[Bug 39453] New: Add attribute type settings for restricting access to extended attributes
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 Bug ID: 39453 Summary: Add attribute type settings for restricting access to extended attributes Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: glasklas@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com This patch introduces a "readonly", "secret" and "hidden" setting for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page, and could be used for sensitive data not all staff members should have access to. One use case (at our library) is to emulate a role based access control by having a number of reserved users as templates for roles. We then have a number of hidden attributes mapping users to these "roles", and a script running nightly that assigns permissions based on this mapping. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #1 from David Gustafsson <glasklas@gmail.com> --- Created attachment 179705 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179705&action=edit Bug 39453: Add attribute type settings for restricting access to extended attributes Add new attribute type settings "readonly", "secret" and "hidden" for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page. To Test: 1) Apply patch 3) Three new attribute type, each with one of the new settings set. 4) In addition to this create an attribute type which is a date, and set this to readonly. 5) As a superlibrarian, edit a patron and set values for the attributes of these types6) Log in as a non superlibrarian. Go to the same patron and verify that: 7) The attributes that are readonly can be viewd in the patrons details page, and when editing the patron, but their value can't be changed. 8) The hidden attribute should appear nowhere. 9) The secret attribute should be visible in the patrons details page, but masked. It should not appear when editing the patron. 10) Edit the patrons extended patron and save. 11) Log in as a superlibrarian, go to the patrons details page and verify the extended attribute values remains the same. Sponsored-by: Gothenburg University Library -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #2 from David Gustafsson <glasklas@gmail.com> --- Created attachment 179706 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179706&action=edit Bug 39453: Schema changes -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |glasklas@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179705|0 |1 is obsolete| | --- Comment #3 from David Gustafsson <glasklas@gmail.com> --- Created attachment 179746 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179746&action=edit Bug 39453: Add attribute type settings for restricting access to extended attributes Add new attribute type settings "readonly", "secret" and "hidden" for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page. To Test: 1) Apply patch 3) Three new attribute type, each with one of the new settings set. 4) In addition to this create an attribute type which is a date, and set this to readonly. 5) As a superlibrarian, edit a patron and set values for the attributes of these types6) Log in as a non superlibrarian. Go to the same patron and verify that: 7) The attributes that are readonly can be viewd in the patrons details page, and when editing the patron, but their value can't be changed. 8) The hidden attribute should appear nowhere. 9) The secret attribute should be visible in the patrons details page, but masked. It should not appear when editing the patron. 10) Edit the patrons extended patron and save. 11) Log in as a superlibrarian, go to the patrons details page and verify the extended attribute values remains the same. Sponsored-by: Gothenburg University Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179706|0 |1 is obsolete| | --- Comment #4 from David Gustafsson <glasklas@gmail.com> --- Created attachment 179747 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179747&action=edit Bug 39453: Schema changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Patch doesn't apply CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179746|0 |1 is obsolete| | --- Comment #5 from David Gustafsson <glasklas@gmail.com> --- Created attachment 189834 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189834&action=edit Bug 39453: Add attribute type settings for restricting access to extended attributes Add new attribute type settings "readonly", "secret" and "hidden" for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page. To Test: 1) Apply patch 3) Three new attribute type, each with one of the new settings set. 4) In addition to this create an attribute type which is a date, and set this to readonly. 5) As a superlibrarian, edit a patron and set values for the attributes of these types6) Log in as a non superlibrarian. Go to the same patron and verify that: 7) The attributes that are readonly can be viewd in the patrons details page, and when editing the patron, but their value can't be changed. 8) The hidden attribute should appear nowhere. 9) The secret attribute should be visible in the patrons details page, but masked. It should not appear when editing the patron. 10) Edit the patrons extended patron and save. 11) Log in as a superlibrarian, go to the patrons details page and verify the extended attribute values remains the same. Sponsored-by: Gothenburg University Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179747|0 |1 is obsolete| | --- Comment #6 from David Gustafsson <glasklas@gmail.com> --- Created attachment 189835 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189835&action=edit Bug 39453: Schema changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff --- Comment #7 from David Gustafsson <glasklas@gmail.com> --- Rebased against main. