Bug 14528

Summary: Viewing lists fails silently when not having correct permisison
Product: Koha Reporter: Pete Edwards <koha>
Component: ListsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: chris, fridolin.somers, jonathan.druart, m.de.rooy, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14544
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 14528: Inconsistency in permissions check when listing shelves
Bug 14528: Inconsistency in permissions check when listing shelves
Bug 14528: Inconsistency in permissions check when listing shelves
[PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves

Description Pete Edwards 2015-07-13 16:21:11 UTC
Whilst testing the list permissions I found a problem. I have an account with staff client access and I went to the Lists module. You immediately get "Processing..." whilst an Ajax request takes place but then nothing else happens. I can debug to see that the search request failed to to not having permission. 
My primary concern is that I don't think any Ajax service call should fail silently like this - the user need to know it has failed.
In this case the permission needed was "borrowers" - see /svc/virtualshelves/search. That doesn't make any sense to me - why would I need to have permission to "Add or modify patrons" when I just want to see Lists?
Lastly, there may be some connection to issue 6960 but fixing that would only hide the primary problem described above.

To reproduce:
1. Set up a user without "borrowers" permission
2. Go to /cgi-bin/koha/virtualshelves/shelves.pl
3. Note that it says "Processing..." and never completes.
Comment 1 Jonathan Druart 2015-07-14 15:48:44 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2015-07-14 15:50:04 UTC Comment hidden (obsolete)
Comment 3 Nick Clemens 2015-07-19 02:12:07 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-10-03 20:38:48 UTC
Created attachment 43083 [details] [review]
[PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Tomás Cohen Arazi 2015-10-05 15:39:21 UTC
Patch pushed to master.

Thanks onathan!
Comment 6 Chris Cormack 2015-10-23 13:16:53 UTC
Pushed to 3.20.x will be in 3.20.5