[Bug 34288] New: Cannot use cataloguing tools without cataloguing permissions
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Bug ID: 34288 Summary: Cannot use cataloguing tools without cataloguing permissions Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org As a side effect of moving the `cataloguing tools` to the cataloguing section, there's no way for a patron with all `tools permissions` to use the cataloguing tools. To reproduce: 1. Have a patron with only 'catalogue' and 'tools' permissions. 2. Log into the staff interface => FAIL: You cannot access the Cataloguing section, thus have no access to the cataloguing tools 3. Point your browser to: http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/tools/batchMod.pl http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/labels/label-home.pl => SUCCESS: You actually have permissions to access the tool -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|koha-bugs@lists.koha-commun |tomascohen@gmail.com |ity.org | CC| |aleisha@catalyst.net.nz, | |martin.renvoize@ptfs-europe | |.com, | |nick@bywatersolutions.com, | |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #1 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 153527 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153527&action=edit Bug 34288: Add CAN_user_tools to Cataloging home link This patch adds the CAN_user_tools permissions check to the options checked when infering whether to display the Catagloging module link on the staff interface main page. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |31162 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31162 [Bug 31162] Add a clear cataloguing module home page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|tomascohen@gmail.com |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED --- Comment #2 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Marking as assigned, there are some edge cases I've already been working on. Writing the unit tests now. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #153527|0 |1 is obsolete| | --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 153560 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153560&action=edit Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 153561 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153561&action=edit Bug 34288: (follow-up) Tidy block -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 153562 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153562&action=edit Bug 34288: Unit tests -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|martin.renvoize@ptfs-europe |tomascohen@gmail.com |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #153560|0 |1 is obsolete| | Attachment #153561|0 |1 is obsolete| | Attachment #153562|0 |1 is obsolete| | --- Comment #6 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 153565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153565&action=edit Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #7 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 153566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153566&action=edit Bug 34288: (follow-up) Tidy block Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #8 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 153567 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153567&action=edit Bug 34288: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #9 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Looking at the fastadd cataloging side of this is making me wonder if the page permissions are still wrong for that case.. we show the link from the home page with `( fast_cataloging && CAN_user_editcatalogue_fast_cataloging )` but then inside the page itself we're looking for 'editcatalogue' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Ah.. my mistake.. I think `editcatalogue => '*'` covers it as a subpermission 'any' case -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #153565|0 |1 is obsolete| | --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 153571 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153571&action=edit Bug 34288: Allow access to the cataloguing module with `tools` permission Bug 31162 moved the cataloguing tools to a new cataloguing module home page. This prevents people without cataloguing permissions, but with some tools permissions to access things like the labels creator tool. I tracked all permissions on the cataloging-home.tt template, including the Stock Rotation ones which I initially missed because I was focusing on tools. This patch makes the cataloging-home.pl page require either 'cataloguing' or any relevant 'tools' permission to allow access. the page. The staff interface main page and the top bar dropdown are updated using the same logic to display the cataloguing module link. For that purpose, I wrapped the permissions on a sub in `C4::Auth`. To test: 1. Have a patron with only 'catalogue' and some of this permissions: * inventory * items_batchdel * items_batchmod * items_batchmod * label_creator * manage_staged_marc * marc_modification_templates * records_batchdel * records_batchmod * stage_marc_import * upload_cover_images * stockrotation => manage_rotas 2. Log in => FAIL: No link to the cataloguing module, neither in the dropdown 3. Apply this patch 4. Repeat 2 => SUCCESS: You have the link! 5. Play with the different combinations and notice things are sound and correct 6. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #153566|0 |1 is obsolete| | --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 153572 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153572&action=edit Bug 34288: (follow-up) Tidy block Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #153567|0 |1 is obsolete| | --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 153573 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=153573&action=edit Bug 34288: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks Tomas.. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |23.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #15 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 23.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbrannon@cdalibrary.org --- Comment #16 from Christopher Brannon <cbrannon@cdalibrary.org> --- Please backport this to 22.11. We can't live with this issue for a year. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=34306 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Christopher Brannon from comment #16)
Please backport this to 22.11. We can't live with this issue for a year. :)
:-P -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|23.11.00 |23.11.00,23.05.02 released in| | Status|Pushed to master |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #18 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to 23.05.x for the next release -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|23.11.00,23.05.02 |23.11.00,23.05.02,22.11.08 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #19 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Nice work everyone! Pushed to oldstable for 22.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #20 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Matt Blenkinsop from comment #19)
Nice work everyone!
Pushed to oldstable for 22.11.x
Nice! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |lucas@bywatersolutions.com Status|Pushed to oldstable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #21 from Christopher Brannon <cbrannon@cdalibrary.org> --- Hmmmm....I can still get to the spine label tools without having permission to them. Is something still broken? I'm on 22.11.8 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #22 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Christopher Brannon from comment #21)
Hmmmm....I can still get to the spine label tools without having permission to them. Is something still broken? I'm on 22.11.8
FYI, if I just have a link to the spine label page, I get in and can use it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |34790 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34790 [Bug 34790] Wrong permission check for labels tools -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #23 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to Christopher Brannon from comment #22)
(In reply to Christopher Brannon from comment #21)
Hmmmm....I can still get to the spine label tools without having permission to them. Is something still broken? I'm on 22.11.8
FYI, if I just have a link to the spine label page, I get in and can use it.
Filed bug 34288 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34288 --- Comment #24 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to Nick Clemens from comment #23)
(In reply to Christopher Brannon from comment #22)
(In reply to Christopher Brannon from comment #21)
Hmmmm....I can still get to the spine label tools without having permission to them. Is something still broken? I'm on 22.11.8
FYI, if I just have a link to the spine label page, I get in and can use it.
Filed bug 34288
I mean bug 34790 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org