillon@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED CC| |aude.charillon@ptfs-europe. | |com Resolution|--- |FIXED --- Comment #21 from Aude Charillon <aude.charillon@ptfs-europe.com> --- No changes to the Manual needed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Michael Adamyk <madamyk@ckls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|madamyk@ckls.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Bug 30207 depends on bug 29540, which changed state. Bug 29540 Summary: Accounts with just 'catalogue' permission can modify/delete holds https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29540 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org