Bug 27811

Summary: Manage patrons fines and fees (updatecharges) subpermissions shows links/buttons that cannot be accessed
Product: Koha Reporter: Nick Clemens <nick>
Component: Fines and feesAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: andrewfh, fridolin.somers, victor
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.06,20.05.12
Attachments: Bug 27811: Hide payment buttons if not enough permission
Bug 27811: Hide the Accounting tab if needed
Bug 27811: Hide payment buttons if not enough permission
Bug 27811: Hide the Accounting tab if needed

Description Nick Clemens 2021-02-26 17:16:47 UTC
pay.pl requires 'remaining_permissions' but links to pay.pl show in a patrons account if you have any of the other subpermissions.
 
To recreate:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
5 - You see the accounting tab and option to pay fines
6 - Clicking on those lead to a log in screen
Comment 1 Jonathan Druart 2021-04-22 12:25:48 UTC
Created attachment 120002 [details] [review]
Bug 27811: Hide payment buttons if not enough permission

If the logged in librarian does not have the updatecharges >
remaining_permissions subpermission, we should hide the 2 "Make payment"
and "Pay all fines" button from the patron detail/circ page.

Test plan:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
=> The two buttons are not displayed
Comment 2 Jonathan Druart 2021-04-22 12:25:53 UTC
Created attachment 120003 [details] [review]
Bug 27811: Hide the Accounting tab if needed

Same as the previous patch for the "Accounting" tab of the circulation
module.
Comment 3 Nick Clemens 2021-04-29 10:27:28 UTC
Created attachment 120303 [details] [review]
Bug 27811: Hide payment buttons if not enough permission

If the logged in librarian does not have the updatecharges >
remaining_permissions subpermission, we should hide the 2 "Make payment"
and "Pay all fines" button from the patron detail/circ page.

Test plan:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
=> The two buttons are not displayed

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Nick Clemens 2021-04-29 10:27:32 UTC
Created attachment 120304 [details] [review]
Bug 27811: Hide the Accounting tab if needed

Same as the previous patch for the "Accounting" tab of the circulation
module.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Nick Clemens 2021-04-29 10:27:54 UTC
Trivial fix, passing QA
Comment 6 Jonathan Druart 2021-04-30 15:17:41 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Fridolin Somers 2021-05-05 13:54:44 UTC
Pushed to 20.11.x for 20.11.06
Comment 8 Andrew Fuerste-Henry 2021-05-25 11:08:49 UTC
Pushed to 20.05.x for 20.05.12
Comment 9 Victor Grousset/tuxayo 2021-05-25 13:56:55 UTC
Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed.