| Summary: | Can't print receipt w/out allowing "Add or modify borrowers" permission | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Richard <rpritsky> |
| Component: | Patrons | Assignee: | Katrin Fischer <katrin.fischer> |
| Status: | CLOSED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | P3 | CC: | charles.farmer, fridolin.somers, magnus, martin.renvoize, mtompset, nick, veron |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Proposed fix
Bug 3886: Fix mismatch of required permissions for printing slips Bug 3886: Fix mismatch of required permissions for printing slips Bug 3886: Fix mismatch of required permissions for printing slips |
||
|
Description
Chris Cormack
2010-05-21 01:16:16 UTC
Created attachment 4167 [details] [review] Proposed fix For some reason the template wrapped the "print page" menu item in a check for CAN_user_borrowers. The slip and quick slip print options were excluded from this check. I created a new staff user with just the "circulate" and "catalogue" permissions, then logged in as this user. Before the patch was applied: When I go to the circulation screen and select a patron for checking out to, I can only see the Print Slip and Quick Slip options on the Print menu. Both of them works as expected. After applying the patch: I now have a third option, Print Page. Clicking on this opens a new tab, but instead of displaying information about the patron, it says "Error: You do not have permission to access this page. Click to log out" and displays the staff login screen. I think the problem here is that Print Page takes me to this URL: http://localhost:8080/cgi-bin/koha/members/moremember.pl?borrowernumber=51&print=page which is not really a part of the circulation "module", but rather falls within the "jurisdiction" of the "borrowers" permission. Giving my circulation-only staff user the "borrowers" permission makes it possible for that user to have the Print Page action display properly, as described by the bug submitter. In light of this, limiting Print Page with CAN_user_borrowers actually seems to make sense. I think there are two options for making Print Page work for users without the "borrowers" permission: 1. Make is possible for them to access members/moremember.pl?borrowernumber=51&print=page (but not other functions of the members/moremember.pl script) 2. Recreate the Print Page functionality within the "jurisdiction" of the "circulate" permission. Marking as "Failed QA". Prog theme no longer exists. Testing on current master: Staff member with circulate_remaining_permissions is able to print slip and quick slip only. To print summary, borrowers permission has to be set. (members-toolbar.inc line 160) Question: Should a staff member with circulate_remaining_permissions be able to print the summary? We have a mismatch here between the templates and the perl script. The script asks for circulate_remaining_permissions and the template for edit_borrowers: http://git.koha-community.org/gitweb/?p=koha.git;a=blob;f=koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc;h=9b5524d4c16c15b81cc7ba9c8eaaad240cf51cf5;hb=9b31bc2d27c6e045a6e7ea079778c47674c135db#l27 I tend to follow the script here. Created attachment 75350 [details] [review] Bug 3886: Fix mismatch of required permissions for printing slips - Print summary (summary-print.pl) - Print quick slip (printslip.pl) - Print slip (printslip.pl) - Print overdues (print_overdues.pl) Perl scripts all require circulate_remaining_permissions, while in the template we were checking for edit_borrowers. Now the print pull down will only be visible if the patron has circulate or circulate_remaining_permissions. To test: - Verify that printing the listed slips works for staff users with either circulate or circulate_remaining_permissions and without edit_borrowers. Works as advertised, though I had to manually enter the print-summary URL in order to test, since my borrower only had the 'catalogue' and either 'circulate' or 'circulate_remaining_permissions' and couldn't directly visit moremember.pl. Are there any other pages available to a patron with such narrow permissions where the printslip button appears? Signed Off Created attachment 75568 [details] [review] Bug 3886: Fix mismatch of required permissions for printing slips - Print summary (summary-print.pl) - Print quick slip (printslip.pl) - Print slip (printslip.pl) - Print overdues (print_overdues.pl) Perl scripts all require circulate_remaining_permissions, while in the template we were checking for edit_borrowers. Now the print pull down will only be visible if the patron has circulate or circulate_remaining_permissions. To test: - Verify that printing the listed slips works for staff users with either circulate or circulate_remaining_permissions and without edit_borrowers. Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> Created attachment 75604 [details] [review] Bug 3886: Fix mismatch of required permissions for printing slips - Print summary (summary-print.pl) - Print quick slip (printslip.pl) - Print slip (printslip.pl) - Print overdues (print_overdues.pl) Perl scripts all require circulate_remaining_permissions, while in the template we were checking for edit_borrowers. Now the print pull down will only be visible if the patron has circulate or circulate_remaining_permissions. To test: - Verify that printing the listed slips works for staff users with either circulate or circulate_remaining_permissions and without edit_borrowers. Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to master for 18.11. Awesome work all, thank you. This patch has been pushed to 18.05.x and will be in 18.05.01 Nice one killing off this old bug team :) Pushed to 17.11.x for 17.11.07 I choose not to backport to 17.05.x, i focus on major and blocker bugs. Resoooooolved ;) |