Whilst testing the list permissions I found a problem. I have an account with staff client access and I went to the Lists module. You immediately get "Processing..." whilst an Ajax request takes place but then nothing else happens. I can debug to see that the search request failed to to not having permission. My primary concern is that I don't think any Ajax service call should fail silently like this - the user need to know it has failed. In this case the permission needed was "borrowers" - see /svc/virtualshelves/search. That doesn't make any sense to me - why would I need to have permission to "Add or modify patrons" when I just want to see Lists? Lastly, there may be some connection to issue 6960 but fixing that would only hide the primary problem described above. To reproduce: 1. Set up a user without "borrowers" permission 2. Go to /cgi-bin/koha/virtualshelves/shelves.pl 3. Note that it says "Processing..." and never completes.
Created attachment 40995 [details] [review] Bug 14528: Inconsistency in permissions check when listing shelves The svc script needed borrowers when the shelves.pl needed catalogue. There is no sense to have different permissions here. Test plan: 1/ Remove the borrowers permission to a user 2/ Use this user to log in 3/ Go on the shelf list 4/ Without this patch, you should get an endless "Processing..." which is fixed if you apply it.
Created attachment 40996 [details] [review] Bug 14528: Inconsistency in permissions check when listing shelves The svc script needed borrowers when the shelves.pl needed catalogue. There is no sense to have different permissions here. Test plan: 1/ Remove the borrowers permission to a user 2/ Use this user to log in 3/ Go on the shelf list 4/ Without this patch, you should get an endless "Processing..." which is fixed if you apply it.
Created attachment 41090 [details] [review] Bug 14528: Inconsistency in permissions check when listing shelves The svc script needed borrowers when the shelves.pl needed catalogue. There is no sense to have different permissions here. Test plan: 1/ Remove the borrowers permission to a user 2/ Use this user to log in 3/ Go on the shelf list 4/ Without this patch, you should get an endless "Processing..." which is fixed if you apply it. Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Created attachment 43083 [details] [review] [PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves The svc script needed borrowers when the shelves.pl needed catalogue. There is no sense to have different permissions here. Test plan: 1/ Remove the borrowers permission to a user 2/ Use this user to log in 3/ Go on the shelf list 4/ Without this patch, you should get an endless "Processing..." which is fixed if you apply it. Signed-off-by: Nick Clemens <nick@quecheelibrary.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Patch pushed to master. Thanks onathan!
Pushed to 3.20.x will be in 3.20.5