Bug 37685

Summary: Adding a new subpermission to a permission category grants new features to all staff with a top level permission
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: andrew, blawlor, gmcharlt, kebliss
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 29393    
Bug Blocks:    

Description Nick Clemens (kidclamp) 2024-08-20 12:06:17 UTC
On bug 29393 there was a new subpermission added to the borrowers permission: "send_messages_to_borrowers"

This meant that all staff who were previously able to add/update/delete patrons could now also send them messages with any content. We have received complaints from libraries who do not wish all staff to have had this new permission added. Messaging and borrower CRUD are not necessarily related.

This points to a larger problem with our permissions, but I think in terms of updates/upgrades it is worth having the conversation of how we should go about adding new permissions/subpermissions and granting access to new features.