[Bug 12080] New: Superserials permission appears to be broken
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Bug ID: 12080 Summary: Superserials permission appears to be broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Serials Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: colin.campbell@ptfs-europe.com 1) IndependentBranches needs to be activated - 'Prevent' 2) Make sure you have some subscriptions, set to different branches 3) Search for all subscriptions with an empty search Problem 1: If the user has the superserials permission, the search doesn't show all subscriptions. Problem 2: If the user doesn't have the superserials permission, you can still edit a subscription accessing the subsscription detail page through the serial collection page (for records with multiple subscriptions) or accessing the detail page directly. Hope I tested this correctly - would be happy if someone could confirm the bug. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff CC| |frederic@tamil.fr Assignee|koha-bugs@lists.koha-commun |frederic@tamil.fr |ity.org | --- Comment #1 from Frédéric Demians <frederic@tamil.fr> --- Created attachment 27115 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27115&action=edit Proposed patch -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |12048 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #2 from Frédéric Demians <frederic@tamil.fr> --- Katrin: I confirm problem 1, and propose a solution. Note that this patch requires patch for bug 12048. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- I confirmed problem 1 and 2. However, this patch only solves problem 1. The /cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=## URL needs to have permissions checks added still. I can direct access the page. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27115|0 |1 is obsolete| | --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 27135 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27135&action=edit [SIGNED OFF] Bug 12080 Superserials permission in search result Enabling/disabling IndependentBranch syspref & superserials permission, you can see that serials search result doesn't display all subscriptions when appropriate. Fixed with this patch. Dependency: This patch must be applied after patch for bug 12048. TEST PLAN --------- 1) Apply the patch for bug 12048 (as needed -- it may be pushed) 2) Ensure you have two users: superlibrarian, non-superlibrarian with all access to the staff client except superserials. 3) Ensure you have serials belonging to a different branch than the non-superlibrarian. 3) Log into staff client as superlibrarian 4) Click 'Serials' 5) Click the 'Submit' button in the search area. -- note the number of results. 6) Log into staff client as non-superlibrarian 7) Click 'Serials' 8) Click the 'Submit' button in the search area. -- note the number should be less, note the number. 9) Give the non-superlibrarian superserials access. 10) Home -> Serials 11) Click the 'Submit' button in the search area. -- the number will still be the same at the one in step #8. 12) Apply the patch 13) Refresh the page -- the number should now match the one in step #5. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #5 from Frédéric Demians <frederic@tamil.fr> --- Thanks Mark for the detailed test plan. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@biblibre.co | |m --- Comment #6 from Jonathan Druart <jonathan.druart@biblibre.com> ---
From C4::Serials::can_edit_subscription:
or C4::Auth::haspermission( $userid, {serials => 'superserials'}), or C4::Auth::haspermission( $userid, {serials => 'edit_subscription'}), If a user has edit_subscription he cans edit a subscription (without having superserials). But or $subscription->{branchcode} eq C4::Context->userenv->{'branch'} Means: if the user is on the same branch, he cans edit it too. So a user can edit a subscription without having the edit_subscription permission... hum... Who wrote this code?? (...) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |ASSIGNED Assignee|frederic@tamil.fr |jonathan.druart@biblibre.co | |m --- Comment #7 from Jonathan Druart <jonathan.druart@biblibre.com> --- I will try to provide a global fix for this permission. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #8 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 27218 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27218&action=edit Bug 12080: Fix C4::Serials::can_edit_subscription This patch adds some unit tests for the can_edit_subscription and add a new can_show_subscription subroutines. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #9 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 27219 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27219&action=edit Bug 12080: Refactor can_*_subscription in C4::Serials -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #10 from Jonathan Druart <jonathan.druart@biblibre.com> --- I tried to do something for this permission, the can_edit_subscription was broken and I think we need a can_show_subscription. I added/modified these 2 routines in 2 last patches. I will be afk for 1 week and not able to continue. So you can obsolete my patch and continue with the signoff one, or continue with my patches. I will reopen a new report with these 2 patches if you decide to fix only the SearchSubscriptions routine. Feel free to do what you want and sorry not to provide a complete patch. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jonathan.druart@biblibre.co |frederic@tamil.fr |m | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |12098 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #11 from Frédéric Demians <frederic@tamil.fr> --- (In reply to Jonathan Druart from comment #10)
I will be afk for 1 week and not able to continue. So you can obsolete my patch and continue with the signoff one, or continue with my patches.
I will obsolete your patches. I have tested them. It works, and solves problem 2 described by Katrin. And last but not lease, you two functions add clarity to the code. But I think that another bug number, with your patch, specifically for problem 2, is more manageable for RM, especially since my patch is already dependent on bug 12048.
I will reopen a new report with these 2 patches if you decide to fix only the SearchSubscriptions routine.
See bug 12098 for attaching your patch. I'd be glad to sign-of it. Thanks. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27218|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27219|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #12 from Frédéric Demians <frederic@tamil.fr> --- I've reverted to Signed-off, since it was the case before Jonathan new patch, which should land now on bug 12098. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27135|0 |1 is obsolete| | --- Comment #13 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 27279 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27279&action=edit [PASSED QA] Bug 12080 Superserials permission in search result Enabling/disabling IndependentBranch syspref & superserials permission, you can see that serials search result doesn't display all subscriptions when appropriate. Fixed with this patch. Dependency: This patch must be applied after patch for bug 12048. TEST PLAN --------- 1) Apply the patch for bug 12048 (as needed -- it may be pushed) 2) Ensure you have two users: superlibrarian, non-superlibrarian with all access to the staff client except superserials. 3) Ensure you have serials belonging to a different branch than the non-superlibrarian. 3) Log into staff client as superlibrarian 4) Click 'Serials' 5) Click the 'Submit' button in the search area. -- note the number of results. 6) Log into staff client as non-superlibrarian 7) Click 'Serials' 8) Click the 'Submit' button in the search area. -- note the number should be less, note the number. 9) Give the non-superlibrarian superserials access. 10) Home -> Serials 11) Click the 'Submit' button in the search area. -- the number will still be the same at the one in step #8. 12) Apply the patch 13) Refresh the page -- the number should now match the one in step #5. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #14 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 27284 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27284&action=edit Bug 12080 [QA Followup] - Bookseller.t fails -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27284|0 |1 is obsolete| | --- Comment #15 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 27286 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27286&action=edit Bug 12080 [QA Followup] - Bookseller.t fails -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #27286|0 |1 is obsolete| | --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 27287 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=27287&action=edit Bug 12080 [QA Followup] - Bookseller.t fails Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Fixes the tests as promised. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I am aware the new follow up changes Serials.pm - I am going to test this altogether with bug 12048 on bug 12098. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |gmcharlt@gmail.com --- Comment #18 from Galen Charlton <gmcharlt@gmail.com> --- Pushed to master. Thanks, Frédéric! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12080 Fridolin SOMERS <fridolyn.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |fridolyn.somers@biblibre.co | |m --- Comment #19 from Fridolin SOMERS <fridolyn.somers@biblibre.com> --- Pushed to 3.14.x, will be in 3.14.10 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org