| Summary: | With IndependentBranches on a non-superlibrarian cannot modify password | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marie-Luce Laflamme <marie-luce.laflamme> |
| Component: | Patrons | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | gmcharlt, kyle |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Marie-Luce Laflamme
2024-02-09 20:02:50 UTC
to test...
Set-up
- Ensure that the IndependentBranches system preference is turned on.
- Add a new staff account with limited permissions to access the intranet
minimum permissions required:
- all (circulate)
- access to staff interface (catalogue)
- In borrowers, select only:
- delete_borrowers
- edit_borrowers
--> do not check view_borrower_infos_from_any_libraries
- all reserveforothers
Test plan
1. Log in to the intranet using the newly created non-superlibrarian account.
2. Find a patron account from the same library as the logged-in staff account.
3. Click on "Modify password"
--> Koha prevents this action and displays the message: "You do not have permission to edit this patron's login information."
It has recently come to my attention that there are certain scenarios I failed to consider during my testing of independentbranches and non-superlibrarian staff permissions. It turns out that you can change a "regular" patron password, but you can't do the same for another staff member when the permission "view_borrower_infos_from_any_libraries" is not granted. While this restriction may seem justified, it prompts the question: Should we think about adding a way for a library manager, who doesn't have superlibrarian powers but oversee staff actions, to change their staff members' passwords? I thought staffaccess permission would allow this. Have you tested? |