[Bug 42542] New: budget_add_del is incorrectly required to edit a budget
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 Bug ID: 42542 Summary: budget_add_del is incorrectly required to edit a budget Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: baptiste.wojtkowski@biblibre.com QA Contact: testopia@bugs.koha-community.org Add and delete funds (but can't modify funds) (budget_add_del) is required to load page "http://your_ktd_instance:8081/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_id=1&budget_period_id=1", which is the link created while *modifying* a budget. I'm not sure about the correct behaviour for a safe way to protect this page, feel free to comment/amend the patch STEPS TO REPRODUCE: 1 - As a superuser edit the rights of Henry Acevedo. Set followings: Staff access, allows viewing of catalogue in staff interface (catalogue) Manage funds (budget_manage) Modify funds (can't create lines, but can modify existing ones) (budget_modify) 2 - Visit http://koha-ktd:8081/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=1 click on Actions->Edit 3 - Nothing happens 4 - add permission budget_add_del and repeat 2 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=24414 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 --- Comment #1 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 198669 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198669&action=edit Bug 42542: budget_add_del is not necessary anymore to edit fund TEST PLAN: 1 - As a superuser edit the rights of Henry Acevedo. Set followings: Staff access, allows viewing of catalogue in staff interface (catalogue) Manage funds (budget_manage) Modify funds (can't create lines, but can modify existing ones) (budget_modify) 2 - Visit http://koha-ktd:8081/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=1 click on Actions->Edit 3 - Nothing happens 4 - Apply patch 5 - Repeat 2 6 - Visit /cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_period_id=1, notice a new message. 7 - Remove both rights and visit /cgi-bin/koha/admin/aqbudgets.pl?op=add_form&budget_id=1&budget_period_id=1, notice you don't have rights -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |baptiste.wojtkowski@biblibr |ity.org |e.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42542 Chris Mathevet <chris.mathevet@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris.mathevet@inLibro.com Status|Needs Signoff |Failed QA --- Comment #2 from Chris Mathevet <chris.mathevet@inLibro.com> --- I was testing your patch when I found out that if a patron have the permissions "budget_manage" and "budget_modify" but not "budget_add_del", the patron can delete the fund. After that I realised that it was present before your patch. In addition, when a patron have the permissions "budget_manage" and "budget_add_del" but not "budget_modify", the "actions" button does not appear. I think it will be better to also fix that in that patch. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org