[Bug 43301] New: Koha::Patron->libraries_where_can_see_things() returns incorrect results
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 Bug ID: 43301 Summary: Koha::Patron->libraries_where_can_see_things() returns incorrect results Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Target Milestone: --- If you create a number of overdues and then go to /cgi-bin/koha/circ/overdue.pl with a user account that doesn't have borrowers > view_borrower_infos_from_any_libraries permission, you will see overdues for all libraries, but you can only filter "Library of the patron" from your own library. This is because "Koha::Patron->libraries_where_can_see_things" returns only the user's branchcode if there are no library groups defined, which... makes no sense. If there are no library groups, then all library branches should be returned. It gets worse... if there is at least 1 library group defined, the patrons from any other branch but your own will have their information hidden (eg A patron from library) even if that library group has no libraries in it! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=28005 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |23356 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23356 [Bug 23356] IndependentBranches: overdues list -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 Olivia Reynolds <olivia.reynolds@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |olivia.reynolds@openfifth.c | |o.uk --- Comment #1 from Olivia Reynolds <olivia.reynolds@openfifth.co.uk> --- I've definitely been baffled by the behaviour of this function before. I think the most confusing thing is the "spooky action at a distance" where if you add a library to a group it can get access to every resource not covered by that group: `if ( $library_groups->count )` is true but none of those groups match the relevant feature so no restrictions are added for them. I've experimented with making the behaviour more logical, but every change I've made has failed an explicit group permission test somewhere which makes me worry people depend on the current implementation. For example, `t/db_dependent/Koha/Patrons.t` line 1898 asserts that you can only see your library if it's not in a group, and line 1847 asserts you can see libraries outside of your group if that group doesn't have the relevant feature. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- (In reply to Olivia Reynolds from comment #1)
I've experimented with making the behaviour more logical, but every change I've made has failed an explicit group permission test somewhere which makes me worry people depend on the current implementation. For example, `t/db_dependent/Koha/Patrons.t` line 1898 asserts that you can only see your library if it's not in a group, and line 1847 asserts you can see libraries outside of your group if that group doesn't have the relevant feature.
I have that same worry... People depend on the current implementation. The current implementation has incorrect behaviour. Thus, people depend on an implementation with incorrect behaviour. People depend on the implementation's incorrect behaviour. The incorrect behaviour can be changed. Therefore, changing the implementation will affect the behaviour people depend on. And on we go... -- I suppose one solution is to change the behaviour, but only for the next major release. That we don't backport the change, and we make sure the release notes *clearly states* that user data visibility will change. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Alternatively, we wait to handle this via Bug 20813 - Revamp user permissions system -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lisette@bywatersolutions.co | |m -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org