Bug 35980 - Add message to patron needs permission check
Summary: Add message to patron needs permission check
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Brendan Lawlor
QA Contact: Julian Maurice
URL:
Keywords:
Depends on: 30230
Blocks:
  Show dependency treegraph
 
Reported: 2024-02-01 16:07 UTC by Fridolin Somers
Modified: 2024-05-13 19:44 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.05


Attachments
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc (2.41 KB, patch)
2024-04-04 16:48 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt (13.14 KB, patch)
2024-04-04 17:32 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc (3.88 KB, patch)
2024-04-04 18:39 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt (13.19 KB, patch)
2024-04-05 18:04 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc (3.93 KB, patch)
2024-04-05 18:05 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc (2.46 KB, patch)
2024-04-10 12:51 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt (13.25 KB, patch)
2024-04-10 12:51 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc (3.99 KB, patch)
2024-04-10 12:51 UTC, Julian Maurice
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin Somers 2024-02-01 16:07:28 UTC
Since Bug 30230, a user can see patron details without edit_borrowers permission.
In tools bar, "Add message" needs to check this permission.

Maybe other places.
Comment 1 Fridolin Somers 2024-02-01 16:09:21 UTC
Test with authentication on staff interface with only permissions 'catalogue' and 'list_borrowers'.
On a patron page try add a message => you get permission denied page.
Comment 2 Brendan Lawlor 2024-04-04 16:48:22 UTC
Created attachment 164433 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc

This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors
3. Apply patch, restart all, reload the page
4. Notice the buttons in the toolbar are gone
Comment 3 Brendan Lawlor 2024-04-04 17:32:56 UTC
Created attachment 164434 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt

This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page
4. You may have to enable some system prefereences like HouseboundModule to fully test
5. Test that things like Additional attributes and identifiers are still displayed
3. Apply patch, restart all, reload the page
4. Notice the edit and add buttons in the patron details page are gone
Comment 4 Brendan Lawlor 2024-04-04 18:39:21 UTC
Created attachment 164435 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc

This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl

To test:
1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions
2. From the main page click on Patrons
3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors
4. Apply patch, restart all, reload the page
5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there
Comment 5 Brendan Lawlor 2024-04-04 18:43:44 UTC
These patches remove all the edit and add buttons that I could find that would lead to permissions errors in the patron toolbar, members tool bar and the patron details.
Comment 6 ByWater Sandboxes 2024-04-05 18:04:58 UTC
Created attachment 164488 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt

This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page
4. You may have to enable some system prefereences like HouseboundModule to fully test
5. Test that things like Additional attributes and identifiers are still displayed
3. Apply patch, restart all, reload the page
4. Notice the edit and add buttons in the patron details page are gone

Signed-off-by: Esther <esther@bywatersolutions.com>
Comment 7 ByWater Sandboxes 2024-04-05 18:05:00 UTC
Created attachment 164489 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc

This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl

To test:
1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions
2. From the main page click on Patrons
3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors
4. Apply patch, restart all, reload the page
5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there

Signed-off-by: Esther <esther@bywatersolutions.com>
Comment 8 Julian Maurice 2024-04-10 12:51:11 UTC
Created attachment 164623 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc

This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors
3. Apply patch, restart all, reload the page
4. Notice the buttons in the toolbar are gone

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 9 Julian Maurice 2024-04-10 12:51:14 UTC
Created attachment 164624 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt

This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page
4. You may have to enable some system prefereences like HouseboundModule to fully test
5. Test that things like Additional attributes and identifiers are still displayed
3. Apply patch, restart all, reload the page
4. Notice the edit and add buttons in the patron details page are gone

Signed-off-by: Esther <esther@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 10 Julian Maurice 2024-04-10 12:51:17 UTC
Created attachment 164625 [details] [review]
Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc

This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl

To test:
1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions
2. From the main page click on Patrons
3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors
4. Apply patch, restart all, reload the page
5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there

Signed-off-by: Esther <esther@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 11 Julian Maurice 2024-04-10 12:54:49 UTC
Patches work as expected and pass QA checks
Comment 12 Katrin Fischer 2024-04-11 14:54:39 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 13 Fridolin Somers 2024-04-18 06:41:02 UTC
Pushed to 23.11.x for 23.11.05
Comment 14 Lucas Gass 2024-05-13 19:44:50 UTC
Missing 23.05.x dependencies, no backport.