[Bug 37144] New: Add a subpermission for hiding patron contact information
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Bug ID: 37144 Summary: Add a subpermission for hiding patron contact information Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: Patrons Assignee: Laura.escamilla@bywatersolutions.com Reporter: Laura.escamilla@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Currently, Koha lacks a subpermission feature that allows libraries, especially those in correctional facilities utilizing inmate volunteers, to hide patron contact information (e.g., addresses) from certain users like volunteers. This privacy gap poses a significant risk, potentially exposing sensitive inmate data to unauthorized personnel. Implementing a subpermission feature would ensure that only authorized staff can access such sensitive information, addressing critical privacy concerns within these specialized library environments. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #1 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168282 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168282&action=edit Bug 37144 (still wip) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168282|0 |1 is obsolete| | --- Comment #2 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168283 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168283&action=edit Bug 37144 (still wip) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #3 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168284 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168284&action=edit Bug 37144 - Add a subpermission for hiding patron contact information -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #4 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168387 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168387&action=edit Bug 37144: Hide address from patron lists -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168284|0 |1 is obsolete| | --- Comment #5 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168388 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168388&action=edit Bug 37144 - Add a subpermission for hiding patron contact information To test: Apply the patch, updatedatabase, restart_all. 1. Create or ensure you have a patron (patron A) with all the contact information fields filled out (i.e. phone number, email, alternate contact information etc.) 2. Create another patron (patron B) with the following permissions: 1. Check out and check in items (circulate) 2. Staff access, allows viewing of catalogue in staff interface (catalogue) 3. Under Add, modify and view patron information 1. Search, list and view patrons (list_borrowers) 2. View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. (view_borrower_infos_from_any_libraries) 3. For now keep View patron contact information. (view_contact_information) unselected 4. Place and modify holds for patrons (reserveforothers) 3. Log in as patron B. 4. Confirm that patron contact information is not visible 1. View patron A 1. If you’re using autocomplete ensure that the address is not visible on the autocomplete dropdown. 2. If you’re using the Patron alphabet search to view the patron make sure that the address is not visible on the member result table. 3. Contact information cannot be viewed under the “brief information” on the right hand side of the patron account, below the patron image. 2. Holds 1. Place a hold for Patron A 1. Confirm that the address is not visible on the autocomplete when searching for a patron to place a hold for. 2. Build the holds queue 1. View the holds queue the patron phone number is not visible 2. View the holds waiting page. Contact information is not displayed either. Nor for ‘Holds waiting past their expiration date’ or ‘Holds with cancellation requests’. 3. Place a hold in transit. 1. The patron contact information is not visible for in-transit items, nor when they are recalled, or canceled. 4. Poke around to make sure that addresses are not visible anywhere else. 5. Log in with a user that has superlibrarian permissions. Make sure that addresses are visible in all the locations mentioned above, and of course in all their other regular locations. 6. Sign off and have a great day! :D -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #6 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168389 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168389&action=edit Bug 37144 - Hide address on circ menu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #7 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168390 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168390&action=edit Bug 37144 - Add js variable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #8 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168391 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168391&action=edit Bug 37144 - Fix typo -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #9 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168392 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168392&action=edit Bug 37144: Pass permission variable to the patron autocomplete -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #10 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168393 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168393&action=edit Bug 37144: Fixed up the permission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168387|0 |1 is obsolete| | --- Comment #11 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168394 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168394&action=edit Bug 37144: Hide address from patron lists -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168283|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |samalau@gmail.com --- Comment #12 from Sam Lau <samalau@gmail.com> --- After applying, I don't see the new subpermission and I'm not seeing any atomic update files attached. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #13 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168460 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168460&action=edit Bug 37144: Atomic update -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168389|0 |1 is obsolete| | --- Comment #14 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 168463 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168463&action=edit Bug 37144: Fixed circ.inc -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lisette@bywatersolutions.co | |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Sam Lau <samalau@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Patch doesn't apply --- Comment #15 from Sam Lau <samalau@gmail.com> --- Applying: Bug 37144: Fixed up the permission error: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc). error: could not build fake ancestor Patch failed at 0001 Bug 37144: Fixed up the permission hint: Use 'git am --show-current-patch=diff' to see the failed patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-37144-Fixed-up-the-permission-t9wm3ly_.patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168393|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #16 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169320 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169320&action=edit Bug 37144: "Adding userpermissions" Same test plan -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #17 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169321 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169321&action=edit Bug 37144: Add permission to circ menu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #18 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169322 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169322&action=edit Bug 37144: Added permission to patron search -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #19 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169323 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169323&action=edit Bug 37144: Added the permission to Permissions.inc -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #20 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169324 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169324&action=edit Bug 37144: Added variable to members menu.ic -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #21 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169325 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169325&action=edit Bug 37144: Added permission to waiting holds -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #22 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169326 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169326&action=edit Bug 37144: Added variable to circulation.tt -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #23 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169327 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169327&action=edit Bug 37144: Added permission to circ returns -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #24 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169328 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169328&action=edit Bug 37144: Added permission to holds queue -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #25 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169329 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169329&action=edit Bug 37144: Added permission to member brief view` -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #26 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169330 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169330&action=edit Bug 37144: Added variable and permission to moremember.tt -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #27 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169331 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169331&action=edit Bug 37144: Added global js variable` -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #28 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169332 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169332&action=edit Bug 37144: Passed permission through the autocomplete -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #29 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169333 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169333&action=edit Bug 37144: Hide address in patron lists -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168460|0 |1 is obsolete| | --- Comment #30 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 169334 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169334&action=edit Bug 37144: Atomic update -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168388|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168390|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168391|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168392|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168394|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168463|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Andrew Fuerste-Henry <andrewfh@dubcolib.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrewfh@dubcolib.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #31 from David Cook <dcook@prosentient.com.au> --- I'm really interested in this use case, and I'll likely be working on this more in the future. I haven't reviewed these in depth, but at a glance it looks like you've added a new sub permission, but it's not clear to me how it relates to the other permissions. Like... it seems at odds with "list_borrowers" for instance. Can you tell us more about how you'd plan to use this new permission in practice? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #32 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Hi David, Thank you for your feedback. I understand your concern about how the new subpermission fits with existing permissions such as "list_borrowers." Here’s a more detailed explanation of how the new subpermission would work in practice and its relationship to current permissions: Currently, Koha does not offer granular control over sensitive patron information. This gap is particularly critical in environments such as correctional facilities, where there is a need to ensure that sensitive inmate information (like addresses) is not accessible to unauthorized users, such as volunteers who might assist with library operations but should not have access to personal data. The new subpermission I’m suggesting would be a refinement to control access specifically to sensitive patron information within the broader "list_borrowers" permission. Here's how it would function: 1. Granular Access Control: * "list_borrowers" Permission: Allows a user to see a list of all patrons in the system, including their basic information. * New Subpermission: Would be an additional layer that allows or restricts access to sensitive details (e.g., addresses, phone numbers) on a per-user basis. 2. Use Case Example: * Library Staff with Full Access: Users with full access (including the new subpermission) would be able to view and manage all patron details, including sensitive information. * Volunteers with Limited Access: Volunteers or other non-staff users would have the "list_borrowers" permission but would be restricted by the new subpermission from seeing sensitive information like addresses. 3. Implementation: * Separate Controls: The subpermission would be a toggle or separate setting within the permissions system, providing a more nuanced control over which users can see specific types of patron information. * Access Scenarios: For instance, a volunteer might need to see the list of patrons to check out books but should not be able to see the home addresses of the patrons. Practical Benefits: * Enhanced Privacy: Protects sensitive information from being exposed to unauthorized users. * Compliance: Helps in meeting privacy requirements and regulations specific to sensitive environments like correctional facilities. * Flexibility: Provides libraries with the flexibility to tailor access controls to their specific needs and user roles. In summary, the new subpermission would integrate with existing permissions by adding a layer of control over access to sensitive data, thus bridging the privacy gap without undermining the functionality of broader permissions like "list_borrowers." I hope this clarifies how the new subpermission complements and enhances the existing permission structure. Please let me know if you need further details or have additional questions. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #33 from David Cook <dcook@prosentient.com.au> --- (In reply to Laura Escamilla from comment #32)
In summary, the new subpermission would integrate with existing permissions by adding a layer of control over access to sensitive data, thus bridging the privacy gap without undermining the functionality of broader permissions like "list_borrowers."
I hope this clarifies how the new subpermission complements and enhances the existing permission structure. Please let me know if you need further details or have additional questions.
