Bug 26628

Summary: Clubs permissions should grant access to Tools page
Product: Koha Reporter: Andrew Fuerste-Henry <andrewfh>
Component: ToolsAssignee: Katrin Fischer <katrin.fischer>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: arthur.suzuki, cbrannon, lisettepalouse+koha, lucas, martin.renvoize, wainuiwitikapark
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33595
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.03,22.05.10,21.11.16
Bug Depends on:    
Bug Blocks: 33595    
Attachments: Bug 26628: Fix access to clubs when user only has clubs permission
Bug 26628: Fix access to clubs when user only has clubs permission
Bug 26628: Fix access to clubs when user only has clubs permission

Description Andrew Fuerste-Henry 2020-10-07 14:46:39 UTC
To recreate:
- create a patron with only the catalogue, borrowers, and clubs permissions
- log in to the staff client as that patron
- navigate to a patron record, confirm you can see the Clubs tab in the patron account, can add patrons to and remove patrons from clubs
- confirm you don't have a link to the Tools module either on the Koha homepage or in the More menu
- enter the clubs url manually (/cgi-bin/koha/clubs/clubs.pl), confirm you are allowed to open the page

We should give a Tools link to anyone with clubs, edit_clubs, or edit_templates permissions.
Comment 1 Katrin Fischer 2023-01-26 21:51:36 UTC
Created attachment 145707 [details] [review]
Bug 26628: Fix access to clubs when user only has clubs permission

If a user only has the clubs and no permission from the tools section,
they can't access the patron clubs page by navigation. This patch
extends the permission checks for tools to include the clubs, that
live on the tools page, but have a top level permission.

To test:
- create a patron with only the catalogue and clubs permissions
- log in to the staff client as that patron
- navigate to a patron record, confirm you can see the Clubs tab in the patron account, can add patrons to and remove patrons from clubs
- confirm you don't have a link to the Tools module either on the Koha homepage or in the More menu
- enter the clubs URL manually (/cgi-bin/koha/clubs/clubs.pl), confirm you are allowed to open the page
- Apply patch
- The only changes should be:
  - You can now see the Tools entry in the More navigation menu
  - You can now see the Tools module link on the start page
  - Both take you to the tools page, only visible tools is 'Patron clubs'
Comment 2 Andrew Fuerste-Henry 2023-01-27 14:12:01 UTC
Created attachment 145747 [details] [review]
Bug 26628: Fix access to clubs when user only has clubs permission

If a user only has the clubs and no permission from the tools section,
they can't access the patron clubs page by navigation. This patch
extends the permission checks for tools to include the clubs, that
live on the tools page, but have a top level permission.

To test:
- create a patron with only the catalogue and clubs permissions
- log in to the staff client as that patron
- navigate to a patron record, confirm you can see the Clubs tab in the patron account, can add patrons to and remove patrons from clubs
- confirm you don't have a link to the Tools module either on the Koha homepage or in the More menu
- enter the clubs URL manually (/cgi-bin/koha/clubs/clubs.pl), confirm you are allowed to open the page
- Apply patch
- The only changes should be:
  - You can now see the Tools entry in the More navigation menu
  - You can now see the Tools module link on the start page
  - Both take you to the tools page, only visible tools is 'Patron clubs'

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Comment 3 Martin Renvoize 2023-01-31 12:45:23 UTC
Created attachment 145850 [details] [review]
Bug 26628: Fix access to clubs when user only has clubs permission

If a user only has the clubs and no permission from the tools section,
they can't access the patron clubs page by navigation. This patch
extends the permission checks for tools to include the clubs, that
live on the tools page, but have a top level permission.

To test:
- create a patron with only the catalogue and clubs permissions
- log in to the staff client as that patron
- navigate to a patron record, confirm you can see the Clubs tab in the patron account, can add patrons to and remove patrons from clubs
- confirm you don't have a link to the Tools module either on the Koha homepage or in the More menu
- enter the clubs URL manually (/cgi-bin/koha/clubs/clubs.pl), confirm you are allowed to open the page
- Apply patch
- The only changes should be:
  - You can now see the Tools entry in the More navigation menu
  - You can now see the Tools module link on the start page
  - Both take you to the tools page, only visible tools is 'Patron clubs'

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2023-01-31 12:45:50 UTC
Trivial fix, all working as expected.

Passing QA, thanks Katrin
Comment 5 Tomás Cohen Arazi 2023-01-31 13:52:08 UTC
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 6 Jacob O'Mara 2023-01-31 18:10:39 UTC
Nice work, thanks everyone!

Pushed to 22.11.x for the next release.
Comment 7 Lucas Gass 2023-02-03 22:12:54 UTC
Backported to 22.05.x for upcoming 22.05.10
Comment 8 Arthur Suzuki 2023-02-17 09:55:19 UTC
applied to 21.11.x for 21.11.16
Comment 9 wainuiwitikapark 2023-03-15 01:42:56 UTC
Not backported to 21.05.x