| Summary: | Permission check for editing help files is broken | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
| Component: | Authentication | Assignee: | Galen Charlton <gmcharlt> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dpavlin, jonathan.druart, tomascohen, veron |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6422 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11115 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18472 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18483 |
||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | --- | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: | Circulation function: | ||
I think this is kind of a bigger problem - only superlibrarians can currently edit help files. Of course, editing help files comes with its own set of problems, as any changes made will be overwritten when updating. A fix could be to add a permission to edit help files. Hi Jonathan, that would probably be the cleanest option. - Right now it's limited to the superlibrarian, but the code seems like it intended something else? The only way to solve this, is to have a specific permission and, of course, an overlay help file so it is not overwritten on update. Bug 18483 - "Customised help: Enhance staff client with news based, easily editable help system" adds two new user permissions: edit_news and edit_help |
To test: - Try editing a help file as superlibrarian, confirm you get to the editor. You might not be able to save your changes though, because of file permissions. - Try editing a help file with any of the listed permissions from the edithelp.pl file: 43 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( 44 { 45 template_name => "help/edithelp.tt", 46 query => $input, 47 type => "intranet", 48 authnotrequired => 0, 49 flagsrequired => { 50 catalogue => 1, 51 circulate => 1, 52 parameters => 1, 53 borrowers => 1, 54 permissions => 1, 55 reserveforothers => 1, 56 borrow => 1, 57 reserveforself => 1, 58 editcatalogue => 1, 59 updatecharges => 1, 60 }, 61 debug => 1, 62 } 63 ); Verify it doesn't work. I think reserveforself doesn't exist in current Koha and the choice of permissions seems a bit arbitrary.