[Bug 5974] New: Bogus auth check for "StaffMember" role
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Bug #: 5974 Summary: Bogus auth check for "StaffMember" role Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: ASSIGNED Severity: minor Priority: P5 Component: Patrons AssignedTo: oleonard@myacpl.org ReportedBy: oleonard@myacpl.org QAContact: koha-bugs@lists.koha-community.org CC: gmcharlt@gmail.com In circ-toolbar.inc: <!-- TMPL_IF NAME="StaffMember" --> <!-- TMPL_IF NAME="CAN_user_staffaccess" --> new YAHOO.widget.Button("changepassword"); <!-- /TMPL_IF--> <!-- TMPL_ELSE--> new YAHOO.widget.Button("changepassword"); <!-- /TMPL_IF --> Besides being pointless, this refers to a "StaffMember" variable which is only defined in one place, moremember.pl, based only on the patron category. A remnant of a time before granular permissions? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> 2011-03-28 18:11:10 UTC --- Created attachment 3474 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=3474 Proposed fix -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 dev_patches@biblibre.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dev_patches@biblibre.com Patch Status|Needs Signoff |Does not apply --- Comment #2 from MJ Ray (software.coop) <mjr@ttllp.co.uk> 2011-04-02 11:41:53 UTC --- This bug is mentioned in: Fix for Bug 5974 - Bogus auth check for "StaffMember" role http://lists.koha-community.org/pipermail/koha-patches/2011-March/014287.htm... -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #3474|0 |1 is obsolete| | --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> 2011-07-08 02:57:15 UTC --- Created attachment 4590 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4590 Fix for Bug 5974 - Bogus auth check for "StaffMember" role Also removing some YAHOO.widget.Button declarations which are redundant. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz Patch Status|Does not apply |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4590|0 |1 is obsolete| | --- Comment #4 from Chris Cormack <chris@bigballofwax.co.nz> 2011-11-04 03:14:19 UTC --- Created attachment 6176 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6176 Fix for Bug 5974 - Bogus auth check for "StaffMember" role Also removing some YAHOO.widget.Button declarations which are redundant. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ian.walls@bywatersolutions. | |com Patch Status|Signed Off |Passed QA --- Comment #5 from Ian Walls <ian.walls@bywatersolutions.com> 2011-11-19 15:56:37 UTC --- Template only change, simplifies template logic and removes check for bogus value. Marking as Passed QA -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.poulain@biblibre.com Version|unspecified |rel_3_6 Patch Status|Passed QA |Patch Pushed --- Comment #6 from Paul Poulain <paul.poulain@biblibre.com> 2011-11-24 13:12:40 UTC --- patch pushed, please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 --- Comment #7 from Paul Poulain <paul.poulain@biblibre.com> 2011-11-25 13:03:21 UTC --- Created attachment 6408 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6408 follow up for trailing " -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-11-27 14:27:49 UTC --- *** Bug 7269 has been marked as a duplicate of this bug. *** -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-11-27 14:32:53 UTC --- Created attachment 6431 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6431 Bug 5974: Fix broken toolbar on paton checkout tab Fixed a couple of errors: - [% CAN_user_staffaccess %] should be [% IF ( CAN_user_staffaccess ) %] - added missing [% END %] - added missing line new YAHOO.widget.Button("duplicate"); To test: 1) Open patron account 2) Go through tabs, especially 'Check out' 3) Check toolbars are correct and buttons work -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Patch Pushed |Needs Signoff Severity|minor |normal -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-11-27 15:14:12 UTC --- Created attachment 6433 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6433 Bug 5974: Fix broken toolbar on paton checkout tab Fixed a couple of errors: - [% CAN_user_staffaccess %] should be [% IF ( CAN_user_staffaccess ) %] - added missing [% END %] - added missing line new YAHOO.widget.Button("duplicate"); To test: 1) Open patron account 2) Go through tabs, especially 'Check out' 3) Check toolbars are correct and buttons work -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6431|0 |1 is obsolete| | Attachment #6433|0 |1 is obsolete| | --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-11-27 15:14:34 UTC --- Created attachment 6434 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6434 Bug 5974: Fix broken toolbar on paton checkout tab Fixed a couple of errors: - [% CAN_user_staffaccess %] should be [% IF ( CAN_user_staffaccess ) %] - added missing [% END %] - added missing line new YAHOO.widget.Button("duplicate"); To test: 1) Open patron account 2) Go through tabs, especially 'Check out' 3) Check toolbars are correct and buttons work -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6176|0 |1 is obsolete| | Attachment #6408|0 |1 is obsolete| | Attachment #6434|0 |1 is obsolete| | --- Comment #12 from Chris Cormack <chris@bigballofwax.co.nz> 2011-11-30 07:30:13 UTC --- Created attachment 6465 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6465 Bug 5974: Fix broken toolbar on paton checkout tab Fixed a couple of errors: - [% CAN_user_staffaccess %] should be [% IF ( CAN_user_staffaccess ) %] - added missing [% END %] - added missing line new YAHOO.widget.Button("duplicate"); To test: 1) Open patron account 2) Go through tabs, especially 'Check out' 3) Check toolbars are correct and buttons work Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Signed Off |Passed QA --- Comment #13 from Ian Walls <ian.walls@bywatersolutions.com> 2011-12-01 17:22:30 UTC --- Template only change, easy to read, marking as Passed QA -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Passed QA |Patch Pushed --- Comment #14 from Paul Poulain <paul.poulain@biblibre.com> 2011-12-03 06:37:41 UTC --- follow-up pushed, please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-12-03 06:41:33 UTC --- Tested succesfully on master, waiting to close until the patch has made it into 3.6. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Nighswonger <cnighswonger@foundations.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cnighswonger@foundations.ed | |u --- Comment #16 from Chris Nighswonger <cnighswonger@foundations.edu> 2011-12-03 12:21:55 UTC --- This patch does not apply cleanly to the 3.6.x branch. If it should, please rebase over that branch and attache a corrected patch to this bug report. cnighs@erasmus:~/koha.3.2.test (3.6.x)$ git cherry-pick -x -s 9cecb7a9d30dfe Automatic cherry-pick failed. After resolving the conflicts, mark the corrected paths with 'git add <paths>' or 'git rm <paths>' and commit the result with: git commit -c 9cecb7a9d30dfeb2c39789b7493d20734647b9b6 cnighs@erasmus:~/koha.3.2.test (3.6.x *+)$ git status # On branch 3.6.x # Your branch is ahead of 'origin/3.6.x' by 9 commits. # # Unmerged paths: # (use "git reset HEAD <file>..." to unstage) # (use "git add/rm <file>..." as appropriate to mark resolution) # # both modified: koha-tmpl/intranet-tmpl/prog/en/includes/circ-toolbar.inc -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6408|1 |0 is obsolete| | -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6176|1 |0 is obsolete| | -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6176|0 |1 is obsolete| | Attachment #6408|0 |1 is obsolete| | Attachment #6465|0 |1 is obsolete| | --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-12-03 18:47:40 UTC --- Created attachment 6554 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6554 [3.6.x] Patch - includes all 3 previous patches for master All 3 patches applied without conflicts, I squashed them and checked the toolbars. No problems spotted. Perhaps another set of eyes checking would still be good. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Patch Pushed |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6554|0 |1 is obsolete| | --- Comment #18 from Chris Cormack <chris@bigballofwax.co.nz> 2011-12-06 22:46:40 UTC --- Created attachment 6625 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6625 Fix for Bug 5974 - Bogus auth check for "StaffMember" role Also removing some YAHOO.widget.Button declarations which are redundant. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> follow-up: trailing " that makes T::T fail http://bugs.koha-community.org/show_bug.cgi?id=5974 Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Bug 5974: Fix broken toolbar on paton checkout tab Fixed a couple of errors: - [% CAN_user_staffaccess %] should be [% IF ( CAN_user_staffaccess ) %] - added missing [% END %] - added missing line new YAHOO.widget.Button("duplicate"); To test: 1) Open patron account 2) Go through tabs, especially 'Check out' 3) Check toolbars are correct and buttons work Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off --- Comment #19 from Chris Cormack <chris@bigballofwax.co.nz> 2011-12-06 22:47:18 UTC --- This has already been pushed, for master, the patch here is for 3.6.x and applies cleanly there -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Chris Nighswonger <cnighswonger@foundations.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Signed Off |Patch Pushed --- Comment #20 from Chris Nighswonger <cnighswonger@foundations.edu> 2011-12-07 02:03:06 UTC --- Patch pushed to 3.6.x. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wizzyrea@gmail.com --- Comment #21 from Liz Rea <wizzyrea@gmail.com> --- This makes it so that the "set password" button is now hidden from users that do not have can_user_staffaccess - I don't think this makes sense - a user with edit borrowers permission can change the password from "edit patron," so why, for the button, do we need staffaccess? I think we perhaps assigned the wrong permission level to this button? -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5974 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org