[Bug 41253] New: Item Modification by Age should have its own permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Bug ID: 41253 Summary: Item Modification by Age should have its own permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: alex@rcls.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Currently, access to the Item Modification by Age tool is determined by the items_batchmod permission. In a Consortium setting, a common scenario is to restrict item editing, including batch item editing, to staff users of the item owning library. This is done via Library Groups and the standard edit_items permission. However, the Item Modification by Age tool does not restrict the items.homebranch condition, allowing users of any library to define a new rule for a library they don't belong to and whose items they don't own. Breaking the tool permissions into two separate permissions would solve this issue. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #1 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 200363 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200363&action=edit Bug 41253: Item Modification by Age should have its own permission Adds a new permission to control access to the Item Modification by Age tool in the Cataloging Module. Previously access to this tool was controlled by the items_batchmod permission. This can be an issue for consortiums where staff members should be able to batch change items that belong to their library, but who shouldn't be able to define item aging rules. Staff with automatic item aging tool access can use authorized values to change items that belong to other libraries. This patch introduces a dedicated permission (items_modification_by_age) to restrict access to the tool to users with this permission. - new permission definition via atomicupdate - removal of dependency on items_batchmod for tool access - updated permission UI display - updated cataloguing-home button visibility - updated flagsrequired check in tool script -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #2 from Alex Carver [Acerock7] <alex@rcls.org> --- Test plan: 1. On clean install, verify that a user with the items_batchmod permission can access the Item modifications by age tool in the Cataloging Module. 2. Apply patch. 3. Run restart_all 4. Run updatedatabase 5. Create or edit a user to have all permissions. 6. Log in with this new user. 7. Verify that this user can access the Item modifications by age tool in the Cataloging Module. 8. Edit the user permissions to remove items_modification_by_age under the Use All Tools group. 9. Verify that this user no longer has the button for the Item modifications by age tool in the Cataloging Module. 10. Attempt to navigate directly to the tool: cgi-bin/koha/tools/automatic_item_modification_by_age.pl 11. Verify that access is denied to this user. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200363|0 |1 is obsolete| | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #3 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 200547 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200547&action=edit Bug 41253: Item Modification by Age should have its own permission Adds exec flag to atomic update file, gives new permission to those users with existing items_batchmod permission, adds success message to atomic update, fixes a rendering issue with Automation header in cataloging.tt -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200547|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #4 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 200548 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200548&action=edit Bug 41253: Item Modification by Age should have its own permission Adds a new permission to control access to the Item Modification by Age tool in the Cataloging Module. Previously access to this tool was controlled by the items_batchmod permission. This can be an issue for consortiums where staff members should be able to batch change items that belong to their library, but who shouldn't be able to define item aging rules. Staff with automatic item aging tool access can use authorized values to change items that belong to other libraries. This patch introduces a dedicated permission (items_modification_by_age) to restrict access to the tool to users with this permission. - new permission definition via atomicupdate - removal of dependency on items_batchmod for tool access - updated permission UI display - updated cataloguing-home button visibility - updated flagsrequired check in tool script -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #5 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 200549 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200549&action=edit Bug 41253: Item Modification by Age should have its own permission Adds exec flag to atomic update file, gives new permission to those users with existing items_batchmod permission, adds success message to atomic update, fixes a rendering issue with Automation header in cataloging.tt -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200548|0 |1 is obsolete| | Attachment #200549|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #6 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 200563 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200563&action=edit Bug 41253: Item Modification by Age should have its own permission Adds a new permission to control access to the Item Modification by Age tool in the Cataloging Module. Previously access to this tool was controlled by the items_batchmod permission. This can be an issue for consortiums where staff members should be able to batch change items that belong to their library, but who shouldn't be able to define item aging rules. Staff with automatic item aging tool access can use authorized values to change items that belong to other libraries. This patch introduces a dedicated permission (items_modification_by_age) to restrict access to the tool to users with this permission. - new permission definition via atomicupdate - removal of dependency on items_batchmod for tool access - updated permission