Summary: | With IndependentBranches on a non-superlibrarian cannot modify password | ||
---|---|---|---|
Product: | Koha | Reporter: | Marie-Luce Laflamme <marie-luce.laflamme> |
Component: | Patrons | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | gmcharlt, kyle.m.hall |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Marie-Luce Laflamme
2024-02-09 20:02:50 UTC
to test... Set-up - Ensure that the IndependentBranches system preference is turned on. - Add a new staff account with limited permissions to access the intranet minimum permissions required: - all (circulate) - access to staff interface (catalogue) - In borrowers, select only: - delete_borrowers - edit_borrowers --> do not check view_borrower_infos_from_any_libraries - all reserveforothers Test plan 1. Log in to the intranet using the newly created non-superlibrarian account. 2. Find a patron account from the same library as the logged-in staff account. 3. Click on "Modify password" --> Koha prevents this action and displays the message: "You do not have permission to edit this patron's login information." It has recently come to my attention that there are certain scenarios I failed to consider during my testing of independentbranches and non-superlibrarian staff permissions. It turns out that you can change a "regular" patron password, but you can't do the same for another staff member when the permission "view_borrower_infos_from_any_libraries" is not granted. While this restriction may seem justified, it prompts the question: Should we think about adding a way for a library manager, who doesn't have superlibrarian powers but oversee staff actions, to change their staff members' passwords? I thought staffaccess permission would allow this. Have you tested? |