| Summary: | edit_any_item permission required to see patron name in detail page | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Caroline Cyr La Rose <caroline.cyr-la-rose> |
| Component: | Staff interface | Assignee: | Lucas Gass (lukeg) <lucas> |
| Status: | Pushed to oldstable --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | minor | ||
| Priority: | P5 - low | CC: | bwsdonna, chughesman, elise.konya, enica, fridolin.somers, gmcharlt, lucas, m.de.rooy |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.05.00,23.11.03,23.05.10
|
|
| Circulation function: | |||
| Bug Depends on: | 33167 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 35800: Remove item.can.be.edited check
Bug 35800: Remove item.can.be.edited check Bug 35800: Remove item.can.be.edited check |
||
Caroline is absolutely correct - edit_any_item should not prevent staff from being able to see who has the item checked out, it should depend on view_borrower_infos_from_any_libraries Im not sure why there is a check for [% IF item.can_be_edited %] before displaying the patron name. That seems to be what is wrong here. Removing this check will make this work properly and honor 'view_borrower_infos_from_any_libraries' instead of 'edit_any_items'. Created attachment 161313 [details] [review] Bug 35800: Remove item.can.be.edited check To test: APPLY PATCH 1. Check out an item to a patron from library A 2. Give permissions to a patron from library B (example of a circulation staff account) - circulate - catalogue - borrowers ( including view_borrower_infos_from_any_libraries ) - reserveforothers - updatecharges - suggestions - lists - clubs -> enroll 3. If necessary, change the username and password of that staff member in order to be able to log in 4. In a private browser window, log in as the staff member 5. View the record with the checked out item 6. You should see the name/cardnumber of the patron the item is checked out ot. 7. Turn off the view_borrower_infos_from_any_libraries for this patron. 8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`. Created attachment 161316 [details] [review] Bug 35800: Remove item.can.be.edited check To test: APPLY PATCH 1. Check out an item to a patron from library A 2. Give permissions to a patron from library B (example of a circulation staff account) - circulate - catalogue - borrowers ( including view_borrower_infos_from_any_libraries ) - reserveforothers - updatecharges - suggestions - lists - clubs -> enroll 3. If necessary, change the username and password of that staff member in order to be able to log in 4. In a private browser window, log in as the staff member 5. View the record with the checked out item 6. You should see the name/cardnumber of the patron the item is checked out ot. 7. Turn off the view_borrower_infos_from_any_libraries for this patron. 8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`. Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Thanks Lucas! Created attachment 161508 [details] [review] Bug 35800: Remove item.can.be.edited check To test: APPLY PATCH 1. Check out an item to a patron from library A 2. Give permissions to a patron from library B (example of a circulation staff account) - circulate - catalogue - borrowers ( including view_borrower_infos_from_any_libraries ) - reserveforothers - updatecharges - suggestions - lists - clubs -> enroll 3. If necessary, change the username and password of that staff member in order to be able to log in 4. In a private browser window, log in as the staff member 5. View the record with the checked out item 6. You should see the name/cardnumber of the patron the item is checked out ot. 7. Turn off the view_borrower_infos_from_any_libraries for this patron. 8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`. Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Bug fix ? (In reply to Marcel de Rooy from comment #7) > Bug fix ? You're right. I changed the "importance" to minor instead of enhancement. I noticed this in 23.05 btw. So if it could be backported, it would be great! Thanks! :) Pushed for 24.05! Well done everyone, thank you! Pushed to 23.11.x for 23.11.03 Seconding Caroline's request! Could this be backported to 23.05? Backported to 23.05.x for upcoming 23.05.10 |
A staff member with limited permissions (mostly circulation-related) cannot see the name of the patron who has checked out an item from the detail page, if the patron is from another library, even if the staff member has view_borrower_infos_from_any_libraries. To recreate: 1. Check out an item to a patron from library A 2. Give permissions to a patron from library B (example of a circulation staff account) - circulate - catalogue - borrowers - reserveforothers - updatecharges - suggestions - lists - clubs -> enroll 3. If necessary, change the username and password of that staff member in order to be able to log in 4. In a private browser window, log in as the staff member 5. View the record with the checked out item --> Notice that it only says "Checked out" without any patron name 6. Back in the normal browser, give the additional permission "edit_any_item" to the staff member 7. Refresh the page in the private window (Ctrl+F5) --> Notice the name of the patron now appears I don't think not having the option to edit items from any library should impact the visibility of patron information. This should be managed by view_borrower_infos_from_any_libraries. With git bisect, I found that it was related to bug 33167, although I don't understand what happened...