Bug 28957

Summary: Many plugins require the full plugins permission set to run
Product: Koha Reporter: Martin Renvoize (ashimema) <martin.renvoize>
Component: Plugin architectureAssignee: Martin Renvoize (ashimema) <martin.renvoize>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: 1joynelson, alban.peyrat_koha, fridolin.somers, jonathan.druart, kyle, lucas, m.de.rooy, martin.renvoize, nick
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36205
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Martin Renvoize (ashimema) 2021-09-07 08:53:34 UTC
Some plugins with hooks into the UI outside of the tools and plugin management page require the overall 'plugins' permission to run.

This however has the side effect of allowing users with those permissions to also manage plugins which may not be the effect wanted.

Example: A site has both an Online Payments plugin and the CLA Permissions Check plugin installed.  To use the button from the catalogueing toolbar for the CLA plugin you are required to have the overall plugins permission. This then exposes the login credentials for the Online payments plugin as the user gets access to the tools pages.
Comment 1 Katrin Fischer 2023-07-01 13:37:15 UTC
Do we need to fix the permissions in Koha or in the plugins?
Comment 2 Martin Renvoize (ashimema) 2023-07-03 11:53:57 UTC
In the case of the CLA plugin, we add a button that triggers a call to `plugins/run.pl?class=[% CLASS %]&method=...`

Anything that follows that pattern to trigger a plugin method to run, will require some more involved permissions.

In the CLA case, I think I'd like to generally modernise the approach so we don't need to call the run method.. so I'm not sure what wider effects this may have on other plugins.
Comment 3 Fridolin Somers 2023-12-19 11:23:48 UTC
I run into the same problem.

Indeed the permissions are on the plugin method :
https://git.koha-community.org/Koha-community/Koha/src/commit/ac02c1d2adc883cc6ff6b749c271cb165d337436/plugins/run.pl#L40

But currently only exists tool and report
and plugins create there own methods.

Should we change for only one subpermission "run plugin" ?
And plugins have to implement permissions.

Best regards,