Bug 9065

Summary: Upload local cover image permission implementation error
Product: Koha Reporter: André Melancia <Andy>
Component: ToolsAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Jonathan Druart <jonathan.druart>
Severity: major    
Priority: P5 - low CC: Andy, chris, gmcharlt, jonathan.druart
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Proposed patch
Bug 9065 - set correct permission for upload local cover image
Bug 9065 - set correct permission for upload local cover image

Description André Melancia 2012-11-13 02:28:34 UTC
If a staff user IS NOT "superlibrarian", even if having "upload_local_cover_images", trying to use the "Tools -> Upload local cover image" will fail with "You do not have permissions [...]".

Bug is found in /usr/share/koha/intranet/cgi-bin/tools/upload-cover-image.pl

The following line (64) must be changed:
>>> flagsrequired   => { tools => 'upload_cover_images' },
To:
>>> flagsrequired   => { tools => 'upload_local_cover_images' },

This will solve the problem.
		
This appears to be the only place "upload_cover_images" bug exists (please also confirm).
Comment 1 Fridolin Somers 2013-01-09 09:44:18 UTC Comment hidden (obsolete)
Comment 2 Galen Charlton 2013-01-09 16:24:43 UTC Comment hidden (obsolete)
Comment 3 Galen Charlton 2013-01-09 16:25:22 UTC
Note that I reworded the commit message for clarity and added a test plan.
Comment 4 Fridolin Somers 2013-01-09 16:43:51 UTC
Thanks a lot Galen
Comment 5 Jonathan Druart 2013-01-10 11:38:42 UTC
Created attachment 14520 [details] [review]
Bug 9065 - set correct permission for upload local cover image

This patch fixes a problem where if a staff user has the
upload_local_cover_images permission (and is not a superlibrarian
and does not have all of the tools permissions), trying to use the
"Tools -> Upload local cover image" will fail with "You do not have
permissions [...]".

To test after applying the patch:

- Create a staff uesr that has just the catalogue and
  upload_local_cover_images permission.
- Log in as that staff user.
- Go to "Tools -> Upload local cover image".
- Verify that one is given the form to upload a cover image.
- Without the patch, one will be presented with the login
  form instead.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

mysql> select * from permissions where code="upload_cover_images";
Empty set (0.00 sec)

mysql> select * from permissions where code="upload_local_cover_images";
+------------+---------------------------+---------------------------+
| module_bit | code                      | description               |
+------------+---------------------------+---------------------------+
|         13 | upload_local_cover_images | Upload local cover images |
+------------+---------------------------+---------------------------+
1 row in set (0.00 sec)

"git grep upload_cover_images" returns 0 result.
Comment 6 Jared Camins-Esakov 2013-01-13 13:32:03 UTC
This patch has been pushed to master.
Comment 7 Chris Cormack 2013-01-15 04:29:52 UTC
Pushed to 3.8.x and 3.10.x, will be in 3.8.9 and 3.10.2