Bug 8539 - Library transfer limits page has incorrect permission
Summary: Library transfer limits page has incorrect permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Katrin Fischer
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-31 15:40 UTC by Owen Leonard
Modified: 2015-06-04 23:30 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 8539: Library transfer limits page has incorrect permission (1.30 KB, patch)
2014-07-12 12:28 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 8539: Library transfer limits page has incorrect permission (1.37 KB, patch)
2014-08-09 05:56 UTC, Nick Clemens
Details | Diff | Splinter Review
[PASSED QA] Bug 8539: Library transfer limits page has incorrect permission (1.43 KB, patch)
2014-08-15 17:48 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2012-07-31 15:40:48 UTC
Permissions for branch_transfer_limits.pl are defined as "flagsrequired => {borrowers => 1}." This makes the page accessible to any user with permission to add or modify patrons.

Based on the other admin scripts, the correct setting appears to be "parameters => 'parameters_remaining_permissions'"
Comment 1 Katrin Fischer 2014-07-12 12:28:34 UTC Comment hidden (obsolete)
Comment 2 Nick Clemens 2014-08-09 05:56:40 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-08-09 08:59:37 UTC
Thx Nick!
Comment 4 Kyle M Hall 2014-08-15 17:48:43 UTC
Created attachment 30859 [details] [review]
[PASSED QA] Bug 8539: Library transfer limits page has incorrect permission

Without this patch the library transfer page required the
'borrowers' permission, which is not quite right for a page
in the administration module.

This patch changes the permission to 'parameters_remaining_permissions'

To test:
Verify the page is accessbile with:
- superlibrarian
- administration (full)
- administration, remaining permissions (without manage_circ_rules)
Verify the page is not accessible without all of those permissions.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Tomás Cohen Arazi 2014-08-20 20:58:28 UTC
Patch pushed to master.

Thanks Katrin!
Comment 6 Galen Charlton 2014-08-26 22:27:14 UTC
Pushed to 3.16.x for inclusion in 3.16.3.