Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm.
Created attachment 56134 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get 403 error => With patch you get the image
*** Bug 17325 has been marked as a duplicate of this bug. ***
Created attachment 56136 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get 403 error => With patch you get the image - Log out and test the page patronimage.pl => You get 403 error
Created attachment 56150 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error
Patch tested with a sandbox, by remy <remy.gonzalves@iepg.fr>
Created attachment 56166 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error Signed-off-by: remy <remy.gonzalves@iepg.fr>
Created attachment 56289 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error Signed-off-by: remy <remy.gonzalves@iepg.fr> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed to Master - Should be in the November 16.11 Release. Thanks!
Pushed in 16.05. Will be in 16.05.05.
Pushed in 3.22.x, will be in 3.22.12