Bug 10888 - Don't hide authorities module from users without permission to edit authorities
Summary: Don't hide authorities module from users without permission to edit authorities
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Paola Rossi
QA Contact: Jonathan Druart
URL:
Keywords:
: 5916 9086 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-09-13 18:46 UTC by Owen Leonard
Modified: 2014-05-26 21:04 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 10888 - Don't hide authorities module from users without permission to edit authorities (6.32 KB, patch)
2013-09-13 18:55 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 10888 - Don't hide authorities module from users without permission to edit authorities (6.97 KB, patch)
2013-09-16 18:33 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 10888 - Don't hide authorities module from users without permission to edit authorities (7.47 KB, patch)
2013-09-17 16:34 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 10888 - Don't hide authorities module from users without permission to edit authorities (7.48 KB, patch)
2013-09-17 16:44 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 10888 Don t hide authorities module from users without permission to edit authorities (7.50 KB, patch)
2013-09-19 09:23 UTC, Paola Rossi
Details | Diff | Splinter Review
Bug 10888 - Don't hide authorities module from users without permission to edit authorities (7.56 KB, patch)
2013-09-19 10:24 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2013-09-13 18:46:04 UTC
Right now we hide the authorities module from users who do not have permission to edit authorities. I don't see any reason why we couldn't make authority searching available in the staff client (as it can be in the OPAC) and hide edit/delete controls from users without permission.
Comment 1 Owen Leonard 2013-09-13 18:55:57 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2013-09-13 18:56:14 UTC
*** Bug 5916 has been marked as a duplicate of this bug. ***
Comment 3 Owen Leonard 2013-09-13 18:56:22 UTC
*** Bug 9086 has been marked as a duplicate of this bug. ***
Comment 4 Paola Rossi 2013-09-16 15:42:46 UTC
I installed the patch.
It works fine with the "editauthorities" permission.
Without the "editauthorities" permission, the search works well, while the save option doesn't work and sends the session in "you're not permitted" webpage.

The save option sends you to this link:
/cgi-bin/koha/authorities/export.pl?format=mads&op=export&authid=1

The cgi export.pl, under "authorities", is affected by "editauthorities" permission.

So I can't sign off.

In my opinion the patch is not complete; we have two options in the case of no "editauthorities" permission:
1) authority search results should show no edit or delete link or save link;
2) a new specific permission is required, to search and to save too.
Comment 5 Owen Leonard 2013-09-16 15:47:09 UTC
Thanks Paola, you're right that this needs more work. Setting this to "in discussion" is too polite. It should be "Failed QA."
Comment 6 Owen Leonard 2013-09-16 18:33:49 UTC Comment hidden (obsolete)
Comment 7 Paola Rossi 2013-09-17 15:23:37 UTC
I can't sign off the patch.

With permission to edit authorities, all the options but "Edit" work fine.

So, in the cgi searchresultlist.tt, I changed the line 89 from:
<a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid %]">Edit</a>

to:
<a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% resul.authid %]">Edit</a>

Then, with permission to edit authorities, all the options work fine.

Without permission to edit authorities, the option "save" works fine.
But the option "duplicate" is presented too.
Comment 8 Owen Leonard 2013-09-17 16:34:47 UTC Comment hidden (obsolete)
Comment 9 Owen Leonard 2013-09-17 16:44:42 UTC Comment hidden (obsolete)
Comment 10 Paola Rossi 2013-09-19 09:23:36 UTC Comment hidden (obsolete)
Comment 11 Paola Rossi 2013-09-19 09:25:06 UTC
I signed off the patch
Comment 12 Jonathan Druart 2013-09-19 10:24:09 UTC
QA comment:
Looks consistent to me.
I don't think a new permission for searching authorities is relevant.
Marked as Passed QA.
Comment 13 Jonathan Druart 2013-09-19 10:24:35 UTC
Created attachment 21229 [details] [review]
Bug 10888 - Don't hide authorities module from users without permission to edit authorities

It should be possible for staff client users to search and view
authority records even if they don't have permission to edit them.

To test, apply the patch and view the staff client as a user with and
without "editauthorities" permission.

With "editauthorities" permission, authority search results should show
both an edit and delete link. Viewing the details of an authority
record, one should see a toolbar with edit/delete/new options.

The detail view has been altered to use the term "record" in place of
"biblio" ("Used in X record(s)).

Without "editauthorities" permission, authority search results should
show no edit or delete link. Viewing the details of an authority, the
only option shown in the toolbar should be "Save."

On the staff client home page and in the header's "More" menu the link
to the authorities module should now appear with and without permission
to edit authorities.

Revision: Corrected permissions in export script to allow saving of
authority records by users who do not have permission to edit.

Revision: Corrected incorrect merge with 10600 (duplicate authority)

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Comment 14 Galen Charlton 2013-09-21 17:54:15 UTC
General reminder -- when signing off, please remember to mark 'obsolete' older versions of the patch when attaching the version with your signoff.
Comment 15 Galen Charlton 2013-09-21 18:03:00 UTC
Pushed to master.  Thanks, Owen!
Comment 16 Tomás Cohen Arazi 2013-11-13 16:22:49 UTC
This patch has been pushed to 3.12.x, will be in 3.12.7.

Thanks Owen!