[Koha-bugs] [Bug 11911] Purchase suggestions can be accessed by all staff members / no specific permission

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911

--- Comment #8 from Katrin Fischer <katrin.fischer at bsz-bw.de> ---
Created attachment 75448
  -->
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75448&action=edit
Bug 11911: Add a separate permission for managing suggestions

Without this patch only catalogue permission was required
for managing suggestions. This patch adds a new permission
in the acquisition module do manage suggestions and updates
staff user permissions accordingly.

To test:
- Make sure there is a pending suggestion
- Create a few users with different permission sets:
  - User 1: only catalogue
  - User 2: any acquisition permission
  - User 3: cataloguing permission
- Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl
- Apply the patch
- Verify all of them now have the suggestions_manage permission
- Verify everything displays correctly on:
  - intranet start page
  - patron account in staff
  - acquisition start page
  - suggestion page (try to access by URL too)
- Remove suggestions_manage for a staff user
- Repeat tests above, access should be denied/links not visible

Bonus:
- Fixes the link on the acquisition start page for late orders
  to mage the permissions of the page itself: order_receive

-- 
You are receiving this mail because:
You are watching all bug changes.