[Bug 22868] New: Separate Permissions for "Manage Purchase Suggestions" and "Enter Purchase Suggestions"
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Bug ID: 22868 Summary: Separate Permissions for "Manage Purchase Suggestions" and "Enter Purchase Suggestions" Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: lisetteslatah@gmail.com QA Contact: testopia@bugs.koha-community.org Target Milestone: --- It would be handy if we could have separate permissions for "Manage Purchase Suggestions" and "Enter Purchase Suggestions" After bug 11911 was pushed, it is now obvious to people who have the "Manage Purchase Suggestions" permission that they can go in and edit any. It would be great if we could separate it out and let staff only add purchase suggestions. Many of our branches have staff enter in any purchase suggestions on the staff side using the "Purchase Suggestions" tab when checking out a patron, but don't want them to have the ability to go manage other ones. 12219 Can help some with that by limiting to branch, but if we could also have the ability to only add and not manage, that would be helpful here. Lisette -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Lisette Scheer <lisetteslatah@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lisetteslatah@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 karen.fellows@citruslibraries.org changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |karen.fellows@citruslibrari | |es.org --- Comment #1 from karen.fellows@citruslibraries.org --- After our upgrade to 18.11 we noticed that staff were able to edit/delete purchase suggestions from the home page link. In the past, staff were allowed staff to create purchase suggestions for patrons, but they could not edit/delete them. I agree with Lisette, that it would be great to have a separate permission like "enter purchase sugggestions" for staff. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbrannon@cdalibrary.org --- Comment #2 from Christopher Brannon <cbrannon@cdalibrary.org> --- I would also like to say we definitely need to keep these separate. This has been a little headache. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal --- Comment #3 from Christopher Brannon <cbrannon@cdalibrary.org> --- I want to change this to a bug, as I don't know that it was intended for this to happen. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 koha-US bug tracker <bugzilla@koha-us.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bugzilla@koha-us.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kyle@bywatersolutions.com |koha-bugs@lists.koha-commun | |ity.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marie-luce.laflamme@inlibro | |.com --- Comment #4 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- Circulation staff do create purchase suggestions on patron's behalf regularly, and they do need the "managing purchase suggestions" permission to create these suggestions. After upgrading to 19.05, we have noticed that if you allow the "managing purchase suggestions" permission (without other acquisition permissions), you can access the budget and see what was ordered. So, if you are a circulation staff, you can access the budget. This is not an ideal situation. I do agree with the others, it would be great to have a separate permission called "enter purchase suggestions" for staff. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |critical --- Comment #5 from Christopher Brannon <cbrannon@cdalibrary.org> --- Oh my gosh! This is not good at all! We need this fixed ASAP. I can only do so much to work around this without crippling our circulation staff. Someone please fix. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #6 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- Staff account with limited access issues. For example: circulation staff will require the "managing purchase suggestion" permission to allow them to enter a purchase suggestion on a patron's behalf (on the staff interface). Unfortunately, this permission will also unlock the access to the budget. Test plan 1) Create a staff account with the following permissions: "Checkout/checkin", "Add, modify and view patron info", "Staff access, allow viewing of catalogue..." and "Manage purchase suggestions" (without other acquisition permissions) 2) Logout and Login to the staff interface with this new account. 3) Access the Acquisition module and notice the budget -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Can you confirm that the problematic information is on the Acquisition home page (acqui/acqui-home.pl) and is the fund list? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |11911 --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- acqui/acqui-home.pl: flagsrequired => { acquisition => '*' }, acqui/booksellers.pl: flagsrequired => { acquisition => '*' }, acqui/histsearch.pl: flagsrequired => { acquisition => '*' }, acqui/invoice-files.pl: flagsrequired => { 'acquisition' => '*' }, acqui/invoice.pl: flagsrequired => { 'acquisition' => '*' }, acqui/invoices.pl: flagsrequired => { 'acquisition' => '*' }, acqui/modordernotes.pl: flagsrequired => { 'acquisition' => '*' }, acqui/ordered.pl: flagsrequired => { acquisition => '*' }, acqui/showorder.pl: flagsrequired => { acquisition => '*' }, acqui/spent.pl: flagsrequired => { acquisition => '*' }, acqui/supplier.pl: flagsrequired => { acquisition => '*' }, services/itemrecorddisplay.pl: flagsrequired => {acquisition => '*'}, I would suggest to move acquisition.suggestions_manage to a new permission "namespace", suggestions.suggestions_manage. Would it work? Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 [Bug 11911] Add separate permission for managing suggestions -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #9 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- It would be a good thing to separate permissions: 1 - "Enter purchase suggestions" 2 - "Manage purchase suggestions" -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #10 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- Yes it's on (acqui/acqui-home.pl) page. It would be a good thing to separate permissions: 1 - "Enter purchase suggestions" 2 - "Manage purchase suggestions" -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #11 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Marie-Luce Laflamme from comment #10)
Yes it's on (acqui/acqui-home.pl) page.
It would be a good thing to separate permissions: 1 - "Enter purchase suggestions" 2 - "Manage purchase suggestions"
It will not fix the problem. The issue here is that script are checking for acquisition => '*' permission, which means "whichever permission is ok for access". Splitting the permission will not block the access to these pages. That's why I suggestion to move the manage_suggestions out of the "acquisition". We could split the permission later if still needed. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #12 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- It may not fix the problem, but we should definitely find a better way to handle purchase suggestions. As mentioned earlier, circulation staff required the "managing purchase suggestions" permission to create purchase suggestions on a patron's behalf. However, you do not want circulation staff to decide if a purchase suggestion should be ordered nor access to the budget. Only librarians should manage suggestions. There are 2 problems: - access to the budget without permission - the need of 2 separate permissions (" enter" vs "manage" purchase suggestions) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Marie-Luce Laflamme from comment #12)
It may not fix the problem, but we should definitely find a better way to handle purchase suggestions.
As mentioned earlier, circulation staff required the "managing purchase suggestions" permission to create purchase suggestions on a patron's behalf.
However, you do not want circulation staff to decide if a purchase suggestion should be ordered nor access to the budget. Only librarians should manage suggestions.
There are 2 problems:
- access to the budget without permission - the need of 2 separate permissions (" enter" vs "manage" purchase suggestions)
Yes, I agree with the 2 permissions but it's an enhancement request, not a "critical" bug (also not a regression). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #14 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Jonathan Druart from comment #13)
Yes, I agree with the 2 permissions but it's an enhancement request, not a "critical" bug (also not a regression).
Not sure why you would call this an enhancement. This is a bug. And I don't recall this behavior on past versions. At some point this changed, and is not a desired effect. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #15 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Christopher Brannon from comment #14)
(In reply to Jonathan Druart from comment #13)
Yes, I agree with the 2 permissions but it's an enhancement request, not a "critical" bug (also not a regression).
Not sure why you would call this an enhancement. This is a bug. And I don't recall this behavior on past versions. At some point this changed, and is not a desired effect.
I did not try but I think that prior to bug 11911, when you were able to create a new suggestion, you also were able to edit it. That is why we need 2 permissions. That must be fixed on a separated bug report, it's an enhancement request. The "critical" bit here is that you can now access acquisition screens if you have the acquisition.manage_suggestions permission. That must be fixed here, it's a regression. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- As I am the one to blame here I can say something about previous behaviour. Before the new permission was added, there was 'no permission' needed for making suggestions and managing them in Koha. If you had the link to the suggestions page, you could do it. Koha was just hiding the link to the acquisition module from display. So I introduced a new permission to remedy that... but that caused the problem we see now: we have other pages that require very lax permissions (any acq permission). I think what Jonathan suggests, moving this out of acq will be a nice fix for the bug. It will go back to where we were before, but we will have a permission to turn it on and off. Then the next step we should discuss how to split it up for editing etc. Note: I am not a fan of splitting CRUD wise, because this means that you can enter a suggestion with a silly typo (add), but you won't be able to fix it (update) or delete it, if the patron no longer wants it. I think it's better to think about use cases here. Like: allow to change status, allow to enter acq information or similar. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Note: moving it out of acq will also make it way easier to add those sub-permissions! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org Status|NEW |ASSIGNED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #18 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 97334 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97334&action=edit Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Separate Permissions for |Circulation staff can with |"Manage Purchase |suggestions_manage can have |Suggestions" and "Enter |access to acquisition data |Purchase Suggestions" | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Circulation staff can with |Circulation staff with |suggestions_manage can have |suggestions_manage can have |access to acquisition data |access to acquisition data -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Severity|critical |enhancement -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #19 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Marie-Luce or Christopher, could one of you sign-off on this? It should work on on the sandboxes. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |critical -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97334|0 |1 is obsolete| | --- Comment #20 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 97666 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97666&action=edit Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #21 from Marie-Luce Laflamme <marie-luce.laflamme@inlibro.com> --- I've tested the patch and here are my results... - a patron with a super librarian permission can manage and add suggestion - a patron without "suggestion management" permission cannot add suggestion There is a tiny issue with the 3rd type of patron account... - patron with several permissions (including "suggestion management") can add suggestion, but it also has the ability to "manage suggestions" (accept or reject suggestions) when you click on "Back to suggestion." To reproduce: Create a patron with "suggestion management" permission (see previous comment for details) Apply the patch Login with a patron who has the "suggestion management" permission Find a patron account. Click on "Purchase suggestion" and Add a suggestion. After submitting the suggestion, click on the title of the suggestion to assess the request. At the bottom of the suggestion form, click on "Back to suggestion" After clicking on "Back to suggestion", you are sent to the "Suggestion Management" page (Acquisition > Suggestion), where you can accept or reject suggestions. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #22 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Marie-Luce Laflamme from comment #21)
There is a tiny issue with the 3rd type of patron account...
- patron with several permissions (including "suggestion management") can add suggestion, but it also has the ability to "manage suggestions" (accept or reject suggestions) when you click on "Back to suggestion."
