Bug 14528

Summary:	Viewing lists fails silently when not having correct permisison
Product:	Koha	Reporter:	Pete Edwards <koha>
Component:	Lists	Assignee:	Jonathan Druart <jonathan.druart>
Status:	CLOSED FIXED	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	chris, fridolin.somers, jonathan.druart, m.de.rooy, tomascohen
Version:	unspecified
Hardware:	All
OS:	All
See Also:	http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14544
Change sponsored?:	---	Patch complexity:	Small patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Bug 14528: Inconsistency in permissions check when listing shelves Bug 14528: Inconsistency in permissions check when listing shelves Bug 14528: Inconsistency in permissions check when listing shelves [PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves

Description Pete Edwards 2015-07-13 16:21:11 UTC

Whilst testing the list permissions I found a problem. I have an account with staff client access and I went to the Lists module. You immediately get "Processing..." whilst an Ajax request takes place but then nothing else happens. I can debug to see that the search request failed to to not having permission. 
My primary concern is that I don't think any Ajax service call should fail silently like this - the user need to know it has failed.
In this case the permission needed was "borrowers" - see /svc/virtualshelves/search. That doesn't make any sense to me - why would I need to have permission to "Add or modify patrons" when I just want to see Lists?
Lastly, there may be some connection to issue 6960 but fixing that would only hide the primary problem described above.

To reproduce:
1. Set up a user without "borrowers" permission
2. Go to /cgi-bin/koha/virtualshelves/shelves.pl
3. Note that it says "Processing..." and never completes.

Comment 1 Jonathan Druart 2015-07-14 15:48:44 UTC Comment hidden (obsolete)

Created attachment 40995 [details] [review]
Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Comment 2 Jonathan Druart 2015-07-14 15:50:04 UTC Comment hidden (obsolete)

Created attachment 40996 [details] [review]
Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Comment 3 Nick Clemens (kidclamp) 2015-07-19 02:12:07 UTC Comment hidden (obsolete)

Created attachment 41090 [details] [review]
Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Comment 4 Katrin Fischer 2015-10-03 20:38:48 UTC

Created attachment 43083 [details] [review]
[PASSED QA] Bug 14528: Inconsistency in permissions check when listing shelves

The svc script needed borrowers when the shelves.pl needed catalogue.
There is no sense to have different permissions here.

Test plan:
1/ Remove the borrowers permission to a user
2/ Use this user to log in
3/ Go on the shelf list
4/ Without this patch, you should get an endless "Processing..." which
is fixed if you apply it.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Comment 5 Tomás Cohen Arazi (tcohen) 2015-10-05 15:39:21 UTC

Patch pushed to master.

Thanks onathan!

Comment 6 Chris Cormack 2015-10-23 13:16:53 UTC

Pushed to 3.20.x will be in 3.20.5