Summary: | Permission for holds history tab is too strict | ||
---|---|---|---|
Product: | Koha | Reporter: | Jessie Zairo <jzairo> |
Component: | Patrons | Assignee: | Katrin Fischer <katrin.fischer> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P5 - low | CC: | aspencatteam, gmcharlt, hayleypelham, josef.moravec, jzairo, kyle.m.hall, lucas, nick, wizzyrea |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
19.11.00, 19.05.06, 18.11.12
|
|
Circulation function: | |||
Attachments: |
Bug 21939: Fix permissions for holds history tab
Bug 21939: Fix permissions for holds history tab Bug 21939: Fix permissions for holds history tab Bug 21939: Fix permissions for holds history tab |
Description
Jessie Zairo
2018-12-03 21:56:19 UTC
Been getting a lot of feedback from our libraries that they would like to see this permission problem fixed so they can view holds history without the problems that are created by allowing all of our libraries to view and edit patrons from other libraries. - Bob Bennhoff Created attachment 94972 [details] [review] Bug 21939: Fix permissions for holds history tab The tab will show when the staff user has edit_borrowers permission, but the page itself will not be accessible. This patch fixes the page permissions to allow access with the edit_borrowers permission as suggested by the comments on the original bug report. To test: - Create a staff user with only "edit_borrowers" permission from the borrowers module - Try to access the holds history tab from any patron account - Verify you are blocked - Apply patch - Try again and verify the page is accessible now - Repeat with superlibrarian and full borrowers permission. I've tried fixing it as suggested, can you please test? Should work fine on sandboxes. Created attachment 94991 [details] [review] Bug 21939: Fix permissions for holds history tab The tab will show when the staff user has edit_borrowers permission, but the page itself will not be accessible. This patch fixes the page permissions to allow access with the edit_borrowers permission as suggested by the comments on the original bug report. To test: - Create a staff user with only "edit_borrowers" permission from the borrowers module - Try to access the holds history tab from any patron account - Verify you are blocked - Apply patch - Try again and verify the page is accessible now - Repeat with superlibrarian and full borrowers permission. Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> Created attachment 95128 [details] [review] Bug 21939: Fix permissions for holds history tab The tab will show when the staff user has edit_borrowers permission, but the page itself will not be accessible. This patch fixes the page permissions to allow access with the edit_borrowers permission as suggested by the comments on the original bug report. To test: - Create a staff user with only "edit_borrowers" permission from the borrowers module - Try to access the holds history tab from any patron account - Verify you are blocked - Apply patch - Try again and verify the page is accessible now - Repeat with superlibrarian and full borrowers permission. Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org> Created attachment 95147 [details] [review] Bug 21939: Fix permissions for holds history tab The tab will show when the staff user has edit_borrowers permission, but the page itself will not be accessible. This patch fixes the page permissions to allow access with the edit_borrowers permission as suggested by the comments on the original bug report. To test: - Create a staff user with only "edit_borrowers" permission from the borrowers module - Try to access the holds history tab from any patron account - Verify you are blocked - Apply patch - Try again and verify the page is accessible now - Repeat with superlibrarian and full borrowers permission. Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Nice work! Pushed to master for 19.11.00 Hi, May we have this for 19.05 as well? It applies cleanly and works nicely there. Cheers, Liz backported to 19.05.x for 19.05.06 Backported to 18.11.x for 18.11.12 |