Bug 23101

Summary: Contracts permissions for staff patron
Product: Koha Reporter: Mohamad Barham <mbarham>
Component: AcquisitionsAssignee: Katrin Fischer <katrin.fischer>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: minor    
Priority: P5 - low CC: fridolin.somers, hc, katrin.fischer, lucas, m.de.rooy, martin.renvoize, mbarham
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.05
Attachments: vendor page
Bug 23101: Hide action buttons on contracts if user lacks permission
Bug 23101: Hide action buttons on contracts if user lacks permission
Bug 23101: Hide action buttons on contracts if user lacks permission
Bug 23101: Hide action buttons on contracts if user lacks permission
Bug 23101: (follow-up) use NoSort class in datatable

Description Mohamad Barham 2019-06-12 08:39:54 UTC
Created attachment 90527 [details]
vendor page

Dears,

Koha 19.00

I have created a staff Patron with no Contracts permissions only (
Manage basket and order lines,Receive orders and manage shipments )

In the vendor page, the patron can view contracts and actions button are available (delete, edit), if he click one of those actions, will redirected to the login page.

so, my recommendation, to remove those action bottoms at all if the user dont have the permission.

Regards
Comment 1 Katrin Fischer 2019-07-13 08:39:01 UTC
Created attachment 91510 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases
Comment 2 ByWater Sandboxes 2019-09-12 14:32:36 UTC
Created attachment 92729 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Comment 3 Bouzid Fergani 2019-09-20 20:36:02 UTC
Created attachment 93053 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Comment 4 Marcel de Rooy 2019-09-27 08:10:49 UTC
Created attachment 93185 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Martin Renvoize 2019-09-27 12:59:31 UTC
Nice work!

Pushed to master for 19.11.00
Comment 6 Fridolin Somers 2019-10-08 07:13:55 UTC
I'm sure about :

+                    [% IF CAN_user_acquisition_contracts_manage %]
                     { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
+                    [% ELSE %]
+                    { "bSortable": false, "bSearchable": false },
+                    [% END %]
                     { "sType": "title-string", "aTargets" : [ "title-string" ] }

Shouldn't we remove the all line instead of only "aTargets" ?
Comment 7 Fridolin Somers 2019-10-08 11:54:30 UTC
Confirmed on irc, we need to use a class for no-sorting.
I'm on a patch
Comment 8 Fridolin Somers 2019-10-08 12:07:14 UTC
Created attachment 93864 [details] [review]
Bug 23101: (follow-up) use NoSort class in datatable
Comment 9 Martin Renvoize 2019-10-08 13:16:51 UTC
Nice work!

Pushed to master for 19.11.00
Comment 10 Martin Renvoize 2019-10-08 13:17:28 UTC
Followup pushed, thanks Fridolin
Comment 11 Katrin Fischer 2019-10-08 15:47:44 UTC
Thx a lot, Frido!
Comment 12 Fridolin Somers 2019-10-09 08:03:01 UTC
Pushed to 19.05.x for 19.05.05
Comment 13 Lucas Gass 2019-11-13 23:04:14 UTC
backported to 18.11.x for 18.11.11