[Bug 37378] New: Patron searches can fail when library groups are set to 'Limit patron data access by group '
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Bug ID: 37378 Summary: Patron searches can fail when library groups are set to 'Limit patron data access by group ' Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com To recreate: 1. Setup a library group and check the "Limit patron data access by group ." option. 2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL ) 3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries" 4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL ) 5. Log in as that patron and attempt a patron search that would include users from either library in step 2. 6. See the error: Something went wrong when loading the table. 500: Internal Server Error. Expected boolean - got null. Expected boolean - got null. Expected string - got null. Expected string - got null. Expected string - got null. Expected integer - got null. Expected integer - got null. Expected integer - got null. Expected boolean - got null. Expected boolean - got null. Expected string - got null. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 AspenCat Team <aspencatteam@clicweb.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aspencatteam@clicweb.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #1 from AspenCat Team <aspencatteam@clicweb.org> --- We can't operate in our consortial setting the way we need to until this fixed. We need the ability to not view patrons from other branches. - Bob Bennhoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #2 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Bug 37368 has a note that makes me think it might be related - even a fix maybe? This patch adds the missing library embed from the patron search forms. This embed is required for the case where a patron is missing both first and last name or is from a different library group and thus falls into the 'Patron from library X' block. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 holly@bywatersolutions.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |holly@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #3 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 169411 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169411&action=edit Bug 37378: Unit test -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #4 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 169412 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169412&action=edit Bug 37378: libraries_where_can_see_things should always return an array The subroutine libraries_where_can_see_things stores the list of libraries that things can be viewed from in an internal variable, so we can return this directly if we have already calculated. When returning if not cached, we dereference the list and return an array. If cached, we are returning an arrayref. This patch simply ensures we dereference the array even if already cached. Before this patch, we were fetching the patrons, then redacting all info as their branches didn't match against an arrayref, rather than checking against each branch we are allowed to view. To test: 1. Setup a library group and check the "Limit patron data access by group ." option. 2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL ) 3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries" 4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL ) 5. Log in as that patron and attempt a patron search that would include users from either library in step 2. 6. See the error: Something went wrong when loading the table. 500: Internal Server Error. Expected boolean - got null. Expected boolean - got null. Expected string - got null. Expected string - got null. Expected string - got null. Expected integer - got null. Expected integer - got null. Expected integer - got null. Expected boolean - got null. Expected boolean - got null. Expected string - got null. 7. Apply patch, restart all 8. Search again, you can see the expected patrons -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #5 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 169413 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169413&action=edit Bug 37378: Tidy -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Assignee|koha-bugs@lists.koha-commun |nick@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |critical -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #6 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #2)
Bug 37368 has a note that makes me think it might be related - even a fix maybe?
This patch adds the missing library embed from the patron search forms. This embed is required for the case where a patron is missing both first and last name or is from a different library group and thus falls into the 'Patron from library X' block.
Nope, this is unrelated. We limit the search by libraries that can be seen, then redact any patrons we can't see - that redaction breaks the api response as it blanks fields that should not be null We don't need to redact in this case, because we already limited to visible libraries, we just didn't get the list correctly -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |29523 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29523 [Bug 29523] Add a way to prevent embedding objects that should not be allowed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169411|0 |1 is obsolete| | --- Comment #7 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 169430 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169430&action=edit Bug 37378: Unit test Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169412|0 |1 is obsolete| | --- Comment #8 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 169431 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169431&action=edit Bug 37378: libraries_where_can_see_things should always return an array The subroutine libraries_where_can_see_things stores the list of libraries that things can be viewed from in an internal variable, so we can return this directly if we have already calculated. When returning if not cached, we dereference the list and return an array. If cached, we are returning an arrayref. This patch simply ensures we dereference the array even if already cached. Before this patch, we were fetching the patrons, then redacting all info as their branches didn't match against an arrayref, rather than checking against each branch we are allowed to view. To test: 1. Setup a library group and check the "Limit patron data access by group ." option. 2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL ) 3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries" 4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL ) 5. Log in as that patron and attempt a patron search that would include users from either library in step 2. 6. See the error: Something went wrong when loading the table. 500: Internal Server Error. Expected boolean - got null. Expected boolean - got null. Expected string - got null. Expected string - got null. Expected string - got null. Expected integer - got null. Expected integer - got null. Expected integer - got null. Expected boolean - got null. Expected boolean - got null. Expected string - got null. 7. Apply patch, restart all 8. Search again, you can see the expected patrons Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169413|0 |1 is obsolete| | --- Comment #9 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 169432 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169432&action=edit Bug 37378: Tidy Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37392 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37392 [Bug 37392] Edit item permission by library group is broken -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169430|0 |1 is obsolete| | --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 169711 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169711&action=edit Bug 37378: Unit test Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169431|0 |1 is obsolete| | --- Comment #11 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 169713 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169713&action=edit Bug 37378: libraries_where_can_see_things should always return an array The subroutine libraries_where_can_see_things stores the list of libraries that things can be viewed from in an internal variable, so we can return this directly if we have already calculated. When returning if not cached, we dereference the list and return an array. If cached, we are returning an arrayref. This patch simply ensures we dereference the array even if already cached. Before this patch, we were fetching the patrons, then redacting all info as their branches didn't match against an arrayref, rather than checking against each branch we are allowed to view. To test: 1. Setup a library group and check the "Limit patron data access by group ." option. 2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL ) 3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries" 4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL ) 5. Log in as that patron and attempt a patron search that would include users from either library in step 2. 6. See the error: Something went wrong when loading the table. 500: Internal Server Error. Expected boolean - got null. Expected boolean - got null. Expected string - got null. Expected string - got null. Expected string - got null. Expected integer - got null. Expected integer - got null. Expected integer - got null. Expected boolean - got null. Expected boolean - got null. Expected string - got null. 7. Apply patch, restart all 8. Search again, you can see the expected patrons Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169432|0 |1 is obsolete| | --- Comment #12 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 169714 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169714&action=edit Bug 37378: Tidy Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |martin.renvoize@ptfs-europe | |.com --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks Nick.. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Patron searches can fail |Patron searches can fail |when library groups are set |when library groups are set |to 'Limit patron data |to 'Limit patron data |access by group ' |access by group' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.04 released in| | Status|Pushed to main |Pushed to stable --- Comment #15 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|24.11.00,24.05.04 |24.11.00,24.05.04,23.11.09 released in| | CC| |fridolin.somers@biblibre.co | |m --- Comment #16 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.09 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #17 from wainuiwitikapark@catalyst.net.nz --- Not backporting to 23.05.x unless requested -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37378 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldstable |RESOLVED --- Comment #18 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11 unless requested -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org