Bug 15289 - "borrowers" permission doesn't allow to see current loans
Summary: "borrowers" permission doesn't allow to see current loans
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Alex Arnaud
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 36332 15442
  Show dependency treegraph
 
Reported: 2015-12-03 10:02 UTC by Koha Team University Lyon 3
Modified: 2024-03-18 09:12 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 15289 - borrowers permission allows to see patron's loans (5.92 KB, patch)
2015-12-15 13:17 UTC, Alex Arnaud
Details | Diff | Splinter Review
Bug 15289 - borrowers permission allows to see patron's loans (6.09 KB, patch)
2015-12-16 10:48 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 15289 - borrowers permission allows to see patron's loans (6.15 KB, patch)
2015-12-18 17:33 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 15289 [QA Followup] - Fix minor language issue (1.39 KB, patch)
2015-12-18 17:33 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 15289 - borrowers permission allows to see patron's loans (6.21 KB, patch)
2015-12-30 03:04 UTC, Brendan Gallagher
Details | Diff | Splinter Review
Bug 15289 [QA Followup] - Fix minor language issue (1.45 KB, patch)
2015-12-30 03:04 UTC, Brendan Gallagher
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Koha Team University Lyon 3 2015-12-03 10:02:52 UTC
Permission "borrowers" gives an access to the Details page of a patron. 
But, in our previous version, we can see the list of the document checkout in this page.
Now, we just have the information 'loading' in the checkout tables, but we can't see documents on loan. 

We should have an access to list of the loan, even without the "circulate" permission, to be able to inform patrons about the books they have, tell them the due date...
Comment 1 Fridolin Somers 2015-12-03 14:14:48 UTC
Indeed, the file svc/checkouts contains :

my ( $auth_status, $sessionID ) =
  check_cookie_auth( $input->cookie('CGISESSID'),
    { circulate => 'circulate_remaining_permissions' } );
Comment 2 Fridolin Somers 2015-12-03 14:15:47 UTC
Maybe it should depend on which page calls the code
Comment 3 Jonathan Druart 2015-12-07 10:20:25 UTC
It's not obvious which permission should be required to see the checkout list.
Katrin and Nicole, will you agree that a user with only the borrowers permission could access to this list?
Comment 4 Koha Team University Lyon 3 2015-12-11 09:48:18 UTC
Hi,
"borrowers" permission is required to deal with information related to patrons and it seems that it's the only one for this purpose.
It's really difficult to imagine that staff who deal with borrowers in the library won't be able to know if patrons have loans, how many and what is the return date, even if they don't have the permission to do circulation action.

Until the 3.16 version, it was the case : we can have the loans table in the details page of a patron for staff who have borrowers permission without circulate permission.

Sonia
Comment 5 Jonathan Druart 2015-12-11 11:18:57 UTC
I have just tested on a 3.14 and... it was quite buggy :)
Without the circulate permission, indeed I can see the checkout list, but I also see the checkin checkboxes, the checkout tab, etc.
And if I click on them, I am redirected to the login page :)

The description of the borrower permission is "Add or modify patrons".
That's why I would prefer to wait for an answer from Nicole and/or Katrin.
Comment 6 Koha Team University Lyon 3 2015-12-11 12:28:16 UTC
Ah yes.. in 3.14, I found logical to be redirected to the login page when you check checkin or renew checkbox as you need to login with another user having the circulate permission to use it. Perhaps I just got used to this behaviour.
I'm sure that we can have a better behaviour which also permit to see the loans only with borrowers permission in the current version :)
Comment 7 Katrin Fischer 2015-12-14 08:19:46 UTC
I think this is kind of a tricky question, because there is something like a 'grey area' between circulate and borrowers permissions.

If we assume:

borrowers
- add borrowers
- modify borrowers
- delete borrowers

circulate
- check-out
- check-in
- renew

It's not really clear, what the correct permission for "seeing patron information" or "seeing checkouts and holds" really is.

I guess ideally there would be an option to circulate books for a borrower, without seeing any patron information, just by scanning the cardnumber and checking out. - but currently that's not really possible.

I think "borrowers" for seeing the holds and checkouts is a bit of a stretch, but it seems like it was like that before, so it would be ok. I think it would be a nice change to hide the checkboxes if you don't have "circulate" - would that be possible?
Comment 8 Alex Arnaud 2015-12-15 13:17:07 UTC Comment hidden (obsolete)
Comment 9 Marc Véron 2015-12-16 10:48:18 UTC Comment hidden (obsolete)
Comment 10 Kyle M Hall 2015-12-18 17:33:33 UTC Comment hidden (obsolete)
Comment 11 Kyle M Hall 2015-12-18 17:33:43 UTC Comment hidden (obsolete)
Comment 12 Brendan Gallagher 2015-12-30 03:04:03 UTC
Created attachment 46058 [details] [review]
Bug 15289 - borrowers permission allows to see patron's loans

Test plan:

 - log with a user that have "borrowers" permission but not "Remaining circulation permissions"
 - go to a borrower's detail page (who has at least a loan) and click on "show checkouts"
 - check that you see loan(s) and that you can't renew and checkin

 - Do the same with a borrower that have "Remaining circulation permissions"
 - check that you see loan(s) and that you can renew and checkin

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Comment 13 Brendan Gallagher 2015-12-30 03:04:13 UTC
Created attachment 46059 [details] [review]
Bug 15289 [QA Followup] - Fix minor language issue

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Comment 14 Brendan Gallagher 2015-12-30 03:04:31 UTC
Pushed to Master - Thanks!
Comment 15 Julian Maurice 2015-12-31 08:48:12 UTC
Patches pushed to 3.22.x, will be in 3.22.2