[Koha-bugs] [Bug 24414] New: Can't add/delete funds with only budget_add_del permission

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24414

            Bug ID: 24414
           Summary: Can't add/delete funds with only budget_add_del
                    permission
 Change sponsored?: ---
           Product: Koha
           Version: master
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5 - low
         Component: Acquisitions
          Assignee: koha-bugs at lists.koha-community.org
          Reporter: caroline.cyr-la-rose at inlibro.com
        QA Contact: testopia at bugs.koha-community.org

This is very minor, but I was trying out all the permissions to better document
them in the manual and I found something weird.

There are several permissions granting access to funds.
- budget_add_del described as 'Add and delete funds (but can't modify funds)'
- budget_manage described as 'Manage funds'
- budget_manage_all described as 'Manage all funds'
- budget_modify described as 'Modify funds (can't create lines but can modify
existing ones)'

If I only have budget_add_del, I can't create or delete funds. I have to have
budget_manage to access the funds administration page. Which is ok, I can
simply add a note in the manual that budget_add_del requires budget_manage.

If I have budget_add_del and budget_manage, I have access to the funds
administration page, but not the 'New fund' button nor the 'Actions' button to
delete an existing fund. So in reality, I can't add nor delete funds...

If I have budget_manage and budget_modify (but not budget_add_del), I can't add
new funds I can't edit existing ones, but I can delete them.

To test :
1) Create a patron and give them the catalogue permission and the
budget_add_del permission
2) Log in with this patron (I use a private window to be able to go back and
change their permissions later without logging out again)
3) Go to the Acquisitions page
4) Notice you can see the budget, but you can't click on the fund code and you
don't have the 'Funds' link in the left menu
5) Go back to edit the user's permissions and grant them budget_manage; save
6) Go back to the  Acquisition page with the limited patron (refresh if needed)
7) Notice that you can now click on the fund code and you have a 'Funds' link
on the left side of the screen
8) Click on the fund code
9) Click on 'New' and choose 'Add fund for xx'; add the new fund
10) Notice there is no 'Actions' button from which you can delete this fund
11) Go back to edit the user's permissions and remove the budget_add_del
permission and add the budget_modify; save
12) Go back to the  Acquisition page with the limited patron (refresh if
needed)
13) Click on the 'Actions' button and choose 'Edit'; the page refreshes, but
nothing happens
14) Click on the 'Actions' button and choose 'Delete' and confirm; the fund is
deleted

I have trouble imagining a situation where we would want staff to be able to
add and delete funds but not modify them, so that's why I said I think this is
minor. I think in most cases, the staff member will have at least all three
(budget_add_del, budget_manage and budget_modify). But I still wanted to record
the weirdness somewhere.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.