Bug 7018 - need all acq permissions to search
Summary: need all acq permissions to search
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical (vote)
Assignee: Fridolin Somers
QA Contact: Katrin Fischer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-10-12 20:15 UTC by Nicole C. Engard
Modified: 2019-06-27 09:24 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 7018 - need all acq permissions to search (1.00 KB, patch)
2012-02-08 15:48 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 7018 - need all acq permissions to search (1023 bytes, patch)
2012-02-15 12:51 UTC, Kyle M Hall
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 7018 - need all acq permissions to search (1.07 KB, patch)
2012-02-16 02:24 UTC, Nicole C. Engard
Details | Diff | Splinter Review
[reopened] Proposed patch (1.37 KB, patch)
2013-02-27 10:23 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 7018 : need all acq permissions to search (1.47 KB, patch)
2013-02-28 17:01 UTC, MJ Ray (software.coop)
Details | Diff | Splinter Review
[PASSED QA] Bug 7018 : need all acq permissions to search (1.57 KB, patch)
2013-03-20 10:28 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nicole C. Engard 2011-10-12 20:15:53 UTC
You can't do the order search on acquisitions if you have the following permissions:

group_manage Manage orders & basketgroups
order_manage Manage orders & basket
order_receive Manage orders & basket 

I think you should be able to search acquisitions if you're allowed to order things or manage vendors.
Comment 1 Paul Poulain 2011-10-26 14:42:31 UTC
Bug still valid in 3.6. It happen on order histearch.pl. I agree with Nicole suggested behaviour
Comment 2 Kyle M Hall 2012-02-08 15:48:34 UTC Comment hidden (obsolete)
Comment 3 Nicole C. Engard 2012-02-14 19:41:23 UTC
Kyle,

If my patron has:

group_manage Manage orders & basketgroups
order_manage Manage orders & basket
order_receive Manage orders & basket 

The permissions needed to place an order I still can't do an order search.  I'm not sure what you're saying about the budget stuff, but it's the order search that needs fixing.

Nicole
Comment 4 Kyle M Hall 2012-02-15 12:51:12 UTC Comment hidden (obsolete)
Comment 5 Nicole C. Engard 2012-02-16 02:24:51 UTC Comment hidden (obsolete)
Comment 6 Ian Walls 2012-02-16 17:39:03 UTC
Changes permission call only to allow for partial acq permissions to access this page.  Marking Passed QA.
Comment 7 Jared Camins-Esakov 2012-05-23 13:01:46 UTC
This fix was included in the 3.6.x branch prior to 3.6.4.
Comment 8 Fridolin Somers 2013-02-27 10:13:02 UTC
I reopen this bug because it does not behave like wanted.
Using :
  flagsrequired   => { 
    acquisition => 'group_manage', 
    acquisition => 'order_manage', 
    acquisition => 'order_receive'
  },
flagsrequired is a hash so setting 3 times the same key results in a hash with only : 
  { acquisition => 'order_receive' }

So instead of requiring group_manage, order_manage and order_receive permissions, acq search page only needs order_receive.
Tested with only group_manage or only order_manage, permission is denied.

Using several permissions on same module will need development in C4::Auth.
It should allow a boolean combination of permissions I think.
Comment 9 Fridolin Somers 2013-02-27 10:23:13 UTC Comment hidden (obsolete)
Comment 10 MJ Ray (software.coop) 2013-02-28 17:01:24 UTC Comment hidden (obsolete)
Comment 11 Katrin Fischer 2013-03-20 10:14:18 UTC
Looking at this now.
Comment 12 Katrin Fischer 2013-03-20 10:28:10 UTC
Created attachment 16481 [details] [review]
[PASSED QA] Bug 7018 : need all acq permissions to search

All acquisition module permissions are needed to allow order search (acqui/histsearch.pl).

With this patch any acquisition permission allows to order search.
Many other pages of this module have this behavior.

Test plan :
- Set for a user only one permission in acquisition module (not order_receive)
=> they also need catalogue permission to be able to log in
- Login with this user and try to perform an order search
=> you get access to page
- Set for a user no permission in acquisition module
- Login with this user and try to perform an order search
=> you do not get access to page

Signed-off-by: MJ Ray <mjr@phonecoop.coop>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as expected and passes tests.
Comment 13 Jared Camins-Esakov 2013-03-20 12:09:12 UTC
This patch has been pushed to master.
Comment 14 Chris Cormack 2013-03-29 06:42:41 UTC
Pushed to 3.10.x and 3.8.x will be in 3.10.5 and 3.8.12