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189834|0 |1 is obsolete| | --- Comment #8 from David Gustafsson <glasklas@gmail.com> --- Created attachment 193061 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193061&action=edit Bug 39453: Add attribute type settings for restricting access to extended attributes Add new attribute type settings "readonly", "secret" and "hidden" for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page. To Test: 1) Apply patch 3) Three new attribute type, each with one of the new settings set. 4) In addition to this create an attribute type which is a date, and set this to readonly. 5) As a superlibrarian, edit a patron and set values for the attributes of these types6) Log in as a non superlibrarian. Go to the same patron and verify that: 7) The attributes that are readonly can be viewd in the patrons details page, and when editing the patron, but their value can't be changed. 8) The hidden attribute should appear nowhere. 9) The secret attribute should be visible in the patrons details page, but masked. It should not appear when editing the patron. 10) Edit the patrons extended patron and save. 11) Log in as a superlibrarian, go to the patrons details page and verify the extended attribute values remains the same. Sponsored-by: Gothenburg University Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189835|0 |1 is obsolete| | --- Comment #9 from David Gustafsson <glasklas@gmail.com> --- Created attachment 193062 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193062&action=edit Bug 39453: Schema changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #10 from David Gustafsson <glasklas@gmail.com> --- Rebased against main. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 Anneli Österman <anneli.osterman@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Patch doesn't apply CC| |anneli.osterman@koha-suomi. | |fi --- Comment #11 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- I tried to test this on a sandbox but when I added patron attributes to a patron and tried to save the patron I got an error The method Koha::Patron->_is_superlibrarian is not covered by tests! Trace begun at /kohadevbox/koha/Koha/Object.pm line 1042 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Anneli Österman from comment #11)
I tried to test this on a sandbox but when I added patron attributes to a patron and tried to save the patron I got an error
The method Koha::Patron->_is_superlibrarian is not covered by tests!
Trace begun at /kohadevbox/koha/Koha/Object.pm line 1042
Try to reload Plack if you have added the patch after setting up the sandbox. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #13 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- I added the patch when creating the sandbox and I have restarted the services twice. Still the same outcome. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193061|0 |1 is obsolete| | --- Comment #14 from David Gustafsson <glasklas@gmail.com> --- Created attachment 193633 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193633&action=edit Bug 39453: Add attribute type settings for restricting access to extended attributes Add new attribute type settings "readonly", "secret" and "hidden" for patron attribute types. All restrictions enforced by these new settings are not applied for superlibrarians, where attributes behave as if they have not been set. Readonly make the attributes of this type readonly, they appear on the patrons details page and when editing a patron, but their values can't be changed. Hidden attributes are not visible on the patrons details page or when editing a patron, but can for example be used internally. Secret attributes are basically the same thing as hidden, but the appear with their value masked in the patrons details page. To Test: 1) Apply patch 3) Three new attribute type, each with one of the new settings set. 4) In addition to this create an attribute type which is a date, and set this to readonly. 5) As a superlibrarian, edit a patron and set values for the attributes of these types6) Log in as a non superlibrarian. Go to the same patron and verify that: 7) The attributes that are readonly can be viewd in the patrons details page, and when editing the patron, but their value can't be changed. 8) The hidden attribute should appear nowhere. 9) The secret attribute should be visible in the patrons details page, but masked. It should not appear when editing the patron. 10) Edit the patrons extended patron and save. 11) Log in as a superlibrarian, go to the patrons details page and verify the extended attribute values remains the same. Sponsored-by: Gothenburg University Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193062|0 |1 is obsolete| | --- Comment #15 from David Gustafsson <glasklas@gmail.com> --- Created attachment 193634 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193634&action=edit Bug 39453: Schema changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff --- Comment #16 from David Gustafsson <glasklas@gmail.com> --- (In reply to Anneli Österman from comment #11)
I tried to test this on a sandbox but when I added patron attributes to a patron and tried to save the patron I got an error
The method Koha::Patron->_is_superlibrarian is not covered by tests!
Trace begun at /kohadevbox/koha/Koha/Object.pm line 1042
Thanks, yes we discovered this ourselves while testing but did not get around to fix the patch until now, sorry about that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 David Gustafsson <glasklas@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED --- Comment #17 from David Gustafsson <glasklas@gmail.com> --- Found another bug, but can't submit to bugzilla right now since git bz stopped working. Haven't been able to figure out why yet, will submit the fix as soon got it working again. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39453 --- Comment #18 from David Gustafsson <glasklas@gmail.com> --- Created attachment 196923 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196923&action=edit Bug 39453: Enumerate hidden attributes Otherwise they cannot be compared when saving as a user from which the attribute is hidden -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org