Description
Koha Team University Lyon 3
2015-12-03 10:02:52 UTC
Indeed, the file svc/checkouts contains : my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } ); Maybe it should depend on which page calls the code It's not obvious which permission should be required to see the checkout list. Katrin and Nicole, will you agree that a user with only the borrowers permission could access to this list? Hi, "borrowers" permission is required to deal with information related to patrons and it seems that it's the only one for this purpose. It's really difficult to imagine that staff who deal with borrowers in the library won't be able to know if patrons have loans, how many and what is the return date, even if they don't have the permission to do circulation action. Until the 3.16 version, it was the case : we can have the loans table in the details page of a patron for staff who have borrowers permission without circulate permission. Sonia I have just tested on a 3.14 and... it was quite buggy :) Without the circulate permission, indeed I can see the checkout list, but I also see the checkin checkboxes, the checkout tab, etc. And if I click on them, I am redirected to the login page :) The description of the borrower permission is "Add or modify patrons". That's why I would prefer to wait for an answer from Nicole and/or Katrin. Ah yes.. in 3.14, I found logical to be redirected to the login page when you check checkin or renew checkbox as you need to login with another user having the circulate permission to use it. Perhaps I just got used to this behaviour. I'm sure that we can have a better behaviour which also permit to see the loans only with borrowers permission in the current version :) I think this is kind of a tricky question, because there is something like a 'grey area' between circulate and borrowers permissions. If we assume: borrowers - add borrowers - modify borrowers - delete borrowers circulate - check-out - check-in - renew It's not really clear, what the correct permission for "seeing patron information" or "seeing checkouts and holds" really is. I guess ideally there would be an option to circulate books for a borrower, without seeing any patron information, just by scanning the cardnumber and checking out. - but currently that's not really possible. I think "borrowers" for seeing the holds and checkouts is a bit of a stretch, but it seems like it was like that before, so it would be ok. I think it would be a nice change to hide the checkboxes if you don't have "circulate" - would that be possible? Created attachment 45699 [details] [review] Bug 15289 - borrowers permission allows to see patron's loans Test plan: - log with a user that have "borrowers" permission but not "Remaining circulation permissions" - go to a borrower's detail page (who has at least a loan) and click on "show checkouts" - check that you see loan(s) and that you can't renew and checkin - Do the same with a borrower that have "Remaining circulation permissions" - check that you see loan(s) and that you can renew and checkin Created attachment 45720 [details] [review] Bug 15289 - borrowers permission allows to see patron's loans Test plan: - log with a user that have "borrowers" permission but not "Remaining circulation permissions" - go to a borrower's detail page (who has at least a loan) and click on "show checkouts" - check that you see loan(s) and that you can't renew and checkin - Do the same with a borrower that have "Remaining circulation permissions" - check that you see loan(s) and that you can renew and checkin Followed test plan. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Created attachment 45850 [details] [review] Bug 15289 - borrowers permission allows to see patron's loans Test plan: - log with a user that have "borrowers" permission but not "Remaining circulation permissions" - go to a borrower's detail page (who has at least a loan) and click on "show checkouts" - check that you see loan(s) and that you can't renew and checkin - Do the same with a borrower that have "Remaining circulation permissions" - check that you see loan(s) and that you can renew and checkin Followed test plan. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 45851 [details] [review] Bug 15289 [QA Followup] - Fix minor language issue Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 46058 [details] [review] Bug 15289 - borrowers permission allows to see patron's loans Test plan: - log with a user that have "borrowers" permission but not "Remaining circulation permissions" - go to a borrower's detail page (who has at least a loan) and click on "show checkouts" - check that you see loan(s) and that you can't renew and checkin - Do the same with a borrower that have "Remaining circulation permissions" - check that you see loan(s) and that you can renew and checkin Followed test plan. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com> Created attachment 46059 [details] [review] Bug 15289 [QA Followup] - Fix minor language issue Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com> Pushed to Master - Thanks! Patches pushed to 3.22.x, will be in 3.22.2 |