Bug 28991

Summary:	Setting user permissions should be limited by current user permissions
Product:	Koha	Reporter:	Marcel de Rooy <m.de.rooy>
Component:	Staff interface	Assignee:	Bugs List <koha-bugs>
Status:	NEW ---	QA Contact:	Testopia <testopia>
Severity:	enhancement
Priority:	P5 - low	CC:	andrew, bwsdonna, gmcharlt
Version:	Main
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28882 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29000
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description Marcel de Rooy 2021-09-10 06:43:05 UTC

See bug 28882.

The gap in the changing permissions form is that we allow a staff user to set and clear permissions that he does not have himself. Which is a bit awkward, especially for Admininstration. I think that we should give that a bit more thought.

What do you think?

Comment 1 Donna 2021-09-10 12:26:21 UTC

I agree!  You either have to let a user change pretty much everything, or nothing.  It would be nice to have a middle ground.  

The two sys prefs that are involved with this are also fairly confusing - 
Allow staff members to modify permissions for other staff members (staffaccess)
and 
Set user permissions (permissions)

Perhaps as a supervisor I need to be able to reset the password for my staff, but I don't need to be able to change permissions.  

It would be helpful to have this permissions reworked to allow more flexibility and control.