Bug 20515

Summary: "ILL Request" menu options displayed when user has no ILL permissions
Product: Koha Reporter: Andrew Isherwood <bugzilla>
Component: ILLAssignee: Andrew Isherwood <bugzilla>
Status: CLOSED FIXED QA Contact: Katrin Fischer <katrin.fischer>
Severity: trivial    
Priority: P5 - low CC: joe.mcglynn, jonathan.druart, katrin.fischer, martin.renvoize
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 7317    
Bug Blocks:    
Attachments: Bug 20515 - "ILL Request" menu options displayed when user has no ILL
Bug 20515 - "ILL Request" menu options displayed when user has no ILL
Bug [20515] - [Follow up]
Bug 20515 - "ILL Request" menu options displayed when user has no ILL
Bug [20515] - [Follow up]
Bug 20515: Fix permission check on "ILL request" menu options
Bug 20515: (QA follow-up) Remove specific superlibrarian check
Bug 20515: (follow-up) Add missing CAN_user_ill
Bug 20515: (follow-up) Add missing CAN_user_ill
Bug 20515: (QA follow-up) Fix capitalization on 'Ill Requests'

Description Andrew Isherwood 2018-04-04 11:02:31 UTC
When the Interlibrary Loans module is enabled the menu option "ILL Requests" is added to the main intranet screen and the "More" dropdown menu. These options are displayed regardless of whether the logged in user has any permissions on this module. They should only be displayed if the user has permissions to work with ILL.
Comment 1 Andrew Isherwood 2018-04-04 11:40:34 UTC
Created attachment 73615 [details] [review]
Bug 20515 - "ILL Request" menu options displayed when user has no ILL

This patch adds the following additional conditions to the display of
both the ILL Requests drop down "More" menu option and the "ILL Requests"
option on the intranet front page:

Before:

[% IF Koha.Preference('ILLModule') %]

After:

[% IF Koha.Preference('ILLModule') && (CAN_user_ill || CAN_user_superlibrarian) %]

This prevents the options being displayed to users who have no
permissions to work with ILL.

Test plan:

View both the intranet front page and "More" dropdown while logged in as
a user without ILL permissions, ensure the options do not display. Then
do the same with a user with ILL permissions, ensure the options do
display.
Comment 2 Mark Tompsett 2018-04-04 14:53:36 UTC
Created attachment 73643 [details] [review]
Bug 20515 - "ILL Request" menu options displayed when user has no ILL

This patch adds the following additional conditions to the display of
both the ILL Requests drop down "More" menu option and the "ILL Requests"
option on the intranet front page:

Before:

[% IF Koha.Preference('ILLModule') %]

After:

[% IF Koha.Preference('ILLModule') && (CAN_user_ill || CAN_user_superlibrarian) %]

This prevents the options being displayed to users who have no
permissions to work with ILL.

Test plan:

View both the intranet front page and "More" dropdown while logged in as
a user without ILL permissions, ensure the options do not display. Then
do the same with a user with ILL permissions, ensure the options do
display.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 3 Katrin Fischer 2018-04-05 05:36:20 UTC
Hi Andrew, all good, but you don't need the superlibrarian bit - can you please remove those in a little follow up and set back to signed off? Thx!
Comment 4 Andrew Isherwood 2018-04-09 14:47:14 UTC
Created attachment 73875 [details] [review]
Bug [20515] - [Follow up]

Removed the test for CAN_user_superlibrarian as requested
Comment 5 Katrin Fischer 2018-04-12 10:02:32 UTC
Hi Andrew, please remember to set the Assignee field!
Comment 6 Katrin Fischer 2018-04-12 10:04:36 UTC
Created attachment 74065 [details] [review]
Bug 20515 - "ILL Request" menu options displayed when user has no ILL

This patch adds the following additional conditions to the display of
both the ILL Requests drop down "More" menu option and the "ILL Requests"
option on the intranet front page:

Before:

[% IF Koha.Preference('ILLModule') %]

After:

[% IF Koha.Preference('ILLModule') && (CAN_user_ill || CAN_user_superlibrarian) %]

This prevents the options being displayed to users who have no
permissions to work with ILL.

Test plan:

View both the intranet front page and "More" dropdown while logged in as
a user without ILL permissions, ensure the options do not display. Then
do the same with a user with ILL permissions, ensure the options do
display.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Katrin Fischer 2018-04-12 10:04:39 UTC
Created attachment 74066 [details] [review]
Bug [20515] - [Follow up]

Removed the test for CAN_user_superlibrarian as requested

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2018-04-12 10:06:47 UTC
Created attachment 74067 [details] [review]
Bug 20515: Fix permission check on "ILL request" menu options

This patch adds the following additional conditions to the display of
both the ILL Requests drop down "More" menu option and the "ILL Requests"
option on the intranet front page:

Before:

[% IF Koha.Preference('ILLModule') %]

After:

[% IF Koha.Preference('ILLModule') && (CAN_user_ill || CAN_user_superlibrarian) %]

This prevents the options being displayed to users who have no
permissions to work with ILL.

Test plan:

View both the intranet front page and "More" dropdown while logged in as
a user without ILL permissions, ensure the options do not display. Then
do the same with a user with ILL permissions, ensure the options do
display.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Katrin Fischer 2018-04-12 10:06:50 UTC
Created attachment 74068 [details] [review]
Bug 20515: (QA follow-up) Remove specific superlibrarian check

Removed the test for CAN_user_superlibrarian as requested

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Katrin Fischer 2018-04-12 10:08:30 UTC
I've also fixed the commit messages (free this time ;) ), but please take a look at https://wiki.koha-community.org/wiki/Commit_messages for your next patches!
Comment 11 Jonathan Druart 2018-04-12 13:43:35 UTC
What about this one too?

121     [% IF Koha.Preference('ILLModule') %]
122         <li><a href="/cgi-bin/koha/ill/ill-requests.pl?borrowernumber=[% patron.borrowernumber %]">Interlibrary loans</a></li>
123     [% END %]

koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
Comment 12 Andrew Isherwood 2018-04-13 10:45:46 UTC
Created attachment 74154 [details] [review]
Bug 20515: (follow-up) Add missing CAN_user_ill

This follow up patch adds two missing CAN_user_ill tests in templates
Comment 13 Katrin Fischer 2018-04-15 22:47:09 UTC
Created attachment 74194 [details] [review]
Bug 20515: (follow-up) Add missing CAN_user_ill

This follow up patch adds two missing CAN_user_ill tests in templates

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 14 Katrin Fischer 2018-04-15 22:47:13 UTC
Created attachment 74195 [details] [review]
Bug 20515: (QA follow-up) Fix capitalization on 'Ill Requests'
Comment 15 Katrin Fischer 2018-04-15 22:47:44 UTC
Took the chance to fix a tiny capitalization error pointed out by the patch.
Comment 16 Jonathan Druart 2018-04-16 17:12:32 UTC
Patches pushed to master for 18.05

Congratulations Andrew for your first patches in!
Comment 17 Katrin Fischer 2018-04-24 11:36:52 UTC
I think we miss a change in Auth.pm:

 297         if ( $flags && $flags->{superlibrarian} == 1 ) {
 298             $template->param( CAN_user_circulate        => 1 );

And that should probably use IsSuperLibrarian()for the check (see bug 20649)
Comment 18 Martin Renvoize 2018-10-11 15:41:39 UTC
*** Bug 20646 has been marked as a duplicate of this bug. ***