Bug 34971

Summary: Permission to close a serial subscription
Product: Koha Reporter: pierre.genty
Component: SerialsAssignee: Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: baptiste.wojtkowski, david, fridolin.somers
Version: 22.11   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29608
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37247
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 34971: Permission to close a serial subscription (edit)

Description pierre.genty 2023-10-02 12:12:05 UTC
Hi, 
With only receive_serials permission it is possible to close a serial subscription. This should require edit_subscription permission.
Comment 1 Baptiste Wojtkowski (bwoj) 2024-07-03 13:39:07 UTC
It looks like it has been corrected on main but I cannot figure out why
Comment 2 Baptiste Wojtkowski (bwoj) 2024-07-03 15:29:09 UTC
Created attachment 168461 [details] [review]
Bug 34971: Permission to close a serial subscription (edit)

TEST PLAN (for 22.11):
Before applying patch :
1 - log in as a user with only receive_serial right
2 - Select a serial
3 - Try to close it -> you can
4 - try to reopen the closed serial -> you can
5 - Make sure you have one opened and one closed serial

Apply patch
6 - Try to close a serial -> you cannot
7 - Try to reopen a closed serial -> you cannot
As a user that has the right delete_subscription:
8 - Try to delete the subscription -> you can (non regression test)

Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights.

Note : this should also be tested for superior version
Comment 3 David Nind 2024-07-04 01:03:27 UTC
Added assignee.