Bug 26721 - Debit and credit type pages should check for the specific permission
Summary: Debit and credit type pages should check for the specific permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Katrin Fischer
QA Contact: Martin Renvoize
URL:
Keywords: Academy
Depends on:
Blocks:
 
Reported: 2020-10-18 15:11 UTC by Katrin Fischer
Modified: 2021-06-14 21:33 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
20.11.00


Attachments
Bug 26721: Fix permission check on debit and credit type admin pages (1.87 KB, patch)
2020-10-18 15:17 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26721: Fix permission check on debit and credit type admin pages (1.93 KB, patch)
2020-10-25 20:41 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 26721: Fix permission check on debit and credit type admin pages (1.99 KB, patch)
2020-11-02 11:21 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2020-10-18 15:11:07 UTC
At the moment, the pages check for:

admin/credit_types.pl:        flagsrequired   => { parameters => 'parameters_remaining_permissions' },
admin/debit_types.pl:        flagsrequired   => { parameters => 'parameters_remaining_permissions' },

But the templates like admin home page check for the correct specific permission:

[% IF ( CAN_user_parameters_manage_accounts ) %]
Comment 1 Katrin Fischer 2020-10-18 15:17:20 UTC
Created attachment 111947 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible
Comment 2 Chris Cormack 2020-10-25 20:41:18 UTC
Created attachment 112481 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Martin Renvoize 2020-11-02 11:21:20 UTC
Created attachment 112825 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2020-11-02 11:22:05 UTC
Dang.. how did I get these mismatched!

Works as expected, thanks for the fix Katrin.

Passing QA
Comment 5 Jonathan Druart 2020-11-03 09:59:07 UTC
Pushed to master for 20.11, thanks to everybody involved!
Comment 6 Lucas Gass 2020-11-16 20:37:22 UTC
does not apply cleanly to 20.05.x, no backport