Patch tested with a sandbox, by Pierre Angot <tredok.pierre@gmail.com>

Patch tested with a sandbox, by Pierre Angot <tredok.pierre@gmail.com>

I like this patch since we really need some permissions for shelves!!

But I think that we must not add manage shelves under editcatalogue.
Managing shelves should have its own permission (if we allow it in the first place). If this patch adds an entry for shelves/lists, I would also have the idea of adding/allowing Change ownership for instance. Note also the privacy issue here as noted in related reports (should a staff user be able to view these lists at all?).
So, you could remove manage_shelves from this patch or add a root entry like lists and start a discussion on how we should view the underlying manage. What we do need e.g. is a permission to manage shelves that do no longer have an owner (after deleting user).

Merge from shelves is another story: this indeed fits better under edit_catalogue.

A technical detail: To know member->userid you use GetMemberDetails: Isn't that quite overkill?
Also please watch operator priority in $user && $shelf->{owner}==$user) || C4::Auth::haspermission... Place parentheses? 

A test plan should be added too.

Thanks for your attention.

Created attachment 18247 [details] [review]
Bug 9833: Refine shelves permissions.

- This patch adds two new permissions for shelves:
   -  manage_shelves: allows to manage shelves
   - merge_from_shelves: allows to merge records from shelves

Signed-off-by: Pierre Angot <tredok.pierre@gmail.com>

Marcel,

I'm confused by the status of this patch - there's a signed off patch but it's failed QA?

I came up against this today, it would be super cool to get this little nagger fixed.

Liz

(In reply to Liz Rea from comment #8)
> Marcel,
> 
> I'm confused by the status of this patch - there's a signed off patch but
> it's failed QA?
> 
> I came up against this today, it would be super cool to get this little
> nagger fixed.
> 
> Liz

I hope that Matthias as author of the patch (or someone else from Biblibre?) adjusts this patch to make it pass qa.

Picked some discussion from irc log:
==========
wizzyrea: and even better, apparently there was a bug at some point that set the owners to NULL, so there are lists existent that cannot be edited by anyone?!

dcook: That is a bit confusing...I can't tell if Marcel passed or failed it based on the comments.. Although it does look like he's asking for some changes? then he attached a patch...
============= [End of quote]

Do no know exactly any more but I must have attached this patch just for a trivial rebase. Yes, I failed this patch for reasons mentioned in comment 6.

Note also that there are privacy issues on viewing/editing all lists by superlibs. Furthermore, I am still working on development for sharing lists that should also cover the topic of lists without owner (i call them orphaned lists). It should be the third patch of the Sharing a lists- series..

Hope that helps.

The lists owned by NULL happens when the borrower that created the list is deleted. That's probably a different bug than this. 

Matthias, any chance of getting this fixed up?

Merge from shelves is more a cataloguing action non ?
Should be a permission under "editcatalogue".
It is actually depending on "edit_catalogue" permission.

(In reply to Fridolin Somers from comment #12)
> Merge from shelves is more a cataloguing action non ?
> Should be a permission under "editcatalogue".
> It is actually depending on "edit_catalogue" permission.

I think maybe merging could be a general permission applying to merging in the cataloguing module or in lists and be listed under cataloguing. 

And I would recommend splitting this bug into 2.