Since Bug 30230, a user can see patron details without edit_borrowers permission. In tools bar, "Add message" needs to check this permission. Maybe other places.
Test with authentication on staff interface with only permissions 'catalogue' and 'list_borrowers'. On a patron page try add a message => you get permission denied page.
Created attachment 164433 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors 3. Apply patch, restart all, reload the page 4. Notice the buttons in the toolbar are gone
Created attachment 164434 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone
Created attachment 164435 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there
These patches remove all the edit and add buttons that I could find that would lead to permissions errors in the patron toolbar, members tool bar and the patron details.
Created attachment 164488 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone Signed-off-by: Esther <esther@bywatersolutions.com>
Created attachment 164489 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there Signed-off-by: Esther <esther@bywatersolutions.com>
Created attachment 164623 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors 3. Apply patch, restart all, reload the page 4. Notice the buttons in the toolbar are gone Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Created attachment 164624 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers To test: 1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions 2. Search for a patron 3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page 4. You may have to enable some system prefereences like HouseboundModule to fully test 5. Test that things like Additional attributes and identifiers are still displayed 3. Apply patch, restart all, reload the page 4. Notice the edit and add buttons in the patron details page are gone Signed-off-by: Esther <esther@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Created attachment 164625 [details] [review] Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl To test: 1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions 2. From the main page click on Patrons 3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors 4. Apply patch, restart all, reload the page 5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there Signed-off-by: Esther <esther@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Patches work as expected and pass QA checks
Pushed for 24.05! Well done everyone, thank you!
Pushed to 23.11.x for 23.11.05
Missing 23.05.x dependencies, no backport.