[Bug 41777] New: Allow patron import tool to overwrite passwords for "staff" category type when used by staff with appropriate permissions
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41777 Bug ID: 41777 Summary: Allow patron import tool to overwrite passwords for "staff" category type when used by staff with appropriate permissions Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: michael.adamyk@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Currently, staff users can change passwords or permissions for any other user if they have the "superlibrarian" (Access to all librarian functions) or "staffaccess" (Allow staff members to modify permissions, usernames, and passwords for other staff members) permission. However, the patron import tool blocks password changes to any patron categories using the "Staff" category type, regardless of the tool user's permission level. It would make sense for the tool to allow password changes to all accounts for at least superlibrarians, possibly also for "staffaccess" permissions. A use case would be a superlibrarian who "rotates" passwords on a regular basis for staff security. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41777 --- Comment #1 from Michael Adamyk <michael.adamyk@bywatersolutions.com> --- However... this has broad security implications for accidentally locking out all staff at once. And with the ability to enforce password expiration and complex passwords through patron categories, this may be a feature that is unnecessary in the patron import tool. Because of this, I suggest it be discussed by the community before action is taken. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41777 --- Comment #2 from Michael Adamyk <michael.adamyk@bywatersolutions.com> --- See Bug 41776 for the documentation need of how patron import currently handles staff passwords. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org