Bug 14528 - Viewing lists fails silently when not having correct permisison
Summary: Viewing lists fails silently when not having correct permisison
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-13 16:21 UTC by Pete Edwards
Modified: 2016-06-21 21:38 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 14528: Inconsistency in permissions check when listing shelves (1.75 KB, patch)
2015-07-14 15:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14528: Inconsistency in permissions check when listing shelves (1.12 KB, patch)
2015-07-14 15:50 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14528: Inconsistency in permissions check when listing shelves (1.18 KB, patch)
2015-07-19 02:12 UTC, Nick Clemens
Details | Diff | Splinter Review
[PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves (1.25 KB, patch)
2015-10-03 20:38 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pete Edwards 2015-07-13 16:21:11 UTC
Whilst testing the list permissions I found a problem. I have an account with staff client access and I went to the Lists module. You immediately get "Processing..." whilst an Ajax request takes place but then nothing else happens. I can debug to see that the search request failed to to not having permission. 
My primary concern is that I don't think any Ajax service call should fail silently like this - the user need to know it has failed.
In this case the permission needed was "borrowers" - see /svc/virtualshelves/search. That doesn't make any sense to me - why would I need to have permission to "Add or modify patrons" when I just want to see Lists?
Lastly, there may be some connection to issue 6960 but fixing that would only hide the primary problem described above.

To reproduce:
1. Set up a user without "borrowers" permission
2. Go to /cgi-bin/koha/virtualshelves/shelves.pl
3. Note that it says "Processing..." and never completes.
Comment 1 Jonathan Druart 2015-07-14 15:48:44 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2015-07-14 15:50:04 UTC Comment hidden (obsolete)
Comment 3 Nick Clemens 2015-07-19 02:12:07 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-10-03 20:38:48 UTC
Created attachment 43083 [details] [review]
[PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Tomás Cohen Arazi 2015-10-05 15:39:21 UTC
Patch pushed to master.

Thanks onathan!
Comment 6 Chris Cormack 2015-10-23 13:16:53 UTC
Pushed to 3.20.x will be in 3.20.5