Summary: | Permission to close a serial subscription | ||
---|---|---|---|
Product: | Koha | Reporter: | pierre.genty |
Component: | Serials | Assignee: | Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski> |
Status: | Signed Off --- | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | baptiste.wojtkowski, david, fridolin.somers |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29608 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37247 |
||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
This fixes the serials receiving (receive_serials) permission - staff that only have this permission can now only receive serials, and can no longer (incorrectly) close a subscription. Previously, the "Close" action was incorrectly shown on the subscription details page and this allowed staff to close (but not reopen) a subscription (Serials > Search > [select a serial from the results] > Subscriptions detail page for a serial).
|
Version(s) released in: | |
Circulation function: | |||
Attachments: |
Bug 34971: Permission to close a serial subscription (edit)
Screenshots - Close serials permissions Bug 34971: Fix reopen button display on serial-collection Bug 34971: Fix permission to close a serial subscription (edit) Bug 34971: Fix reopen button display on serial-collection Bug 34971: Fix permission to close a serial subscription (edit) |
Description
pierre.genty
2023-10-02 12:12:05 UTC
It looks like it has been corrected on main but I cannot figure out why Created attachment 168461 [details] [review] Bug 34971: Permission to close a serial subscription (edit) TEST PLAN (for 22.11): Before applying patch : 1 - log in as a user with only receive_serial right 2 - Select a serial 3 - Try to close it -> you can 4 - try to reopen the closed serial -> you can 5 - Make sure you have one opened and one closed serial Apply patch 6 - Try to close a serial -> you cannot 7 - Try to reopen a closed serial -> you cannot As a user that has the right delete_subscription: 8 - Try to delete the subscription -> you can (non regression test) Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights. Note : this should also be tested for superior version Added assignee. Created attachment 175972 [details]
Screenshots - Close serials permissions
I had a go at testing (using koha-testing-docker) on 22.11.22 and on main.
What I found:
1. On 22.11.22:
- there is a "Close" button only on the serial collection page
- you can close a serial
- I couldn't get the patch to apply on 22.11.22 (I got a weird error
I've never seen before), so I couldn't test the patch
2. On main:
- same as 22.11.22, there is "Close" button only on the serial
collection page
- you can close a serial
- after the patch (which applies on main), the "Close" button is still there
on the serial collection page
- if you click "Close" you get the login screen with "Error: You do not have
permission to access this page.”
I've attached a document with screenshots, hopefully that will make it easier to see what I saw.
I've changed to Failed QA, as:
- It isn't fixed on main.
- I think the "Close" button shouldn't be there on the serial collection page if you don't have the correct permissions.
- As an aside, I don't think the "Manage frequencies" and "Manage numbering patterns" menu items should be shown if the staff patron doesn't have the correct permissions (this should probably be another bug).
Created attachment 175997 [details] [review] Bug 34971: Fix reopen button display on serial-collection Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Created attachment 175998 [details] [review] Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Note: No patch for 22.11 anymore since I could reproduce and test on main Created attachment 176040 [details] [review] Bug 34971: Fix reopen button display on serial-collection Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> Created attachment 176041 [details] [review] Bug 34971: Fix permission to close a serial subscription (edit) Note: there is a minor bug I had to correct, I don't split into two patches since it is very minor and necessary to test that one. Patch 1 - (this one) When a user is on serial collection information, the subscription is not passed to the template, and therefore not passed to serials-toolbar.inc. This makes sense if collection information is called with a biblionumber but not if collection information is called with a subscription id. Consequently, subscription.closed is always false and it is not possible to reopen a basket. Patch 2 - User with incorrect permission can close serials, they just need to access to the page. This is due to serials-toolbar.inc expecting a variable named "cannotedit", which is provided by "subscription-details.pl" and not by "serials-collection.pl" TEST PLAN: Before applying patches : 1 - log in as a user with only receive_serial permission 2 - Open two pages one on /serials-collection.pl?subscriptionid=ID_A, another on /serials-collection.pl?subscriptionid=ID_B 3 - On serial A's collection page, check you can close the serial (wrong behaviour), note you can close it again but not reopen it 4 - Apply first patch 5 - Check you can reopen the serial (wrong behaviour) keep the page open 6 - On serial B's collection page, close the serial, keep the page open 7 - Apply second patch 8 - On page left open on 3 -, click on close, you are redirected to a login page. 8 - Go back to serial A's collection page -> there is no close button anymore 9 - On page left open on 4 -, click on reopen, you are redirected to a login page 10 - Go back to serial B's collection page -> there is no close button anymore Signed-off-by: David Nind <david@davidnind.com> |