Thanks for that, Laura. I think that I understand what you're saying. In other words, anyone currently with "list_borrowers" (also "edit_borrowers" for legacy reasons although we didn't give all "edit_borrowers" the "list_borrowers" permission when it came out as "edit_borrowers" could still do everything "list_borrowers" could do) would also need "view_contact_information" in order to continue seeing the information they're currently seeing. At a glance, I don't see a patch attached that performs that update. Without it, I think a lot of Koha staff users would become very unhappy in prod. In some ways, it's a shame this isn't implemented via Koha::Patron. If it were, it could be unit tested. (For instance, Koha::Patron could have a method that restricts the display of certain information, and ./members/moremember.pl could invoke that method based on the permission that the session user has.) That actually reminds me... I thought Tomas and Martin previously were working on something like that, but I can't remember the details now. With it as a template change, we should probably have some Selenium tests. Actually Selenium tests would be good in either case, since we're talking about restricting sensitive information. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #34 from David Cook <dcook@prosentient.com.au> --- Actually, that reminds me that this change doesn't take into account the REST API either, since it's just hiding information in the templates. A clever user could easily bypass this permission to view the contact information. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #35 from David Cook <dcook@prosentient.com.au> --- I think that the feature is a good idea, and would be very useful, but I think we might need to still do a bit more thinking on it. I don't think this change is all the way there yet. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #36 from David Cook <dcook@prosentient.com.au> --- I wanted to double-check things so I applied the patches, and it looks like there's at least one coding error. http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 staff-global_24.0600021.js:712 Uncaught SyntaxError: Unexpected token ')' (at staff-global_24.0600021.js:712:13) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #37 from David Cook <dcook@prosentient.com.au> --- And by visiting http://localhost:8081/api/v1/patrons/51 I bypass this change and get all the patron information. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #38 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #33)
That actually reminds me... I thought Tomas and Martin previously were working on something like that, but I can't remember the details now.
I think it was bug 29523. However, that only covers the REST API. The REST API is arguably easier to deal with. If you added a patch to take care of the REST API... then these template based patches might be enough for now... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #39 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I have some concerns here as well: What is considered sensitive information might vary from library to library. Here it's listed as contact information. But I think it should be more clearly defined and describe. The other thing is that we now already have a lot of template changes and given the sensitivity of this feature I am worried about maintaining this and avoiding regressions. Having an option to filter out the information so it is never sent to the template in the first place would probably be much more elegant. I think that's what David meant by resolving this on the level of Patron.pm. With our mix of old and new code (C4/Koha) still not an easy task. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #40 from David Cook <dcook@prosentient.com.au> --- (In reply to Katrin Fischer from comment #39)
What is considered sensitive information might vary from library to library. Here it's listed as contact information. But I think it should be more clearly defined and describe.
I was pondering that as well. For instance, many of our libraries would want to hide date of birth as well I think.
The other thing is that we now already have a lot of template changes and given the sensitivity of this feature I am worried about maintaining this and avoiding regressions. Having an option to filter out the information so it is never sent to the template in the first place would probably be much more elegant. I think that's what David meant by resolving this on the level of Patron.pm.
Yep! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #41 from David Cook <dcook@prosentient.com.au> ---
With our mix of old and new code (C4/Koha) still not an easy task.
It is a tough one. I have a similar use case to Laura, which I'll likely need to code and deploy soon. I suspect I'll have to do something like this in the short-term, since it's the easier/quicker change to make. But I think we do need to put more thought into a design for a comprehensive solution. We need some way to associate the $logged_in_user with the Koha::Patron object, but there's lots of different ways of getting a Koha::Patron object even. On other projects with better MVC structures and smaller codebases, I've done some column-level security, although it was mostly in terms of restricting updates at the column-level. Using Koha::Proxy::Patron class to wrap Koha::Patron could work... except that there are ways of getting Koha::Patron objects from other objects which could bypass that. But maybe it would be enough... Actually, looking through './circ/circulation.pl' I'm thinking how we mostly want to use an unrestricted Koha::Patron for a lot of the business logic... but then for some things we'd want to use a Koha::Proxy::Patron with user restrictions for view logic... This is one of those topics where I think it's difficult to come up with a perfect design ahead of time... but where it's also easy to create a mess by having an incomplete design ahead of time... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36561 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 --- Comment #42 from David Cook <dcook@prosentient.com.au> --- Conceptually, I was just thinking about "patron_profile" rather than "patron", so instead of Koha::Proxy::Patron we'd have "Koha::Patron::Profile or something like that. Although I was thinking about that in terms of a whole separate object, which looking at this... would be easier said than done... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.derscheid@lmscloud.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|Laura.escamilla@bywatersolu |koha-bugs@lists.koha-commun |tions.com |ity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |In Discussion -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=28680 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org