Bug 13662

Summary: Serial permissions: receive_serials
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: SerialsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: chris, colin.campbell, julian.maurice, paola.rossi, tomascohen
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 13662: Fix the serials.receive_serials permissions
Bug 13662: Fix the serials.receive_serials permissions
36121: Bug 13662: Fix the serials.receive_serials permissions
Bug 13662: Fix the serials.receive_serials permissions

Description Jonathan Druart 2015-02-03 12:29:39 UTC
There are some issues with serial permissions.
For instance it's not possible to receive serials if the edit_subscription is not set.
It worked in a previous version (before 3.14).
Comment 1 Jonathan Druart 2015-02-03 12:37:42 UTC Comment hidden (obsolete)
Comment 2 Paola Rossi 2015-02-20 16:57:24 UTC
I've applied the patch against master 3.19.00.011 head 12948.

A) Step 5:
Permission edit_subscription ON, receive_serials OFF:
on /cgi-bin/koha/serials/subscription-detail.pl toolbar over "Subscription for [serial-title]:
Master:  "Edit" and "Close" are shown; no "New Subscription" is shown.
APPLIED: "Edit", "Close" and "New Subscription" are shown.

Selecting "New subscription" gets "Error: you do not have the permission to access this page ..." (RIGHT).

Anyway, I think that adding "New subscription" is a regression error of this bug.

B) Permission edit_subscription OFF, receive_serials ON :
on /cgi-bin/koha/serials/subscription-detail.pl toolbar over "Subscription for [serial-title]:"
Master:  toolbar is shown but it's empty.
APPLIED: "New Subscription" and "Receive" are shown.

Selecting "Receive" works fine (RIGHT).
Selecting "New subscription" gets "Error: you do not have the permission to access this page ..." (RIGHT).

Anyway, I think that adding "New subscription" is an error of this bug (ERROR).

C) Permission edit_subscription OFF, receive_serials ON :
C1) on /cgi-bin/koha/serials/serials-collection.pl toolbar over "Serial collection information for [serial-title]:"
Master:  toolbar is shown but it's empty.
APPLIED: no toolbar at all is shown (Is it RIGHT that the toolbar is empty? IMO yes, RIGHT fix).
C2) on /cgi-bin/koha/serials/serials-collection.pl "Edit" column at the left of the issues table:
Master: "disabled" is shown
APPLIED: selectable checkboxes (RIGHT, a good fix out of the test plan).

For the A) and B) errors I pass this patch to "Failed QA" status.
Comment 3 Jonathan Druart 2015-02-23 14:28:29 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-02-23 14:30:00 UTC
(In reply to Paola Rossi from comment #2)

Good catch Paola!
That should be fixed with the last patch.
Comment 5 Paola Rossi 2015-02-24 11:09:10 UTC Comment hidden (obsolete)
Comment 6 Brendan Gallagher 2015-03-02 15:15:09 UTC
Created attachment 36323 [details] [review]
Bug 13662: Fix the serials.receive_serials permissions

There are some issues with serial permissions.
For instance it's not possible to receive serials if the
edit_subscription is not set.
Also the toolbar is empty.

Test plan:
1/ Set the serials => receive_serials permissions to a patron (and only
this one for the serials module).
2/ Verify you cannot create a new subscription, you can search
subscriptions but cannot edit them.
3/ On the serial result list, receive a serial (action > Serial
receive).
You can now change the status and receive it.
4/ On the serial collection, you can edit 1+ serials to reveice it.
5/ Set the serials => edit_subscription permission and confirm there is
no regression.

QA note: I think we should introduce a C4::Serials::can_receive_serials
subroutine, to test the IndependentBranches pref, but I don't want to
add to much processing to check permissions.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 7 Tomás Cohen Arazi 2015-06-05 16:03:11 UTC
Patch pushed to master.

Thanks Josef!
Comment 8 Tomás Cohen Arazi 2015-06-05 16:03:36 UTC
I mean Jonathan!
Comment 9 Chris Cormack 2015-06-07 08:29:28 UTC
Pushed to 3.20.x will be in 3.20.1