Bug 39379

Summary: The "Edit" button appears in patron search results even when you cannot edit the patron
Product: Koha Reporter: David Cook <dcook>
Component: PatronsAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: Pushed to main --- QA Contact: Katrin Fischer <katrin.fischer>
Severity: minor    
Priority: P5 - low CC: gmcharlt, kyle.m.hall, tomascohen
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:
Attachments: Bug 39379: Sync OPAC's datatables.js with the staff interface's version
Bug 39379: Only display Edit patron button if enough permissions
Bug 39379: Only display Edit patron button if enough permissions

Description David Cook 2025-03-19 03:57:20 UTC
This isn't a huge deal, but I notice that the "Edit" button appears in /cgi-bin/koha/members/members-home.pl even when you don't have edit borrower permissions.

This should be an easy fix.
Comment 1 Tomás Cohen Arazi (tcohen) 2025-04-24 13:08:25 UTC Comment hidden (obsolete)
Comment 2 Tomás Cohen Arazi (tcohen) 2025-04-24 20:29:48 UTC
Created attachment 181469 [details] [review]
Bug 39379: Only display Edit patron button if enough permissions

This patch adds a check for the current user permissions in order to
display the 'Edit' button on the patron search screen.

To test:
1. Have a patron with staff access and only `list_borrowers` permission
   (I picked Henry Acevedo, henry - Acevedo123)
2. Login as that user
3. Perform a patron search at http://kohadev-intra.localhost/cgi-bin/koha/members/members-home.pl
=> FAIL: There's an 'Edit' button
4. Click on the 'Edit' button
=> SUCCESS: You are told you don't have enough permissions
5. Apply this patch
6. Repeat 3
=> SUCCESS: The button is not displayed
7. Login with a superlibrarian user
8. Repeat 3
=> SUCCESS: You can see the button
9. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 Tomás Cohen Arazi (tcohen) 2025-04-24 20:47:55 UTC
(In reply to David Cook from comment #0)
> This isn't a huge deal, but I notice that the "Edit" button appears in
> /cgi-bin/koha/members/members-home.pl even when you don't have edit borrower
> permissions.

Good catch!
Comment 4 Roman Dolny 2025-04-25 19:56:41 UTC
Created attachment 181554 [details] [review]
Bug 39379: Only display Edit patron button if enough permissions

This patch adds a check for the current user permissions in order to
display the 'Edit' button on the patron search screen.

To test:
1. Have a patron with staff access and only `list_borrowers` permission
   (I picked Henry Acevedo, henry - Acevedo123)
2. Login as that user
3. Perform a patron search at http://kohadev-intra.localhost/cgi-bin/koha/members/members-home.pl
=> FAIL: There's an 'Edit' button
4. Click on the 'Edit' button
=> SUCCESS: You are told you don't have enough permissions
5. Apply this patch
6. Repeat 3
=> SUCCESS: The button is not displayed
7. Login with a superlibrarian user
8. Repeat 3
=> SUCCESS: You can see the button
9. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 5 Katrin Fischer 2025-05-07 12:31:21 UTC
Pushed for 25.05!

Well done everyone, thank you!