Bug 19323

Summary: Subscription edit permission issue
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: SerialsAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Kyle M Hall <kyle>
Severity: major    
Priority: P5 - low CC: caroline.cyr-la-rose, colin.campbell, katrin.fischer, kyle, mtj
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 19323: subscription edit permission issue
Bug 19323: subscription edit permission issue
Bug 19323: subscription edit permission issue

Description Fridolin Somers 2017-09-15 09:10:08 UTC
If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.
Comment 1 Fridolin Somers 2017-09-15 09:28:14 UTC
Created attachment 67141 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page
Comment 2 Caroline Cyr La Rose 2017-09-15 19:10:44 UTC
Created attachment 67153 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 3 Caroline Cyr La Rose 2017-09-15 19:11:43 UTC
Worked!
Comment 4 Kyle M Hall 2017-09-29 12:00:04 UTC
Created attachment 67440 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Jonathan Druart 2017-09-29 15:48:29 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin Somers 2017-10-17 07:59:01 UTC
Pushed to 17.05.x, will be in 17.05.05.
Comment 7 Katrin Fischer 2017-10-18 21:20:48 UTC
This patch has been pushed to 16.11.x and will be in 16.11.13.
Comment 8 Mason James 2017-11-23 23:16:58 UTC
Pushed to 16.05.x, for 16.05.18 release