You can't do the order search on acquisitions if you have the following permissions: group_manage Manage orders & basketgroups order_manage Manage orders & basket order_receive Manage orders & basket I think you should be able to search acquisitions if you're allowed to order things or manage vendors.
Bug still valid in 3.6. It happen on order histearch.pl. I agree with Nicole suggested behaviour
Created attachment 7506 [details] [review] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring budget_add_del, budget_manage, and budget_modify
Kyle, If my patron has: group_manage Manage orders & basketgroups order_manage Manage orders & basket order_receive Manage orders & basket The permissions needed to place an order I still can't do an order search. I'm not sure what you're saying about the budget stuff, but it's the order search that needs fixing. Nicole
Created attachment 7653 [details] [review] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring group_manage, order_manage, and order_receive
Created attachment 7671 [details] [review] [SIGNED-OFF] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring group_manage, order_manage, and order_receive Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Changes permission call only to allow for partial acq permissions to access this page. Marking Passed QA.
This fix was included in the 3.6.x branch prior to 3.6.4.
I reopen this bug because it does not behave like wanted. Using : flagsrequired => { acquisition => 'group_manage', acquisition => 'order_manage', acquisition => 'order_receive' }, flagsrequired is a hash so setting 3 times the same key results in a hash with only : { acquisition => 'order_receive' } So instead of requiring group_manage, order_manage and order_receive permissions, acq search page only needs order_receive. Tested with only group_manage or only order_manage, permission is denied. Using several permissions on same module will need development in C4::Auth. It should allow a boolean combination of permissions I think.
Created attachment 15721 [details] [review] [reopened] Proposed patch I propose to use any acqui permission to allow order search. See commit message.
Created attachment 15781 [details] [review] Bug 7018 : need all acq permissions to search All acquisition module permissions are needed to allow order search (acqui/histsearch.pl). With this patch any acquisition permission allows to order search. Many other pages of this module have this behavior. Test plan : - Set for a user only one permission in acquisition module (not order_receive) => they also need catalogue permission to be able to log in - Login with this user and try to perform an order search => you get access to page - Set for a user no permission in acquisition module - Login with this user and try to perform an order search => you do not get access to page Signed-off-by: MJ Ray <mjr@phonecoop.coop>
Looking at this now.
Created attachment 16481 [details] [review] [PASSED QA] Bug 7018 : need all acq permissions to search All acquisition module permissions are needed to allow order search (acqui/histsearch.pl). With this patch any acquisition permission allows to order search. Many other pages of this module have this behavior. Test plan : - Set for a user only one permission in acquisition module (not order_receive) => they also need catalogue permission to be able to log in - Login with this user and try to perform an order search => you get access to page - Set for a user no permission in acquisition module - Login with this user and try to perform an order search => you do not get access to page Signed-off-by: MJ Ray <mjr@phonecoop.coop> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Works as expected and passes tests.
This patch has been pushed to master.
Pushed to 3.10.x and 3.8.x will be in 3.10.5 and 3.8.12