[Bug 13663] New: offline circ permission issue
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Bug ID: 13663 Summary: offline circ permission issue Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: Circulation Assignee: jonathan.druart@biblibre.com Reporter: jonathan.druart@biblibre.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com circ/offline.pl needs the perm circulate_remaining_permissions but tools/upload-file.pl needs tools => * That means a librarian cannot upload the .koc files generated offline -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #1 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 35661 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35661&action=edit Bug 13663: allow a librarian with circulate_remaining_permissions to upload koc files The tools/upload-file.pl script require one of the tools permissions to upload koc files. This script is called by offline_circ/process_koc.pl which requires circulate_remaining_permissions. It does not make sense to require another permission for this script. Test plan: Verify that the circulate_remaining_permissions perm is enough to upload .koc file. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35661|0 |1 is obsolete| | --- Comment #2 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 35882 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=35882&action=edit Bug 13663: allow a librarian with circulate_remaining_permissions to upload koc files The tools/upload-file.pl script require one of the tools permissions to upload koc files. This script is called by offline_circ/process_koc.pl which requires circulate_remaining_permissions. It does not make sense to require another permission for this script. Test plan: Verify that the circulate_remaining_permissions perm is enough to upload .koc file. Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de Status|Signed Off |Failed QA --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- If the patron doesn't have any tools permission, you have to log in again after uploading the file. I think this is because upload-file-progress.pl still requires the tool permission. Are we sure those files are only used for the offline circulation file upload? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #4 from Jonathan Druart <jonathan.druart@biblibre.com> --- (In reply to Katrin Fischer from comment #3)
If the patron doesn't have any tools permission, you have to log in again after uploading the file.
I think this is because upload-file-progress.pl still requires the tool permission.
Are we sure those files are only used for the offline circulation file upload?
Hum, I was sure I tested that, but actually you are right, the file is used by other scripts: upload-file.pl is used in file-upload.in which is used in - offline_circ/process_koc.tt - tools/stage-marc-import.tt - tools/upload-images.tt So this patch does not fix the problem correctly. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 claire.hernandez@biblibre.com <claire.hernandez@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jonathan.druart@biblibre.co |claire.hernandez@biblibre.c |m |om CC| |claire.hernandez@biblibre.c | |om -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alex.arnaud@biblibre.com --- Comment #5 from Alex Arnaud <alex.arnaud@biblibre.com> --- (In reply to Jonathan Druart from comment #4)
Hum, I was sure I tested that, but actually you are right, the file is used by other scripts: upload-file.pl is used in file-upload.in which is used in - offline_circ/process_koc.tt - tools/stage-marc-import.tt - tools/upload-images.tt
So this patch does not fix the problem correctly.
So, we don't need to check permissions again in upload-file.pl since we did it in offline_circ/process_koc.pl, tools/stage-marc-import.pl and tools/upload-cover-image.pl ? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I don't feel comfortable with 'not checking' - maybe just check that one of the needed permissions is given? - circulate_remaining_permissions - stage marc import - upload images -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #7 from Alex Arnaud <alex.arnaud@biblibre.com> --- @Katrin: It's not about "not checking" because, if i'm not wrong, it's not possible to access/use upload-file.pl without a least one of these 3 permissions since they are checked before. The question is: Why checking them once again in upload-file.pl? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I guess it just doesn't sound very clean :) And someone without the proper permissions might be able to access the script then? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #9 from Alex Arnaud <alex.arnaud@biblibre.com> --- Oh yes, indeed, just seen that could be a security problem. So, why not check only catalogue permission (Which is the one required to access staff interface iirc)? I feel better with that because we won't need to update upload-file.pl and upload-file-progress.pl permissions each time we add a new page requiring these files with an other permission. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I don't think we will add more very often - I'd like it better if it was limited to the 3 permissions linked to the features. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #35882|0 |1 is obsolete| | --- Comment #11 from Alex Arnaud <alex.arnaud@biblibre.com> --- Created attachment 40089 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40089&action=edit Bug 13663 - Fix permissions in upload-file.pl and upload-file-progress.pl -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Alex Arnaud <alex.arnaud@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|claire.hernandez@biblibre.c |alex.arnaud@biblibre.com |om | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Indranil Das Gupta <indradg@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40089|0 |1 is obsolete| | --- Comment #12 from Indranil Das Gupta <indradg@gmail.com> --- Created attachment 40123 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40123&action=edit Bug 13663 - Fix permissions in upload-file.pl and upload-file-progress.pl Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Indranil Das Gupta <indradg@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |indradg@gmail.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #13 from Indranil Das Gupta <indradg@gmail.com> --- Created attachment 40124 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40124&action=edit (followup) fixes tab char QA test fails Fixes the tab char qa test suite fails in the following files: 1/ tools/upload-file-progress.pl 2/ tools/upload-file.pl -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #14 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- I think Bug 6874 will impact this bug -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=6874 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40123|0 |1 is obsolete| | Attachment #40124|0 |1 is obsolete| | --- Comment #15 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 41380 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=41380&action=edit Bug 13663 - Fix permissions in upload-file.pl and upload-file-progress.pl Test plan: Verify that the circulate_remaining_permissions perm is enough to upload .koc file. Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #16 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 41381 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=41381&action=edit Bug 13663: (followup) fixes tab char QA test fails Fixes the tab char qa test suite fails in the following files: 1/ tools/upload-file-progress.pl 2/ tools/upload-file.pl Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Amended patch: tidy whitespaces -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |tomascohen@gmail.com --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Patches pushed to master. Thanks Alex! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #18 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.20.x will be in 3.20.3 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 --- Comment #19 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- (In reply to Fridolin SOMERS from comment #14)
I think Bug 6874 will impact this bug In the end no, the feature does not use upload-file.pl nor upload-file-progress.pl
-- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13663 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com --- Comment #20 from Mason James <mtj@kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.14 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org