Bug 28465

Summary: Don't allow staff user to change patron categories of other staff users and their own account
Product: Koha Reporter: Christofer Zorn <christofer.zorn>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, george, gmcharlt, kyle.m.hall, rpalermo
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Christofer Zorn 2021-05-26 15:26:01 UTC
Hello All!
 
One of our staff members had a mental lapse and deleted her own STAFF account the other day. Apparently Koha tried to stop her by preventing the deletion of either the account she was logged into, or by preventing her from deleting an account with a STAFF designation, but she was determined. She changed the account type from STAFF to COMPUSE, then the system didn’t stop her from deleting it.
 
I'm proposing that if a staff member is not able to change another staff member's username, then they shouldn't be able to change the patron type of that account either. This would prevent a staff member from unintentionally (or otherwise) deleting a number of staff accounts.

Thank you!

Christofer
Comment 1 Katrin Fischer 2021-05-29 15:04:58 UTC
Hi Christofer, I updated the description a bit - please check if I got it right!

The permission preventing the user name change is staffaccess. I think it would be consequential to extend it to patron categories as this is the way currently to get around the intention of the perm in the first place.
Comment 2 Christofer Zorn 2021-06-01 17:36:26 UTC
Thank you Katrin ... that looks great to me.
Comment 3 George Williams (NEKLS) 2022-11-07 15:00:28 UTC
I would also find this feature helpful.
Comment 4 rpalermo 2025-06-02 20:48:08 UTC
This could help us prevent a situation where staff can edit user accounts for other staff.