On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves.
Would catalogue => "*" make sense here? If so I can make a patch for it.
Created attachment 42622 [details] [review] Change permissions of issue history
Created attachment 43441 [details] [review] Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Created attachment 43495 [details] [review] Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Clarification, just in case: this bug is passed-QA, I've just requested the QAM's opinion privately, but I also marked with the rel_3_22_candidate keyword to make it clear it will be pushed for 3.22.
Did this make it into 3.22? Or was it pushed back to the next release? I didn't notice it in the release notes. Thanks!
(In reply to Tom Misilo from comment #6) > Did this make it into 3.22? Or was it pushed back to the next release? I > didn't notice it in the release notes. Thanks! No, it has not been pushed yet.
Still waiting for QAM's opinion.
Hm, at the risk of people not being happy with me... this is what I think: The circulation history tab includes information about borrowers - the patrons who have checked out items of the record. If you have access to the circulation module, it seems 'more ok' to see that, then if you just have catalog permission in order to be able to do some minor tasks in the staff interface. A suggestion: If someone has only catalog - don't show the information about the patrons. If someone has circulation permissions - show all the columns. Could that work?
(In reply to Katrin Fischer from comment #10) > Hm, at the risk of people not being happy with me... this is what I think: > > The circulation history tab includes information about borrowers - the > patrons who have checked out items of the record. > > If you have access to the circulation module, it seems 'more ok' to see > that, then if you just have catalog permission in order to be able to do > some minor tasks in the staff interface. > > A suggestion: If someone has only catalog - don't show the information about > the patrons. If someone has circulation permissions - show all the columns. > > Could that work? That sounds like a good approach. So, to be clear about it, you are proposing that if the librarian does not have the circulation permission, the first column ( Patron ) should not be displayed, correct? This would need to be done at the template level so the data is not just hidden from view, but would not be in the HTML source at all.
Yep, that's what I was thinking. The page level permission could be catalog - which every staff member should have. Then adjust the datatable to hide the first column iirc in the template itself.
Created attachment 47245 [details] [review] Bug 14244: Does not display patron's info in the checkout history if not authorised The librarian needs CAN_user_circulate_circulate_remaining_permissions to see the checkouts patron's information. Test plan: The "Patron" column of the checkout history page should only be displayed of you have the circulate > circulate_remaining_permissions permission.
The patches work as described. However, I can still see patron information in the Normal view on ...cgi-bin/koha/catalogue/detail.pl?biblionumber=xxxxx, in column "Status". Example: Currently in local use by Edna Acosta : due 11/12/2015 23:59 ...and the link on the name leads to the "No permission" page.
Hi Marc, I think this bug is only about the reading history - so the detail page/normal view woudl be better on another bug report. Do you agree with the general approach or would you like it to work differently?
Hi Katrin, no problem with fixing it with a separate bug.
Created attachment 47257 [details] [review] Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 47258 [details] [review] Bug 14244: Does not display patron's info in the checkout history if not authorised The librarian needs CAN_user_circulate_circulate_remaining_permissions to see the checkouts patron's information. Test plan: The "Patron" column of the checkout history page should only be displayed of you have the circulate > circulate_remaining_permissions permission. Signed-off-by: Marc Véron <veron@veron.ch>
(In reply to Katrin Fischer from comment #15) > Hi Marc, I think this bug is only about the reading history - so the detail > page/normal view woudl be better on another bug report. Do you agree with > the general approach or would you like it to work differently? H Katrin, I filed a separate bug: Bug 15655
Created attachment 47694 [details] [review] Bug 14244: viewing a bib item's circ history requires circulation permissions On issuehistory.pl you have: flagsrequired => { circulate => "circulate_remaining_permissions" }, But that really doesn't make sense. People should be able to view the history of circulation without having permission to circulate items themselves This patch changes the required permissions from circulate to catalogue. Test Plan: 1. Login as user without the circulate_remaining_permissions 2. Attempt to view Circulation History of an Item 3. Does not work 4. Apply Patch 5. Attempt to view circulation history with a user that has access to the staff side. 6. Can view circulation history now Signed-off-by: Nicole Engard <nengard@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 47695 [details] [review] Bug 14244: Does not display patron's info in the checkout history if not authorised The librarian needs CAN_user_circulate_circulate_remaining_permissions to see the checkouts patron's information. Test plan: The "Patron" column of the checkout history page should only be displayed of you have the circulate > circulate_remaining_permissions permission. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
pushed to master - should be in the may 2016 release. Thanks
Patches pushed to stable, will be in 3.22.5
This patch has been pushed to 3.20.x, will be in 3.20.10.