Bug 7651 added the permission currencies_manage within the acquisitions permission subgroup. Giving a borrower just this permission and catalogue does make them technically able to load /currency.pl, but it doesn't provide them any link to get there. To Test: - create a patron - give them currencies_manage and catalogue permissions - log in as this patron - observe that there is no Currencies link out of Acquisitions and Administration doesn't appear on the home page or the More menu - give the patron any other admin permission - observe that the Currencies link now shows in Acquisitions - take away admin permissions and give the patron full acquisitions permissions - observe that a link to Currencies still appears in Acquisitions
I guess this apply for other permissions as well. It seems tedious to handle that case.
Created attachment 86212 [details] [review] Bug 22444: currencies_manage permission doesn't provide link to manage currencies when selected alone This patch modifies the acquisitions sidebar menu so that it checks properly for the currencies_manage permission. This patch also removes the menu link directly to the administration home page. Since we're removing the check on the general "CAN_user_parameters" permission it doesn't make sense to assume the page is accessible. To test, apply the patch and modifiy a staff user so that they have no "parameters" permissions but do have "currencies_manage" permission. Go to the Acquisitions home page. There should be a link to currencies management in the sidebar menu. Perform the same test with a user who has "parameters" permissions but not "currencies_manage" permission. There should be no link to currencies in the acquisitions sidebar menu. The user should have access to the administrative home page.
(In reply to Andrew from comment #0) > Administration doesn't appear on the home page or the More menu Since all acquisitions-related management pages can be accessed from the acquisitions home page I don't think it's necessary to be concerned about the lack of a link to the administration home page.
Created attachment 87404 [details] [review] Bug 22444: currencies_manage permission doesn't provide link to manage currencies when selected alone This patch modifies the acquisitions sidebar menu so that it checks properly for the currencies_manage permission. This patch also removes the menu link directly to the administration home page. Since we're removing the check on the general "CAN_user_parameters" permission it doesn't make sense to assume the page is accessible. To test, apply the patch and modifiy a staff user so that they have no "parameters" permissions but do have "currencies_manage" permission. Go to the Acquisitions home page. There should be a link to currencies management in the sidebar menu. Perform the same test with a user who has "parameters" permissions but not "currencies_manage" permission. There should be no link to currencies in the acquisitions sidebar menu. The user should have access to the administrative home page. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Thx Owen!
Created attachment 87583 [details] [review] Bug 22444: currencies_manage permission doesn't provide link to manage currencies when selected alone This patch modifies the acquisitions sidebar menu so that it checks properly for the currencies_manage permission. This patch also removes the menu link directly to the administration home page. Since we're removing the check on the general "CAN_user_parameters" permission it doesn't make sense to assume the page is accessible. To test, apply the patch and modifiy a staff user so that they have no "parameters" permissions but do have "currencies_manage" permission. Go to the Acquisitions home page. There should be a link to currencies management in the sidebar menu. Perform the same test with a user who has "parameters" permissions but not "currencies_manage" permission. There should be no link to currencies in the acquisitions sidebar menu. The user should have access to the administrative home page. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
No regressions found and the change makes sense to me... Passing QA
Awesome work all! Pushed to master for 19.05
Pushed to 18.11.x for 18.11.05
backported to 18.05.x for 18.05.12