[Koha-bugs] [Bug 14528] New: Viewing lists fails silently when not having correct permisison

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14528

            Bug ID: 14528
           Summary: Viewing lists fails silently when not having correct
                    permisison
 Change sponsored?: ---
           Product: Koha
           Version: 3.20
          Hardware: All
                OS: All
            Status: NEW
          Severity: minor
          Priority: P5 - low
         Component: Lists
          Assignee: gmcharlt at gmail.com
          Reporter: koha at jsense.co.uk
        QA Contact: testopia at bugs.koha-community.org
                CC: m.de.rooy at rijksmuseum.nl

Whilst testing the list permissions I found a problem. I have an account with
staff client access and I went to the Lists module. You immediately get
"Processing..." whilst an Ajax request takes place but then nothing else
happens. I can debug to see that the search request failed to to not having
permission. 
My primary concern is that I don't think any Ajax service call should fail
silently like this - the user need to know it has failed.
In this case the permission needed was "borrowers" - see
/svc/virtualshelves/search. That doesn't make any sense to me - why would I
need to have permission to "Add or modify patrons" when I just want to see
Lists?
Lastly, there may be some connection to issue 6960 but fixing that would only
hide the primary problem described above.

To reproduce:
1. Set up a user without "borrowers" permission
2. Go to /cgi-bin/koha/virtualshelves/shelves.pl
3. Note that it says "Processing..." and never completes.

-- 
You are receiving this mail because:
You are watching all bug changes.