https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Chanel Wheeler <chanel.wheeler@yavapaiaz.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chanel.wheeler@yavapaiaz.go | |v --- Comment #1 from Chanel Wheeler <chanel.wheeler@yavapaiaz.gov> --- +1 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Michelle Spinney <mspinney@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mspinney@clamsnet.org -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #3 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 186301 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186301&action=edit Bug 35830: Add merge_borrowers subpermission Merging patrons only required edit_borrowers permission but would result in a patron deletion. This patch requires a new merge_borrowers subpermission To test: 1. Give a patron the following permissions catalogue, edit_borrowers, list_borrowers 2. Log into the staff interface as the patron 3. Do a patron search and select 2 patrons 4. Click merge patron - success - a patron got deleted 5. Apply patch, updatedatabase and restart_all 6. Repeat steps 3 and 4 - you can't 7. Add the new permission for merge_borrowers 8. Repeat steps 3 and 4 - now you can 9. prove t/Koha/Auth/Patrons.t -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #186301|0 |1 is obsolete| | --- Comment #4 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 186302 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186302&action=edit Bug 35830: Add merge_borrowers subpermission Merging patrons only required edit_borrowers permission but would result in a patron deletion. This patch requires a new merge_borrowers subpermission To test: 1. Give a patron the following permissions catalogue, edit_borrowers, list_borrowers 2. Log into the staff interface as the patron 3. Do a patron search and select 2 patrons 4. Click merge patron - success - a patron got deleted 5. Apply patch, updatedatabase and restart_all 6. Repeat steps 3 and 4 - you can't 7. Add the new permission for merge_borrowers 8. Repeat steps 3 and 4 - now you can 9. prove t/Koha/Auth/Patrons.t Sponsored-by: CLAMS -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #5 from Brendan Lawlor <blawlor@clamsnet.org> --- Setting to needs sign off for feedback. I know I need to add the atomic update in a separate commit. I think this might also need to update the database to give the new merge_borrowers permission to everyone who currently has the delete_borrowers permission. Or should it just give merge_borrowers to everyone with edit_borrowers because that's the current way it is? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #7 from Brendan Lawlor <blawlor@clamsnet.org> --- I added an insert statement to the atomic update to add the merge_borrowers permission for all users who currently have the edit_borrowers permission This makes the behavior for for existing installations consistent with the current functionality. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.11.00 released in| | Status|Passed QA |Pushed to main --- Comment #22 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Pushed to main for 25.11.00 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Pushed to oldoldoldstable -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Andrii Nugged <nugged@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nugged@gmail.com --- Comment #23 from Andrii Nugged <nugged@gmail.com> --- Might be only mine specific data configuration, but on my dataset atomic update crashed: ``` Upgrade to 25.06.00.028 [00:37:40]: Bug 35830 - Add permission borrowers:merge_borrowers Added new permission 'merge_borrowers' ERROR: {UNKNOWN}: DBI Exception: DBD::mysql::db do failed: Duplicate entry '281100-4-merge_borrowers' for key 'PRIMARY' at /usr/share/koha/lib/C4/Installer.pm line 825 ``` writing this urgently here, because if this is potential atomic update crash, it will lock up Kohas for people around the world. But this might be false alarm. Investigating: I will research for a workday and give my findings, how this is critical. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #25 from Andrii Nugged <nugged@gmail.com> --- .. I did fixed my server with patching this SQL INSERT as "IGNORE": ``` q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, module_bit, 'merge_borrowers' FROM user_permissions where module_bit = 4 and code = 'edit_borrowers';} ``` and re-run `apt-get upgrade`, all passed. Not sure this is the cleanest way for now, but this might be workarounder for other non-deep-Koha people who come here from the websearch one day too. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #27 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I think the missing bit is that the database update cannot be run multiple times at the moment, which we need to fix. Correct? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Katie Bliss <kebliss@dmpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kebliss@dmpl.org -- You are receiving this mail because: You are watching all bug changes.

From a packager point of view (e.g. .deb builds) it’s great that this has now been fixed in all relevant branches as quickly as it was, and I don't know how many shipped and potential overlays around the world, but I am just noting

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 --- Comment #29 from Andrii Nugged <nugged@gmail.com> --- ... Lucas (@lukeg) has now added fixes for all affected branches in Bug 41421 by changing the `user_permissions` statement to `INSERT IGNORE` in each branch, so that re-running the update (or running it twice across different branches) simply skips rows that already exist instead of throwing an error. I’m OK with the `INSERT IGNORE` approach here — it makes this update properly idempotent and unblocks all the upgrade paths. Minor downsides I can see is that: - if there ever were some unexpected data issues or duplicates in `user_permissions`, they would now be silently skipped instead of failing loudly, and - `updatedatabase` will still print “Added 'merge_borrowers' permission to existing users with 'edit_borrowers'” even on subsequent runs where no new rows are actually inserted. For this very narrow case I think that trade-off is acceptable, especially given how important it is that we deliver it asap for installs on a broken upgrade path. this, not a question. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35830 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Documentation| |Martin Renvoize contact| | -- You are receiving this mail because: You are watching all bug changes.