Bug 34288

Summary: Cannot use cataloguing tools without cataloguing permissions
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: ToolsAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: CLOSED FIXED QA Contact: Martin Renvoize (ashimema) <martin.renvoize>
Severity: major    
Priority: P5 - low CC: aleisha, cbrannon, lucas, martin.renvoize, nick, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02,22.11.08
Circulation function:
Bug Depends on: 31162    
Bug Blocks: 34790    
Attachments: Bug 34288: Add CAN_user_tools to Cataloging home link
Bug 34288: Allow access to the cataloguing module with `tools` permission
Bug 34288: (follow-up) Tidy block
Bug 34288: Unit tests
Bug 34288: Allow access to the cataloguing module with `tools` permission
Bug 34288: (follow-up) Tidy block
Bug 34288: Unit tests
Bug 34288: Allow access to the cataloguing module with `tools` permission
Bug 34288: (follow-up) Tidy block
Bug 34288: Unit tests

Description Tomás Cohen Arazi (tcohen) 2023-07-14 20:11:19 UTC
As a side effect of moving the `cataloguing tools` to the cataloguing section, there's no way for a patron with all `tools permissions` to use the cataloguing tools.

To reproduce:
1. Have a patron with only 'catalogue' and 'tools' permissions.
2. Log into the staff interface
=> FAIL: You cannot access the Cataloguing section, thus have no access to the cataloguing tools
3. Point your browser to:
http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/tools/batchMod.pl
http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/labels/label-home.pl
=> SUCCESS: You actually have permissions to access the tool
Comment 1 Martin Renvoize (ashimema) 2023-07-17 08:52:29 UTC
Created attachment 153527 [details] [review]
Bug 34288: Add CAN_user_tools to Cataloging home link

This patch adds the CAN_user_tools permissions check to the options
checked when infering whether to display the Catagloging module link on
the staff interface main page.
Comment 2 Tomás Cohen Arazi (tcohen) 2023-07-17 13:26:25 UTC
Marking as assigned, there are some edge cases I've already been working on. Writing the unit tests now.
Comment 3 Tomás Cohen Arazi (tcohen) 2023-07-17 15:15:39 UTC
Created attachment 153560 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D
Comment 4 Tomás Cohen Arazi (tcohen) 2023-07-17 15:15:42 UTC
Created attachment 153561 [details] [review]
Bug 34288: (follow-up) Tidy block
Comment 5 Tomás Cohen Arazi (tcohen) 2023-07-17 15:15:45 UTC
Created attachment 153562 [details] [review]
Bug 34288: Unit tests
Comment 6 Kyle M Hall (khall) 2023-07-17 16:01:55 UTC
Created attachment 153565 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Kyle M Hall (khall) 2023-07-17 16:02:02 UTC
Created attachment 153566 [details] [review]
Bug 34288: (follow-up) Tidy block

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 8 Kyle M Hall (khall) 2023-07-17 16:02:05 UTC
Created attachment 153567 [details] [review]
Bug 34288: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Martin Renvoize (ashimema) 2023-07-17 17:53:15 UTC
Looking at the fastadd cataloging side of this is making me wonder if the page permissions are still wrong for that case.. we show the link from the home page with `( fast_cataloging && CAN_user_editcatalogue_fast_cataloging )` but then inside the page itself we're looking for 'editcatalogue'
Comment 10 Martin Renvoize (ashimema) 2023-07-17 17:56:55 UTC
Ah.. my mistake.. I think `editcatalogue => '*'` covers it as a subpermission 'any' case
Comment 11 Martin Renvoize (ashimema) 2023-07-17 18:18:56 UTC
Created attachment 153571 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 12 Martin Renvoize (ashimema) 2023-07-17 18:18:59 UTC
Created attachment 153572 [details] [review]
Bug 34288: (follow-up) Tidy block

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 13 Martin Renvoize (ashimema) 2023-07-17 18:19:02 UTC
Created attachment 153573 [details] [review]
Bug 34288: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 14 Martin Renvoize (ashimema) 2023-07-17 18:20:10 UTC
Thanks Tomas.. Passing QA
Comment 15 Tomás Cohen Arazi (tcohen) 2023-07-18 15:47:56 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 16 Christopher Brannon 2023-07-18 18:39:30 UTC
Please backport this to 22.11.  We can't live with this issue for a year.  :)
Comment 17 Tomás Cohen Arazi (tcohen) 2023-07-18 19:13:38 UTC
(In reply to Christopher Brannon from comment #16)
> Please backport this to 22.11.  We can't live with this issue for a year.  :)

:-P
Comment 18 Martin Renvoize (ashimema) 2023-07-19 07:32:59 UTC
Thanks for all the hard work!

Pushed to 23.05.x for the next release
Comment 19 Matt Blenkinsop 2023-07-19 10:15:38 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x
Comment 20 Christopher Brannon 2023-07-19 14:45:48 UTC
(In reply to Matt Blenkinsop from comment #19)
> Nice work everyone!
> 
> Pushed to oldstable for 22.11.x

Nice!
Comment 21 Christopher Brannon 2023-09-13 22:04:02 UTC
Hmmmm....I can still get to the spine label tools without having permission to them.  Is something still broken?  I'm on 22.11.8
Comment 22 Christopher Brannon 2023-09-13 22:04:42 UTC
(In reply to Christopher Brannon from comment #21)
> Hmmmm....I can still get to the spine label tools without having permission
> to them.  Is something still broken?  I'm on 22.11.8

FYI, if I just have a link to the spine label page, I get in and can use it.
Comment 23 Nick Clemens (kidclamp) 2023-09-14 12:21:53 UTC
(In reply to Christopher Brannon from comment #22)
> (In reply to Christopher Brannon from comment #21)
> > Hmmmm....I can still get to the spine label tools without having permission
> > to them.  Is something still broken?  I'm on 22.11.8
> 
> FYI, if I just have a link to the spine label page, I get in and can use it.

Filed bug 34288
Comment 24 Nick Clemens (kidclamp) 2023-09-14 12:22:18 UTC
(In reply to Nick Clemens from comment #23)
> (In reply to Christopher Brannon from comment #22)
> > (In reply to Christopher Brannon from comment #21)
> > > Hmmmm....I can still get to the spine label tools without having permission
> > > to them.  Is something still broken?  I'm on 22.11.8
> > 
> > FYI, if I just have a link to the spine label page, I get in and can use it.
> 
> Filed bug 34288

I mean bug 34790