Bug 21939 - Permission for holds history tab is too strict
Summary: Permission for holds history tab is too strict
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-12-03 21:56 UTC by Jessie Zairo
Modified: 2021-06-14 21:29 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00, 19.05.06, 18.11.12


Attachments
Bug 21939: Fix permissions for holds history tab (1.39 KB, patch)
2019-11-02 20:29 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 21939: Fix permissions for holds history tab (1.53 KB, patch)
2019-11-04 09:14 UTC, Séverine Queune
Details | Diff | Splinter Review
Bug 21939: Fix permissions for holds history tab (1.59 KB, patch)
2019-11-06 22:34 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 21939: Fix permissions for holds history tab (1.66 KB, patch)
2019-11-07 11:39 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jessie Zairo 2018-12-03 21:56:19 UTC
With bug 14919 we added the availability to allow staff to view the Holds History tab for a patron if intranetreadinghistory is set to allow. However, depending on the permissions, a staff member has they may or may not be able to see. In order to view the Holds History Tab a staff member must have the full borrowers permission. 

borrowers Add, modify and view patron information
 edit_borrowers Add, modify and view patron information
 view_borrower_infos_from_any_libraries View patron info from any libraries. If not set the logged in user could only access patron info from its own library or group of libraries.

If they only have edit_borrowers Add, modify and view patron information, they will not have access to view the Holds History tab.
Comment 1 AspenCat Team 2019-10-09 16:11:12 UTC
Been getting a lot of feedback from our libraries that they would like to see this permission problem fixed so they can view holds history without the problems that are created by allowing all of our libraries to view and edit patrons from other libraries. - Bob Bennhoff
Comment 2 Katrin Fischer 2019-11-02 20:29:42 UTC
Created attachment 94972 [details] [review]
Bug 21939: Fix permissions for holds history tab

The tab will show when the staff user has edit_borrowers
permission, but the page itself will not be accessible.
This patch fixes the page permissions to allow access
with the edit_borrowers permission as suggested by the
comments on the original bug report.

To test:
- Create a staff user with only "edit_borrowers" permission
  from the borrowers module
- Try to access the holds history tab from any patron account
- Verify you are blocked
- Apply patch
- Try again and verify the page is accessible now
- Repeat with superlibrarian and full borrowers permission.
Comment 3 Katrin Fischer 2019-11-02 20:30:21 UTC
I've tried fixing it as suggested, can you please test? Should work fine on sandboxes.
Comment 4 Séverine Queune 2019-11-04 09:14:21 UTC
Created attachment 94991 [details] [review]
Bug 21939: Fix permissions for holds history tab

The tab will show when the staff user has edit_borrowers
permission, but the page itself will not be accessible.
This patch fixes the page permissions to allow access
with the edit_borrowers permission as suggested by the
comments on the original bug report.

To test:
- Create a staff user with only "edit_borrowers" permission
  from the borrowers module
- Try to access the holds history tab from any patron account
- Verify you are blocked
- Apply patch
- Try again and verify the page is accessible now
- Repeat with superlibrarian and full borrowers permission.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Comment 5 ByWater Sandboxes 2019-11-06 22:34:49 UTC
Created attachment 95128 [details] [review]
Bug 21939: Fix permissions for holds history tab

The tab will show when the staff user has edit_borrowers
permission, but the page itself will not be accessible.
This patch fixes the page permissions to allow access
with the edit_borrowers permission as suggested by the
comments on the original bug report.

To test:
- Create a staff user with only "edit_borrowers" permission
  from the borrowers module
- Try to access the holds history tab from any patron account
- Verify you are blocked
- Apply patch
- Try again and verify the page is accessible now
- Repeat with superlibrarian and full borrowers permission.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 6 Jonathan Druart 2019-11-07 11:39:34 UTC
Created attachment 95147 [details] [review]
Bug 21939: Fix permissions for holds history tab

The tab will show when the staff user has edit_borrowers
permission, but the page itself will not be accessible.
This patch fixes the page permissions to allow access
with the edit_borrowers permission as suggested by the
comments on the original bug report.

To test:
- Create a staff user with only "edit_borrowers" permission
  from the borrowers module
- Try to access the holds history tab from any patron account
- Verify you are blocked
- Apply patch
- Try again and verify the page is accessible now
- Repeat with superlibrarian and full borrowers permission.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Martin Renvoize 2019-11-07 13:27:09 UTC
Nice work!

Pushed to master for 19.11.00
Comment 8 Liz Rea 2019-11-15 22:57:28 UTC
Hi,

May we have this for 19.05 as well? It applies cleanly and works nicely there.

Cheers,
Liz
Comment 9 Lucas Gass 2019-12-12 22:51:00 UTC
backported to 19.05.x for 19.05.06
Comment 10 Hayley Pelham 2019-12-17 01:46:35 UTC
Backported to 18.11.x for 18.11.12