[Koha-bugs] [Bug 22868] Circulation staff with suggestions_manage can have access to acquisition data

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22868

--- Comment #25 from Katrin Fischer <katrin.fischer at bsz-bw.de> ---
(In reply to karen.fellows from comment #24)
> I agree with Christopher and going off of my comment from above-- "In the
> past, staff were allowed staff to create purchase suggestions for patrons,
> but they could not edit/delete them."--We want this feature back.

I believe this is not true - the page was still accessible and staff could have
added/edited anytime, just the acq module link would not show on the start
page. We have used this 'loophole' for ages by linking to the page directly for
libraries not using the acq module otherwise. There was NO permission check on
the suggestions module page (apart from "catalogue").

I just tested this in a 17.11.:
- Create a user without any acq access
- Go to any patron account
- Create a new purchase suggestion
- Click on the "purchase suggestions" part of the breadcrumbs
- You can managed (edit/add) your heart out.

The regression is, that you can see other acq details, but not in the
suggestions handling. 

> Circ staff need to be able to enter the suggestions but not manage them--we
> have technical services staff that complete that task, not circulation
> staff.  The idea is to make it easier for the circ staff to help the patrons
> put in suggestions since most of the patrons don't log in to their accounts
> to do it themselves.

I am not saying we could not make this more granular. The change here will even
make that possible. By moving the suggestion permission to be a top-level
permission, we will be able to have sub permissions as a next step. I am just
saying, let's fix it to where we were before - then move forward from there.

-- 
You are receiving this mail because:
You are watching all bug changes.