Bug 26721

Summary: Debit and credit type pages should check for the specific permission
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: Architecture, internals, and plumbingAssignee: Katrin Fischer <katrin.fischer>
Status: Pushed to master --- QA Contact: Martin Renvoize <martin.renvoize>
Severity: normal    
Priority: P5 - low CC: lucas, martin.renvoize
Version: masterKeywords: Academy
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25768
Change sponsored?: --- Patch complexity: Trivial patch
Text to go in the release notes:
Version(s) released in:
20.11.00
Attachments: Bug 26721: Fix permission check on debit and credit type admin pages
Bug 26721: Fix permission check on debit and credit type admin pages
Bug 26721: Fix permission check on debit and credit type admin pages

Description Katrin Fischer 2020-10-18 15:11:07 UTC
At the moment, the pages check for:

admin/credit_types.pl:        flagsrequired   => { parameters => 'parameters_remaining_permissions' },
admin/debit_types.pl:        flagsrequired   => { parameters => 'parameters_remaining_permissions' },

But the templates like admin home page check for the correct specific permission:

[% IF ( CAN_user_parameters_manage_accounts ) %]
Comment 1 Katrin Fischer 2020-10-18 15:17:20 UTC
Created attachment 111947 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible
Comment 2 Chris Cormack 2020-10-25 20:41:18 UTC
Created attachment 112481 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Martin Renvoize 2020-11-02 11:21:20 UTC
Created attachment 112825 [details] [review]
Bug 26721: Fix permission check on debit and credit type admin pages

At the moment the pages falsely check for parameters_remaining_permissions,
but they should check the specific manage_accounts permission.

To test:
- Create a new staff user with only catalog and manage_acccounts
  permissions
- Log in with this staff user and go to the admin page
- You will see the debit and credit type sections, but won't be
  able to access them
- Apply the patch
- Veriy the links still show, but pages are now accessible

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2020-11-02 11:22:05 UTC
Dang.. how did I get these mismatched!

Works as expected, thanks for the fix Katrin.

Passing QA
Comment 5 Jonathan Druart 2020-11-03 09:59:07 UTC
Pushed to master for 20.11, thanks to everybody involved!
Comment 6 Lucas Gass 2020-11-16 20:37:22 UTC
does not apply cleanly to 20.05.x, no backport