Yes, it is the expected behavior. With suggestions_manage you can manage suggestions :) Which means you can add/edit/delete purchase suggestions. On this bug report we are dealing with acquisition access, a librarian with suggestions_manage but no acquisition permission cannot access budgets/funds information. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #23 from Christopher Brannon <cbrannon@cdalibrary.org> --- Personally, I think if a staff member can add a suggestion, they need to be able to edit or remove as well, but from the patron interface, not from the global table. Less likely to affect the wrong patron. That seems the most logical. The global table needs its own permission. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #24 from karen.fellows@citruslibraries.org --- I agree with Christopher and going off of my comment from above-- "In the past, staff were allowed staff to create purchase suggestions for patrons, but they could not edit/delete them."--We want this feature back. Circ staff need to be able to enter the suggestions but not manage them--we have technical services staff that complete that task, not circulation staff. The idea is to make it easier for the circ staff to help the patrons put in suggestions since most of the patrons don't log in to their accounts to do it themselves. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #25 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to karen.fellows from comment #24)
I agree with Christopher and going off of my comment from above-- "In the past, staff were allowed staff to create purchase suggestions for patrons, but they could not edit/delete them."--We want this feature back.
I believe this is not true - the page was still accessible and staff could have added/edited anytime, just the acq module link would not show on the start page. We have used this 'loophole' for ages by linking to the page directly for libraries not using the acq module otherwise. There was NO permission check on the suggestions module page (apart from "catalogue"). I just tested this in a 17.11.: - Create a user without any acq access - Go to any patron account - Create a new purchase suggestion - Click on the "purchase suggestions" part of the breadcrumbs - You can managed (edit/add) your heart out. The regression is, that you can see other acq details, but not in the suggestions handling.
Circ staff need to be able to enter the suggestions but not manage them--we have technical services staff that complete that task, not circulation staff. The idea is to make it easier for the circ staff to help the patrons put in suggestions since most of the patrons don't log in to their accounts to do it themselves.
I am not saying we could not make this more granular. The change here will even make that possible. By moving the suggestion permission to be a top-level permission, we will be able to have sub permissions as a next step. I am just saying, let's fix it to where we were before - then move forward from there. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Hayley Mapley <hayleymapley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Hayley Mapley <hayleymapley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97666|0 |1 is obsolete| | --- Comment #26 from Hayley Mapley <hayleymapley@catalyst.net.nz> --- Created attachment 97951 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=97951&action=edit Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #97951|0 |1 is obsolete| | --- Comment #27 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 98100 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=98100&action=edit Bug 22868: Move suggestions_manage subperm out of acquisition perm Bug 11911 replaced the permission of suggestions.pl (create a purchase suggestion) from catalogue => 1 to acquisition => 'suggestions_manage'. However we have a lot of acquisition scripts that have lax permissions (acquisition => '*' which means any sub permissions of acquisition is enough). That causes problem when a circulation staff can create purchase suggestions but not access acquisition information. One solution is to move the suggestions_manage subpermission out of the acquisition permission and create a new suggestion permission. Test plan: 0. Setup * Create a patron with several permission (and full acquisition permission) * Create another patron with several permission, and suggestions_manage permission * Create another patron without the suggestions_manage permission 1. Apply the patch and execute the update database entry 2. Note that the third patron you create still does not have suggestions_manage 3. Confirm that you can create a purchase suggestion if you have suggestions_manage, but cannot access acquisition pages if you do not have any subpermissions of the acquisition permission Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #28 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- This patch will fix the regression found (see comments before), for further improving/splitting permissions, it would be great if separate bug reports could be reported. There are small glitches: - The top permission has one sub permission now. It might have been slightly more consistent to have it only as a top level module permission, but seeing requests here for more granular permissions, this might see more work later. - The breadcrumbs show Acquisitions, but when you click on it, you got no permission. I am not seeing this as a blocker, as this is what we had before the regression was introduced. So I think we can think about this separately. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |20.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 --- Comment #29 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work everyone! Pushed to master for 20.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Joy Nelson <joy@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |joy@bywatersolutions.com Version(s)|20.05.00 |20.05.00, 19.11.03 released in| | Status|Pushed to master |Pushed to stable --- Comment #30 from Joy Nelson <joy@bywatersolutions.com> --- Pushed to 19.11.x branch for 19.11.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|20.05.00, 19.11.03 |20.05.00, 19.11.03, released in| |19.05.08 Status|Pushed to stable |Pushed to oldstable --- Comment #31 from Lucas Gass <lucas@bywatersolutions.com> --- backported to 19.05.x for 19.05.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Hayley Mapley <hayleymapley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable CC| |hayleymapley@catalyst.net.n | |z Version(s)|20.05.00, 19.11.03, |20.05.00, 19.11.03, released in|19.05.08 |19.05.08, 18.11.14 --- Comment #32 from Hayley Mapley <hayleymapley@catalyst.net.nz> --- Backported to 18.11.x for 18.11.14. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david.roberts@ptfs-europe.c | |om --- Comment #33 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- *** Bug 22402 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |25005 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25005 [Bug 25005] Admin Rights issue for Suggestion to Purchase -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |25858 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25858 [Bug 25858] Borrower permissions are broken by update from bug 22868 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868 koha-US bug tracker <bugzilla@koha-us.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|bugzilla@koha-us.org | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org