[Bug 7648] New: staff can make themselves superlibrarians
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 Priority: P5 - low Change sponsored?: --- Bug ID: 7648 CC: gmcharlt@gmail.com Assignee: kyle.m.hall@gmail.com Summary: staff can make themselves superlibrarians QA Contact: koha.sekjal@gmail.com Severity: normal Classification: Unclassified OS: All Reporter: nengard@gmail.com Hardware: All Status: NEW Version: master Component: Patrons Product: Koha This seems like an oversight to me, but if you give a staff patron the ability to set permissions for other staff members they can then update their own permissions and make themselves superlibrarians. I would say that only superlibrarians can make other staff superlibrarians, and I'd go even further to say that only superlibrarians should be able to change their own permissions - but I think this is probably due for some discussion either way because it's a pretty big oversight. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> --- I don't think it's an oversight, if you trust people enough to let them set staff permissions for others, including making others super librarians. I think it's fair to trust them to not act unethically with their own permissions. If you can't trust them to not escalate their own permissions, there is no way you should give them permission to change others. Maybe just fire people who act unethically. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 --- Comment #2 from Nicole C. Engard <nengard@gmail.com> --- I would say that giving superlibrarian permissions needs to be another permission. If you're in a consortium you have to let someone at each branch set permissions for their staff, but you don't want them going in and changing the system preferences, and if they can assign superlibrarian permissions then they can access the system preferences. And no matter how many times I tell people to fire those in their libraries who don't follow the rules they won't. Instead they'd like more protection on the system. Nicole -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> --- (In reply to comment #2)
I would say that giving superlibrarian permissions needs to be another permission. If you're in a consortium you have to let someone at each branch set permissions for their staff, but you don't want them going in and changing the system preferences, and if they can assign superlibrarian permissions then they can access the system preferences.
What about giving yourself every permission except superlibrarian .. how many are you allowed to set with the permission to set permissions. You would have to disable the management permissions to in your case above.
And no matter how many times I tell people to fire those in their libraries who don't follow the rules they won't. Instead they'd like more protection on the system.
Definitely not a bug, perhaps a possible enhancement, but would have to be done in a way that doesn't annoy the rest of the world who have staff they can actually trust. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 Nicole C. Engard <nengard@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=10537 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=6846 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org