UI display - updated cataloguing-home button visibility - updated flagsrequired check in tool script -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200563|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #7 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Created attachment 200592 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200592&action=edit Bug 41253: Item Modification by Age should have its own permission Adds a new permission to control access to the Item Modification by Age tool in the Cataloging Module. Previously access to this tool was controlled by the items_batchmod permission. This can be an issue for consortiums where staff members should be able to batch change items that belong to their library, but who shouldn't be able to define item aging rules. Staff with automatic item aging tool access can use authorized values to change items that belong to other libraries. This patch introduces a dedicated permission (items_modification_by_age) to restrict access to the tool to users with this permission. - new permission definition via atomicupdate - removal of dependency on items_batchmod for tool access - updated permission UI display - updated cataloguing-home button visibility - updated flagsrequired check in tool script Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #8 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Happy to bump myself up to QA if someone else adds a SO here. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |alex@rcls.org |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #9 from Jonathan Druart <jonathan.druart@gmail.com> --- To test I have assign the new permission and catalogue to a new user. The "Tools" is available from the mainpage, but then you get a blank page, the cataloguing module cannot be accessed. I don't think it's a blocker for this one, and it's certainly a problem for all other permissions under tools, but worth mentioning it! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200592|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #10 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 200756 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200756&action=edit Bug 41253: Item Modification by Age should have its own permission Adds a new permission to control access to the Item Modification by Age tool in the Cataloging Module. Previously access to this tool was controlled by the items_batchmod permission. This can be an issue for consortiums where staff members should be able to batch change items that belong to their library, but who shouldn't be able to define item aging rules. Staff with automatic item aging tool access can use authorized values to change items that belong to other libraries. This patch introduces a dedicated permission (items_modification_by_age) to restrict access to the tool to users with this permission. - new permission definition via atomicupdate - removal of dependency on items_batchmod for tool access - updated permission UI display - updated cataloguing-home button visibility - updated flagsrequired check in tool script Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #11 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 200757 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200757&action=edit Bug 41253: Grant permission only when the permission is created In case it got backported, we don't want to grant permissions again, only when the db rev is run for the first time. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pedro.amorim@openfifth.co.u | |k Status|Passed QA |Failed QA --- Comment #12 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi guys, also noticed this one, is this expected? 1) Log in as a patron with 'items_batchmod' and 'catalogue' permissions only. 2) Go to 'Cataloging': confirm no "Automation" section appears (correct). 3) Click into 'Batch item modification'. 4) In the left sidebar, confirm an "Automation" section with an "Item modifications by age" link does appear, inconsistent with step 2. 5) Click it: confirm permission denied. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #13 from Alex Carver [Acerock7] <alex@rcls.org> --- Ah--yes the sidenav visibility should also be controlled with the permission. I'll work up a new patch. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #14 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 203917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203917&action=edit Removes "Automation" Heading and "Item Modifications by Age" options for users without the items_modification_by_age permission in the cataloging sidenav (cat-menu.inc). Users with who can manage stock rotation will still see heading and stock rota option Patch from commit ae9955c -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #203917|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #15 from Alex Carver [Acerock7] <alex@rcls.org> --- Created attachment 203918 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203918&action=edit Bug 41253: Fix Cataloging Side Nav Patch from commit e0b0afe -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41253 --- Comment #16 from Alex Carver [Acerock7] <alex@rcls.org> --- Test plan: 1. On clean install, verify that a user with the items_batchmod permission can access the Item modifications by age tool in the Cataloging Module. 2. Apply patch. 3. Run restart_all 4. Run updatedatabase 5. Create or edit a user to have all permissions. 6. Log in with this new user. 7. Verify that this user can access the Item modifications by age tool in the Cataloging Module. 8. Edit the user permissions to remove items_modification_by_age under the Use All Tools group. 9. Verify that this user no longer has the button for the Item modifications by age tool in the Cataloging Module. 10. In the cataloging module, verify that this user cannot see "Item Modifications by Age" option or "Automation" heading in the cataloging sidenav. 11. Attempt to navigate directly to the tool: cgi-bin/koha/tools/automatic_item_modification_by_age.pl 12. Verify that access is denied to this user. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org