Bug 14713

We had the same issue and found out that in order for fine collection to work, 

 (borrowers) Add or modify patrons 

permission must also be checked!

Can you please verify it? 
If so, this finding should could help the person who deals with the case identify the problem. If this is by design (although these permissions should work independently!), a note should be added in the relevant docs.

(In reply to Theodoros Theodoropoulos from comment #1)
> We had the same issue and found out that in order for fine collection to
> work, 
> 
>  (borrowers) Add or modify patrons 
> 
> permission must also be checked!
> 
> Can you please verify it? 
> If so, this finding should could help the person who deals with the case
> identify the problem. If this is by design (although these permissions
> should work independently!), a note should be added in the relevant docs.

We can confirm that what Theodoros is saying about this bug is true. Enabling the ability to add or modify patrons allowed our staff members to write-off fines.

I agree with Theodoros that these permissions should indeed be made wholly separate ideally, or documented if making them separate is a major project.

Which version of Koha do you use ?
Tested on current master with a borrower that have only permissions: 'catalogue', 'borrowers' and 'updatecharges' > 'remaining_permissions'.
I can't write off any fine, but I can collect fine.

Also, I think the requirement for borrowers permission is by design, because how can you access borrower's fines without it ?
By the way, 'borrowers' permission's description has been reworded to "Add, modify and view patron information".

(In reply to Julian Maurice from comment #3)
> Which version of Koha do you use ?

We use 3.20.

> Tested on current master with a borrower that have only permissions:
> 'catalogue', 'borrowers' and 'updatecharges' > 'remaining_permissions'.
> I can't write off any fine, but I can collect fine.
>
> Also, I think the requirement for borrowers permission is by design, because
> how can you access borrower's fines without it ?

I've tested an account with the same permissions on our server and it is the same- you can't waive fines but you can collect them. So, the initial problem reported is no longer the issue... but I would say there's still an issue here, which is that the relationship between the borrowers permission and the ability to collect charges isn't really documented anywhere or made obvious by making the fines subpermissions of the borrowers permission.

I'd also argue that the ability to edit patron records should probably be made a sub-permission of borrowers as well, so that view and edit are different, but likely a separate ticket.

I see that pages :
members/pay.pl
members/paycollect.pl
Need permissions from "updatecharges" but also full permissions from "borrowers" :
  flagsrequired   => { borrowers => 1, updatecharges => $updatecharges_permissions },

Created attachment 103205 [details] [review]
Bug 14713: Add hint that updatecharges permissions require ability to view patron details

A staff usre with only updatecharges permissions or sub permissions but without
the ability to view patron details (borrowers permissions and sub permissions)
will not be able to access the fines and charges functionalities.

This patch adds a textual hint about the dependency to the permissions screen.

To test:
- Verify behaviour: Add a staff user with
  - updatecharges permissions
  - no borrowers permissions
- Try to access a patron fines record in the GUI
- Try by direct URL: cgi-bin/koha/members/pay.pl?borrowernumber=17
- Add borrowers permissions - everything should be accessible now
- Apply patch
- View the permissions of a staff user
- Verify there is now a note stating this fact

Created attachment 103238 [details] [review]
Bug 14713: Add hint that updatecharges permissions require ability to view patron details

A staff user with only updatecharges permissions or sub permissions but without
the ability to view patron details (borrowers permissions and sub permissions)
will not be able to access the fines and charges features.

This patch adds a textual hint about the dependency to the permissions screen.

To test:
- Verify behaviour: Add a staff user with
  - updatecharges permissions
  - no borrowers permissions
- Try to access a patron fines record in the GUI
- Try by direct URL: cgi-bin/koha/members/pay.pl?borrowernumber=17
- Add borrowers permissions - everything should be accessible now
- Apply patch
- View the permissions of a staff user
- Verify there is now a note stating this fact

Signed-off-by: David Nind <david@davidnind.com>

Katrin, I think it's not correct for all the subperms.

I found, at least:

koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
 750                                     [% IF ( CAN_user_updatecharges_writeoff && overduecharges ) %]

to display "Forgive overdue charges"

(In reply to Jonathan Druart from comment #8)
> Katrin, I think it's not correct for all the subperms.
> 
> I found, at least:
> 
> koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
>  750                                     [% IF (
> CAN_user_updatecharges_writeoff && overduecharges ) %]
> 
> to display "Forgive overdue charges"

Hm, I think this is a somewhat special case that will also require a different permission (circulate). I could amend the note maybe:

From:
Requires permissions to view patron details.

To:

Requires permissions to view patron details or circulation.

How should we handle this? 

"Requires permission to view patron details in some cases"

?

I am not sure how to resolve this. I've tried to rephrase the note, but it gets complicated fast and doesn't look nice in the template with too much additional text. 

I think if we want to do this, we need to take a much closer look at permission dependencies in general and figure out a nice way to display these.