[Bug 35980] New: Add message to patron needs permission check
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Bug ID: 35980 Summary: Add message to patron needs permission check Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: fridolin.somers@biblibre.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Since Bug 30230, a user can see patron details without edit_borrowers permission. In tools bar, "Add message" needs to check this permission. Maybe other places. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |30230 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30230 [Bug 30230] Search for patrons in checkout should not require edit_borrowers permission -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #1 from Fridolin Somers <fridolin.somers@biblibre.com> --- Test with authentication on staff interface with only permissions 'catalogue' and 'list_borrowers'. On a patron page try add a message => you get permission denied page. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #2 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 164433 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164433&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors 3. Apply patch, restart all, reload the page 4. Notice the buttons in the toolbar are gone -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #3 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 164434 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164434&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blawlor@clamsnet.org Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |blawlor@clamsnet.org |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #4 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 164435 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164435&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #5 from Brendan Lawlor <blawlor@clamsnet.org> --- These patches remove all the edit and add buttons that I could find that would lead to permissions errors in the patron toolbar, members tool bar and the patron details. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #164434|0 |1 is obsolete| | --- Comment #6 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 164488 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164488&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone Signed-off-by: Esther <esther@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #164435|0 |1 is obsolete| | --- Comment #7 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 164489 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164489&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there Signed-off-by: Esther <esther@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Esther Melander <esther.melander@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |esther.melander@bywatersolu | |tions.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |julian.maurice@biblibre.com QA Contact|testopia@bugs.koha-communit |julian.maurice@biblibre.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #164433|0 |1 is obsolete| | --- Comment #8 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 164623 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164623&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors 3. Apply patch, restart all, reload the page 4. Notice the buttons in the toolbar are gone Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #164488|0 |1 is obsolete| | --- Comment #9 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 164624 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164624&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone Signed-off-by: Esther <esther@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #164489|0 |1 is obsolete| | --- Comment #10 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 164625 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164625&action=edit Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there Signed-off-by: Esther <esther@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #11 from Julian Maurice <julian.maurice@biblibre.com> --- Patches work as expected and pass QA checks -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.00 |24.05.00,23.11.05 released in| | Status|Pushed to master |Pushed to stable --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 --- Comment #14 from Lucas Gass <lucas@bywatersolutions.com> --- Missing 23.05.x dependencies, no backport. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35980 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to stable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org