Bug 22617

Summary: Checkout notes pending dashboard link - error received even though manage_checkout_notes permission set
Product: Koha Reporter: Lucy Vaux-Harvey <lucy.vaux-harvey>
Component: CirculationAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: david, fiona.borthwick, fridolin.somers, gmcharlt, kyle.m.hall, lucas, mtompset
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
This fixes an error that occurs when an account with full circulate permissions (but not super librarian permissions) clicks on 'Checkout notes pending' and is then automatically logged out with the message "Error: you do not have permission to view this page. Log in as a different user".
Version(s) released in:
19.11.00,19.05.02
Attachments: Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

Description Lucy Vaux-Harvey 2019-04-01 16:37:00 UTC
When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the ‘Checkout notes pending’ link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.
Comment 1 Fridolin Somers 2019-06-14 08:28:40 UTC
I'm on it.
Comment 2 Fridolin Somers 2019-06-14 08:48:53 UTC
Created attachment 90589 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access
Comment 3 Mark Tompsett 2019-06-18 00:56:35 UTC
It is quite annoying to not be able to get to circulation home. You need circulate_remaining_permissions to get to the circulation home. However, I was able to cut-and-paste the checkout notes URL and confirm this patch does get the person into the page. So for that specific problem it does work. As such, I'm going to sign off.
Comment 4 Mark Tompsett 2019-06-18 00:57:29 UTC
Created attachment 90711 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 5 Mark Tompsett 2019-06-18 00:58:45 UTC
Comment on attachment 90711 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

Review of attachment 90711 [details] [review]:
-----------------------------------------------------------------

::: circ/checkout-notes.pl
@@ +33,4 @@
>          query           => $query,
>          type            => "intranet",
>          authnotrequired => 0,
> +        flagsrequired   => { circulate => "manage_checkout_notes" },

Nice catch on this typo, as:
   $ git grep "circulation ="
gives nothing, but
   $ git grep "circulate ="
shows that this is what it should be.
Comment 6 Nick Clemens 2019-06-21 11:19:44 UTC
Created attachment 90895 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Martin Renvoize 2019-06-21 12:13:49 UTC
Nice work!

Pushed to master for 19.11.00
Comment 8 Fridolin Somers 2019-07-16 06:38:45 UTC
Pushed to 19.05.x for 19.05.02
Comment 9 Lucas Gass 2019-08-14 17:24:44 UTC
backported to 18.11.x for 18.11.09