If I don’t give an account a permission to the purchase suggestions, but they have a copy of the link, such as http://mysite/cgi-bin/koha/suggestion/suggestion.pl?displayby=STATUS&branchcode=__ANY__, they can go straight into the feature without permission. Shouldn’t the suggestion.pl be checking permissions upon loading? Do most pages function in this manner?
Suggestions are tied to a very low level permission: flagsrequired => { catalogue => 1 } So everyone can access the page, even without any acq related permission. I think fixing this cleanly we should add a permission for the suggestions and make sure its set for all existing staff.
*** Bug 13160 has been marked as a duplicate of this bug. ***
*** Bug 15506 has been marked as a duplicate of this bug. ***
*** Bug 6889 has been marked as a duplicate of this bug. ***
May I respectfully ask that this bug **not** be fixed to ensure that permissions are checked, without the action in duplicate 15506 being attended to at the same time. Here we are delighted at this permissions bug as only a handful of central office staff have Acquisitions permissions (and hence Purchase Suggestions permissions). We have distributed the link included below out to college library staff at all of our various sites, and this means the staff there can deal with Suggestions themselves without central bibliographic services staff having to be involved. Perhaps Purchase Suggestions permissions belong under Tools, rather than Acquisitions? Ray Delahunty University of the Arts London
Hi Ray, that's exactly what I suggested here. We should add a new permission and make sure it's set for all existing staff acounts - that way there will be no change of behaviour on update. We also use the suggestions outside of the acquisitions module. We have added the link to the suggestions to the intranet navigation bar using IntranetNav. A downside of the curent behaviour is that the dashboard doesn't show information about new suggestions to users without acq permissions. Having a separate permission we could also fix this.
I definitely think a separate permission to manage suggestions would be very welcome. We have a range of customers who make use of purchase suggestions but want to have the ability to control which members of the staff can actually manage the suggestions.
Created attachment 75448 [details] [review] Bug 11911: Add a separate permission for managing suggestions Without this patch only catalogue permission was required for managing suggestions. This patch adds a new permission in the acquisition module do manage suggestions and updates staff user permissions accordingly. To test: - Make sure there is a pending suggestion - Create a few users with different permission sets: - User 1: only catalogue - User 2: any acquisition permission - User 3: cataloguing permission - Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl - Apply the patch - Verify all of them now have the suggestions_manage permission - Verify everything displays correctly on: - intranet start page - patron account in staff - acquisition start page - suggestion page (try to access by URL too) - Remove suggestions_manage for a staff user - Repeat tests above, access should be denied/links not visible Bonus: - Fixes the link on the acquisition start page for late orders to mage the permissions of the page itself: order_receive
All behaviours are correct (the bonus one too !). I just wondered about this setting : any acquisition permission except suggestions_manage : "Suggestions" link on acqui-home side menu is hidden, shouldn't it be the same for the "Manage suggestions" link on the "Pending suggestions" frame ?
Created attachment 75616 [details] [review] Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission When the user is not superlibrarian or has the manage_suggestions permission, the suggestion box on the left of the acq start page needs to be hidden.
Hi Severine, thx for catching this! Could you maybe sign the follow-up too?
Created attachment 75630 [details] [review] Bug 11911: Add a separate permission for managing suggestions Without this patch only catalogue permission was required for managing suggestions. This patch adds a new permission in the acquisition module do manage suggestions and updates staff user permissions accordingly. To test: - Make sure there is a pending suggestion - Create a few users with different permission sets: - User 1: only catalogue - User 2: any acquisition permission - User 3: cataloguing permission - Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl - Apply the patch - Verify all of them now have the suggestions_manage permission - Verify everything displays correctly on: - intranet start page - patron account in staff - acquisition start page - suggestion page (try to access by URL too) - Remove suggestions_manage for a staff user - Repeat tests above, access should be denied/links not visible Bonus: - Fixes the link on the acquisition start page for late orders to mage the permissions of the page itself: order_receive Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Created attachment 75631 [details] [review] Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission When the user is not superlibrarian or has the manage_suggestions permission, the suggestion box on the left of the acq start page needs to be hidden. Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Both patchs ok for me, thank you Katrin !
I am not sure it's a big deal but since bug 18403 the "borrowers" permissions has subpermissions and so the SQL query should be adjusted a bit.
Sorry Joubu, but I don't understand what you mean. I look for staff users with catalogue permission and the new permission is under acquisitions... where does the borrowers permission play in?
We should highlight the change in the release notes: Before: members/purchase-suggestions.pl required { borrowers => 'edit_borrowers' } suggestion/suggestion.pl required { catalogue => 1 } After the require the new { acquisition => 'suggestions_manage' }
(In reply to Jonathan Druart from comment #17) > After the require the new { acquisition => 'suggestions_manage' } they*
Created attachment 75736 [details] [review] Bug 11911: Add a separate permission for managing suggestions Without this patch only catalogue permission was required for managing suggestions. This patch adds a new permission in the acquisition module do manage suggestions and updates staff user permissions accordingly. To test: - Make sure there is a pending suggestion - Create a few users with different permission sets: - User 1: only catalogue - User 2: any acquisition permission - User 3: cataloguing permission - Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl - Apply the patch - Verify all of them now have the suggestions_manage permission - Verify everything displays correctly on: - intranet start page - patron account in staff - acquisition start page - suggestion page (try to access by URL too) - Remove suggestions_manage for a staff user - Repeat tests above, access should be denied/links not visible Bonus: - Fixes the link on the acquisition start page for late orders to mage the permissions of the page itself: order_receive Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 75737 [details] [review] Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission When the user is not superlibrarian or has the manage_suggestions permission, the suggestion box on the left of the acq start page needs to be hidden. Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Awesome work all! Pushed to master for 18.11
Enhancement, will not be backported to 18.05.x series.