| Summary: | Insufficient access control for printer profiles | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
| Component: | System Administration | Assignee: | Martin Renvoize (ashimema) <martin.renvoize> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | minor | ||
| Priority: | P5 - low | CC: | 1joynelson, andrew, fridolin.somers, gmcharlt, jonathan.druart, lucas, martin.renvoize, nick |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: |
This change moves the label creator pages, including the printer profiles management, under the 'lable_creator' permission under tools. This gives a more refined access permission for this area of functionality.
|
Version(s) released in: |
21.05.00,20.11.04
|
| Circulation function: | |||
| Attachments: |
Bug 27716: Update permissions for patroncards creator
Bug 27716: Update permissions for patroncards creator Bug 27716: Update permissions for patroncards creator Bug 27716: Update permissions for patroncards creator |
||
|
Description
Martin Renvoize (ashimema)
2021-02-17 11:31:15 UTC
% git grep flagsrequired patroncards [11:20:56]
patroncards/add_user_search.pl: flagsrequired => { catalogue => 1 },
patroncards/create-pdf.pl: flagsrequired => { tools => 'label_creator' },
patroncards/edit-batch.pl: flagsrequired => { catalogue => 1 },
patroncards/edit-layout.pl: flagsrequired => { catalogue => 1 },
patroncards/edit-profile.pl: flagsrequired => { catalogue => 1 },
patroncards/edit-template.pl: flagsrequired => { catalogue => 1 },
patroncards/home.pl: flagsrequired => { catalogue => 1 },
patroncards/image-manage.pl: flagsrequired => {tools => 'batch_upload_patron_images'}, # FIXME: establish flag for patron card creator
patroncards/manage.pl: flagsrequired => { catalogue => 1 },
patroncards/print.pl: flagsrequired => { catalogue => 1 },
Should they all use tools => batch_upload_patron_images?
Hm, I believe label_creator would probably make more sense here. And the manage image is, I think, not only about patron images, but could be general ones too. Yes, I think I agree Katrin.. sorry for the slow reply.. was still wrapping my brain around what permission was most suitable. Created attachment 117059 [details] [review] Bug 27716: Update permissions for patroncards creator The various subpages of the label creator tool we're under the 'catalogue' permission. There is however a 'label_creator' subpermission of tools which is more appropriate. Test plan 1/ Setup a user with just the 'catelogue' permission (to enable logging into the staff interface) 2/ With the patch applied you should not be able to access the following pages (either via navigation in the UI or by typing them into the browser address bar directly) - /patroncards/add_user_search.pl - /patroncards/edit-batch.pl - /patroncards/edit-layout.pl - /patroncards/edit-profile.pl - /patroncards/edit-template.pl - /patroncards/home.pl - /patroncards/image-manage.pl - /patroncards/manage.pl - /patroncards/print.pl 3/ Signoff Created attachment 117197 [details] [review] Bug 27716: Update permissions for patroncards creator The various subpages of the label creator tool we're under the 'catalogue' permission. There is however a 'label_creator' subpermission of tools which is more appropriate. Test plan 1/ Setup a user with just the 'catelogue' permission (to enable logging into the staff interface) 2/ With the patch applied you should not be able to access the following pages (either via navigation in the UI or by typing them into the browser address bar directly) - /patroncards/add_user_search.pl - /patroncards/edit-batch.pl - /patroncards/edit-layout.pl - /patroncards/edit-profile.pl - /patroncards/edit-template.pl - /patroncards/home.pl - /patroncards/image-manage.pl - /patroncards/manage.pl - /patroncards/print.pl 3/ Signoff Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 117742 [details] [review] Bug 27716: Update permissions for patroncards creator The various subpages of the label creator tool we're under the 'catalogue' permission. There is however a 'label_creator' subpermission of tools which is more appropriate. Test plan 1/ Setup a user with just the 'catelogue' permission (to enable logging into the staff interface) 2/ With the patch applied you should not be able to access the following pages (either via navigation in the UI or by typing them into the browser address bar directly) - /patroncards/add_user_search.pl - /patroncards/edit-batch.pl - /patroncards/edit-layout.pl - /patroncards/edit-profile.pl - /patroncards/edit-template.pl - /patroncards/home.pl - /patroncards/image-manage.pl - /patroncards/manage.pl - /patroncards/print.pl 3/ Signoff Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 117743 [details] [review] Bug 27716: Update permissions for patroncards creator The various subpages of the label creator tool we're under the 'catalogue' permission. There is however a 'label_creator' subpermission of tools which is more appropriate. Test plan 1/ Setup a user with just the 'catelogue' permission (to enable logging into the staff interface) 2/ With the patch applied you should not be able to access the following pages (either via navigation in the UI or by typing them into the browser address bar directly) - /patroncards/add_user_search.pl - /patroncards/edit-batch.pl - /patroncards/edit-layout.pl - /patroncards/edit-profile.pl - /patroncards/edit-template.pl - /patroncards/home.pl - /patroncards/image-manage.pl - /patroncards/manage.pl - /patroncards/print.pl 3/ Signoff Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 21.05, thanks to everybody involved! I'm not anxious to change permissions outside of a full version upgrade. Not backporting to 20.05, but feel free to ask if needed. Was this still getting considered for 20.11? Pushed to 20.11.x for 20.11.04 20.11 is still young so I think permission change is not a problem. I understand it is different of older versions. |