|
Description
Owen Leonard
2013-09-13 18:46:04 UTC
Created attachment 21098 [details] [review] Bug 10888 - Don't hide authorities module from users without permission to edit authorities It should be possible for staff client users to search and view authority records even if they don't have permission to edit them. To test, apply the patch and view the staff client as a user with and without "editauthorities" permission. With "editauthorities" permission, authority search results should show both an edit and delete link. Viewing the details of an authority record, one should see a toolbar with edit/delete/new options. The detail view has been altered to use the term "record" in place of "biblio" ("Used in X record(s)). Without "editauthorities" permission, authority search results should show no edit or delete link. Viewing the details of an authority, the only option shown in the toolbar should be "Save." On the staff client home page and in the header's "More" menu the link to the authorities module should now appear with and without permission to edit authorities. *** Bug 5916 has been marked as a duplicate of this bug. *** *** Bug 9086 has been marked as a duplicate of this bug. *** I installed the patch. It works fine with the "editauthorities" permission. Without the "editauthorities" permission, the search works well, while the save option doesn't work and sends the session in "you're not permitted" webpage. The save option sends you to this link: /cgi-bin/koha/authorities/export.pl?format=mads&op=export&authid=1 The cgi export.pl, under "authorities", is affected by "editauthorities" permission. So I can't sign off. In my opinion the patch is not complete; we have two options in the case of no "editauthorities" permission: 1) authority search results should show no edit or delete link or save link; 2) a new specific permission is required, to search and to save too. Thanks Paola, you're right that this needs more work. Setting this to "in discussion" is too polite. It should be "Failed QA." Created attachment 21124 [details] [review] Bug 10888 - Don't hide authorities module from users without permission to edit authorities It should be possible for staff client users to search and view authority records even if they don't have permission to edit them. To test, apply the patch and view the staff client as a user with and without "editauthorities" permission. With "editauthorities" permission, authority search results should show both an edit and delete link. Viewing the details of an authority record, one should see a toolbar with edit/delete/new options. The detail view has been altered to use the term "record" in place of "biblio" ("Used in X record(s)). Without "editauthorities" permission, authority search results should show no edit or delete link. Viewing the details of an authority, the only option shown in the toolbar should be "Save." On the staff client home page and in the header's "More" menu the link to the authorities module should now appear with and without permission to edit authorities. Revision: Corrected permissions in export script to allow saving of authority records by users who do not have permission to edit. I can't sign off the patch. With permission to edit authorities, all the options but "Edit" work fine. So, in the cgi searchresultlist.tt, I changed the line 89 from: <a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid %]">Edit</a> to: <a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% resul.authid %]">Edit</a> Then, with permission to edit authorities, all the options work fine. Without permission to edit authorities, the option "save" works fine. But the option "duplicate" is presented too. Created attachment 21142 [details] [review] Bug 10888 - Don't hide authorities module from users without permission to edit authorities It should be possible for staff client users to search and view authority records even if they don't have permission to edit them. To test, apply the patch and view the staff client as a user with and without "editauthorities" permission. With "editauthorities" permission, authority search results should show both an edit and delete link. Viewing the details of an authority record, one should see a toolbar with edit/delete/new options. The detail view has been altered to use the term "record" in place of "biblio" ("Used in X record(s)). Without "editauthorities" permission, authority search results should show no edit or delete link. Viewing the details of an authority, the only option shown in the toolbar should be "Save." On the staff client home page and in the header's "More" menu the link to the authorities module should now appear with and without permission to edit authorities. Revision: Corrected permissions in export script to allow saving of authority records by users who do not have permission to edit. Revision: Corrected incorrect merge with 10600 (duplicate authority) Created attachment 21143 [details] [review] Bug 10888 - Don't hide authorities module from users without permission to edit authorities It should be possible for staff client users to search and view authority records even if they don't have permission to edit them. To test, apply the patch and view the staff client as a user with and without "editauthorities" permission. With "editauthorities" permission, authority search results should show both an edit and delete link. Viewing the details of an authority record, one should see a toolbar with edit/delete/new options. The detail view has been altered to use the term "record" in place of "biblio" ("Used in X record(s)). Without "editauthorities" permission, authority search results should show no edit or delete link. Viewing the details of an authority, the only option shown in the toolbar should be "Save." On the staff client home page and in the header's "More" menu the link to the authorities module should now appear with and without permission to edit authorities. Revision: Corrected permissions in export script to allow saving of authority records by users who do not have permission to edit. Revision: Corrected incorrect merge with 10600 (duplicate authority) Created attachment 21226 [details] [review] Bug 10888 Don t hide authorities module from users without permission to edit authorities I signed off the patch QA comment: Looks consistent to me. I don't think a new permission for searching authorities is relevant. Marked as Passed QA. Created attachment 21229 [details] [review] Bug 10888 - Don't hide authorities module from users without permission to edit authorities It should be possible for staff client users to search and view authority records even if they don't have permission to edit them. To test, apply the patch and view the staff client as a user with and without "editauthorities" permission. With "editauthorities" permission, authority search results should show both an edit and delete link. Viewing the details of an authority record, one should see a toolbar with edit/delete/new options. The detail view has been altered to use the term "record" in place of "biblio" ("Used in X record(s)). Without "editauthorities" permission, authority search results should show no edit or delete link. Viewing the details of an authority, the only option shown in the toolbar should be "Save." On the staff client home page and in the header's "More" menu the link to the authorities module should now appear with and without permission to edit authorities. Revision: Corrected permissions in export script to allow saving of authority records by users who do not have permission to edit. Revision: Corrected incorrect merge with 10600 (duplicate authority) Signed-off-by: Paola Rossi <paola.rossi@cineca.it> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> General reminder -- when signing off, please remember to mark 'obsolete' older versions of the patch when attaching the version with your signoff. Pushed to master. Thanks, Owen! This patch has been pushed to 3.12.x, will be in 3.12.7. Thanks Owen! |