Bug 21702

Summary: mancredit.pl incorrectly passes user_id instead of the patron id
Product: Koha Reporter: Tomás Cohen Arazi <tomascohen>
Component: Fines and feesAssignee: Tomás Cohen Arazi <tomascohen>
Status: CLOSED FIXED QA Contact: Josef Moravec <josef.moravec>
Severity: major    
Priority: P5 - low CC: fridolin.somers, jonathan.druart, josef.moravec, kyle.m.hall, martin.renvoize, nick
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 20980    
Bug Blocks:    
Attachments: Bug 21702: Make mancredit.pl use the patron id for the staff user
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour
Bug 21702: Make mancredit.pl use the patron id for the staff user
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour
Bug 21702: Make mancredit.pl use the patron id for the staff user
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour

Description Tomás Cohen Arazi 2018-10-27 12:09:57 UTC
I think unsafe SQL modes and the fact that manager_id has no FK allowed this to go unnoticed. But now we catch it!

To reproduce:
- On a patron, try adding a new manual credit of any type
=> FAIL: It fails telling the userid of the logged user is not a valid integer!
Comment 1 Tomás Cohen Arazi 2018-10-27 12:25:50 UTC
Created attachment 81360 [details] [review]
Bug 21702: Make mancredit.pl use the patron id for the staff user

I think unsafe SQL modes and the fact that manager_id has no FK allowed this to go unnoticed. But now we catch it!

To test:
- On a patron, try adding a new manual credit of any type
=> FAIL: It fails telling the userid of the logged user is not a valid integer!
- Apply this patch
- Try adding a manual credit of any type
=> SUCCESS: Manual credit added!
- Sign off!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 Tomás Cohen Arazi 2018-10-27 12:25:56 UTC
Created attachment 81361 [details] [review]
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour

This patch acknowledges the fact that some checks here are done in a way
that is not standard these days. This checks are originally done
multiple times in different ways. output_and_exit_if_error should be
used.

This implies a minor behaviour change: if the passed (in the URL)
borrowernumber doesn't exist, it sends the user to a 'Patron doesn't
exist page' instead of the circulation page for the borrowernumber.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 Andrew Isherwood 2018-10-29 09:33:10 UTC
Created attachment 81464 [details] [review]
Bug 21702: Make mancredit.pl use the patron id for the staff user

I think unsafe SQL modes and the fact that manager_id has no FK allowed this to go unnoticed. But now we catch it!

To test:
- On a patron, try adding a new manual credit of any type
=> FAIL: It fails telling the userid of the logged user is not a valid integer!
- Apply this patch
- Try adding a manual credit of any type
=> SUCCESS: Manual credit added!
- Sign off!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 4 Andrew Isherwood 2018-10-29 09:34:49 UTC
Created attachment 81465 [details] [review]
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour

This patch acknowledges the fact that some checks here are done in a way
that is not standard these days. This checks are originally done
multiple times in different ways. output_and_exit_if_error should be
used.

This implies a minor behaviour change: if the passed (in the URL)
borrowernumber doesn't exist, it sends the user to a 'Patron doesn't
exist page' instead of the circulation page for the borrowernumber.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 5 Josef Moravec 2018-10-29 22:00:12 UTC
Created attachment 81593 [details] [review]
Bug 21702: Make mancredit.pl use the patron id for the staff user

I think unsafe SQL modes and the fact that manager_id has no FK allowed this to go unnoticed. But now we catch it!

To test:
- On a patron, try adding a new manual credit of any type
=> FAIL: It fails telling the userid of the logged user is not a valid integer!
- Apply this patch
- Try adding a manual credit of any type
=> SUCCESS: Manual credit added!
- Sign off!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 6 Josef Moravec 2018-10-29 22:00:16 UTC
Created attachment 81594 [details] [review]
Bug 21702: (follow-up) Simplify checks and use standard fallback behaviour

This patch acknowledges the fact that some checks here are done in a way
that is not standard these days. This checks are originally done
multiple times in different ways. output_and_exit_if_error should be
used.

This implies a minor behaviour change: if the passed (in the URL)
borrowernumber doesn't exist, it sends the user to a 'Patron doesn't
exist page' instead of the circulation page for the borrowernumber.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 7 Nick Clemens 2018-10-31 15:05:43 UTC
Awesome work all!

Pushed to master for 18.11
Comment 8 Martin Renvoize 2018-11-08 16:14:17 UTC
I'm not entirely confident in backporting this.. if it's required for 18.05.x series could you submit an alternative patch for it?
Comment 9 Martin Renvoize 2018-11-09 14:50:21 UTC
Reworked version pushed to 18.05.x series for 18.05.06
Comment 10 Fridolin Somers 2018-11-26 06:56:40 UTC
Depends on bug 20980 not in 17.11.x