Bug 8839 - Independant Branches - Checkout to patron belonging to another branch
Summary: Independant Branches - Checkout to patron belonging to another branch
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Kyle M Hall
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-27 15:24 UTC by Kyle M Hall
Modified: 2023-07-29 12:27 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 8839 - Independant Branches - Checkout to patron belonging to another branch (4.84 KB, patch)
2012-09-27 15:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 8839 - Independant Branches - Checkout to patron belonging to another branch (4.87 KB, patch)
2012-10-09 14:44 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 8839 - Independant Branches - Checkout to patron belonging to another branch (4.43 KB, patch)
2013-01-25 15:38 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2012-09-27 15:24:45 UTC

    
Comment 1 Kyle M Hall 2012-09-27 15:27:24 UTC
Some libraries want to use the IndependantBranches feature to prevent libraries from editing each other's patron records while still allowing any library to issue items to another library's patrons.

It appears that this behavior may have been standard in some previous versions of Koha, but is currently not.
Comment 2 Kyle M Hall 2012-09-27 15:29:26 UTC Comment hidden (obsolete)
Comment 3 Frédéric Demians 2012-10-04 15:54:11 UTC
It's not that clear from a Koha administrator perspective since
IndependantBranches means no authorization to modify anything from
another branch. And what will you do if a library want the contrary:
preventing issuing but allowing to see other branch borrowers?

Couldn't you reach your goal with a syspref named
'IndependantBranchOverwriteTo', with those values:

  - nothing
  - Issue to other branches
  - See other branches borrowers
  - Issue to other branches and see other branches borrowers
Comment 4 Kyle M Hall 2012-10-05 11:18:44 UTC
(In reply to comment #3)
> It's not that clear from a Koha administrator perspective since
> IndependantBranches means no authorization to modify anything from
> another branch. And what will you do if a library want the contrary:
> preventing issuing but allowing to see other branch borrowers?
> 
> Couldn't you reach your goal with a syspref named
> 'IndependantBranchOverwriteTo', with those values:
> 
>   - nothing
>   - Issue to other branches
>   - See other branches borrowers
>   - Issue to other branches and see other branches borrowers

Without a large amount of development, it's not possible to issue to a borrower without being allowed to see them. The same goes for being able to view a borrower without being able to issue to them ( though this is less complicated ).

I think this is a good start. Those other options can be added on an as needed basis.

I do wonder if I should change the name of the system preference to something like IndependantBranchesCirculation instead though.
Comment 5 Frédéric Demians 2012-10-05 13:11:41 UTC
Ok, I understand! I was scratching nowhere. From my perspective, trying
to have the end user perspective, the difficulty is to understand how
both sysprefs work together: IndependantBranches and the new one.
Cascading sysprefs are a pain to work with...

Yes, a syspref without negative spelling, witouth 'prevent', would be
better to understand.
Comment 6 Kyle M Hall 2012-10-09 14:44:34 UTC Comment hidden (obsolete)
Comment 7 Kyle M Hall 2013-01-25 15:38:49 UTC
Created attachment 14865 [details] [review]
Bug 8839 - Independant Branches - Checkout to patron belonging to another branch

Adds the new system preference IndependantBranchesCirculation to control
whether IndependantBranches stops one branch from viewing the patron record
or issuing items to a patron from a different library.
Comment 8 Fred P 2013-02-12 15:37:34 UTC
   You may be aware about the IndependantBranches preference issue. Setting IndependantBranches to "Don't Prevent" overrides the AutoLocation "Require" ip range restrictions, allowing remote access from anywhere, with implications for security.

Auth.pm around line 834:

 if (C4:Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('AutoLocation')){
  # we have to check they are coming from the right ip range

  If we do not restrict remote access, we need to implement stronger login security. 

 So I am wondering how the new IndependantBranches settings affect security. Are we still wide open to password cracking if we say "Don't Prevent" for IndependantBranches? Or do the new settings help secure the system?
Comment 9 Fred P 2013-02-12 15:40:39 UTC
Sorry, that's probably a separate issue...
Comment 10 Owen Leonard 2013-03-18 15:46:41 UTC
No test plan.
Comment 11 Marc Véron 2016-05-23 15:28:07 UTC
Still valid?
Comment 12 Katrin Fischer 2023-07-29 12:27:06 UTC
Kyle, is this resolved with the newer library group features?