Bug 17423

Summary: patronimage.pl permission is too restrictive
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: brendan, frederic, gmcharlt, julian.maurice, kyle.m.hall, sandboxes, sophie.meynieux
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14566    
Bug Blocks: 29541    
Attachments: Bug 17423 - patronimage.pl permission is too restrictive
Bug 17423 - patronimage.pl permission is too restrictive
Bug 17423 - patronimage.pl permission is too restrictive
Bug 17423 - patronimage.pl permission is too restrictive
Bug 17423 - patronimage.pl permission is too restrictive

Description Fridolin Somers 2016-10-11 07:59:05 UTC
Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.
Comment 1 Fridolin Somers 2016-10-11 08:07:52 UTC
Created attachment 56134 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get 403 error
=> With patch you get the image
Comment 2 Fridolin Somers 2016-10-11 08:09:40 UTC
*** Bug 17325 has been marked as a duplicate of this bug. ***
Comment 3 Fridolin Somers 2016-10-11 08:35:52 UTC
Created attachment 56136 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get 403 error
=> With patch you get the image
- Log out and test the page patronimage.pl
=> You get 403 error
Comment 4 Fridolin Somers 2016-10-11 09:34:03 UTC
Created attachment 56150 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error
Comment 5 sandboxes@biblibre.com 2016-10-11 10:03:10 UTC
Patch tested with a sandbox, by remy <remy.gonzalves@iepg.fr>
Comment 6 sandboxes@biblibre.com 2016-10-11 10:31:58 UTC
Created attachment 56166 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error

Signed-off-by: remy <remy.gonzalves@iepg.fr>
Comment 7 Jonathan Druart 2016-10-12 14:18:15 UTC
Created attachment 56289 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error

Signed-off-by: remy <remy.gonzalves@iepg.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 8 Brendan Gallagher 2016-10-17 23:46:32 UTC
Pushed to Master - Should be in the November 16.11 Release.  Thanks!
Comment 9 Frédéric Demians 2016-10-22 12:51:54 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 10 Julian Maurice 2016-10-24 10:34:09 UTC
Pushed in 3.22.x, will be in 3.22.12