Bug 13910

Summary: Prevent delete of one's own patron account
Product: Koha Reporter: David Cook <dcook>
Component: PatronsAssignee: Marc Véron <veron>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: chris, gmcharlt, jonathan.druart, kyle.m.hall, sheila.kearns, tomascohen, veron
Version: Main   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10910
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10909
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14077
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14077    
Attachments: Bug 13910 - Prevent delete of one's own patron account
Bug 13910 - Prevent delete of one's own patron account
Bug 13910 - Prevent delete of one's own patron account
[Follow-up] Bug 13910 - Line with AUTH_UPDATE_FAILED restored
Bug 13910 - Prevent delete of one's own patron account
Bug 13910 - Line with AUTH_UPDATE_FAILED restored
[PASSED QA] Bug 13910 - Prevent delete of one's own patron account
[PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored

Description David Cook 2015-03-25 22:30:41 UTC
When deleting accounts, it should be impossible to delete one's own borrower account.

Over the years, I've had a few librarians accidentally delete themselves and lock themselves out of Koha. 

I suppose there are quite a few ways this could be implemented. I don't have a patch yet, but this report here is mostly a placeholder for when I do...
Comment 1 Sheila Kearns 2015-04-23 19:08:43 UTC
It may be a different area of permissions, but it would also be useful if permission to delete patrons was separate from permissions to add and modify patrons. Circulation staff need to add and modify, but an option to prevent them from deleting patrons would be usefuo.
Comment 2 Marc Véron 2015-04-23 21:10:05 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-04-28 15:21:57 UTC
Set ExportWithCsvProfile and the export column won't appear anymore with your patch.
It's certainly related to this change:
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
@@ -1,4 +1,4 @@
-[% USE Koha %]
+

Why did you remove that?
Comment 4 Marc Véron 2015-04-29 05:33:49 UTC Comment hidden (obsolete)
Comment 5 Mark Tompsett 2015-04-29 07:35:19 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-04-29 08:33:22 UTC
Comment on attachment 38638 [details] [review]
Bug 13910 - Prevent delete of one's own patron account

Review of attachment 38638 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
@@ +144,3 @@
>  [% IF ( error ) %]
>  <div class="dialog alert">
> +    [% IF ( error == 'AUTH_UPDATE_FAILED' ) %]

I don't manager to trigger this one.
Looking at the code, it is never set.
I would prefer not to see this one changed in this bug report but remove in its own bug.
Comment 7 Marc Véron 2015-04-29 09:20:48 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-04-29 09:31:13 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-04-29 09:31:21 UTC Comment hidden (obsolete)
Comment 10 Marc Véron 2015-04-29 10:05:14 UTC
(In reply to Jonathan Druart from comment #9)
(...)
> This should be fixed in a separate patch, this error is not sent to the
> template and the related code could be removed.

See Bug 14077
Comment 11 Katrin Fischer 2015-04-29 20:01:15 UTC
Created attachment 38678 [details] [review]
[PASSED QA] Bug 13910 - Prevent delete of one's own patron account

This patch adds a check to prevent deleting the user's own account.
Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting.

To test:
- Apply patch
- Create a user with sufficient privileges to delete users
- Log in as this new user
- Try to delete this user. Confirm message box "Are you sure..."
- Confirm that you get a message "Not allowed to delete own account" and that the user still exists.

Bonus test:
Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE'
(You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF  etc.)
Without patch, no message appears. With patch, messages appear as appropriate.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

NOTE: Attempted all CANT combinations. From reading the code,
this is kind of an important patch, because I'm not sure
deleting error messages work at all right now based on what
I read.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 12 Katrin Fischer 2015-04-29 20:01:33 UTC
Created attachment 38679 [details] [review]
[PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored

As of comment #6

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
This should be fixed in a separate patch, this error is not sent to the
template and the related code could be removed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Tomás Cohen Arazi 2015-05-14 14:56:31 UTC
Patches pushed to master.

Thanks Marc!
Comment 14 Chris Cormack 2015-05-17 22:59:24 UTC
Pushed to 3.18.x will be in 3.18.7