Summary: | Add permissions check to PatronSelfRegistrationAlert on home page | ||
---|---|---|---|
Product: | Koha | Reporter: | Owen Leonard <oleonard> |
Component: | Patrons | Assignee: | Owen Leonard <oleonard> |
Status: | Signed Off --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | david, gmcharlt, kyle.m.hall |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: |
This enhancement fixes the staff interface home page so that the "Self-registrations from" alert is only shown if the staff patron has the correct permissions. Before this, the alert was shown when the staff patron didn't have any borrower permissions.
|
|
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 35028 | ||
Bug Blocks: | |||
Attachments: |
Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page
Bug 39927: (follow-up) Add permission check to display of page section Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page Bug 39927: (follow-up) Add permission check to display of page section |
Description
Owen Leonard
2025-05-16 17:01:19 UTC
Created attachment 182547 [details] [review] Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page This patch adds a permissions check around the display of PatronSelfRegistrationAlert information on the staff interface home page. To test, apply the patch and follow the test plan on Bug 35028: 1. Create patron category SELFREG 2. Enable PatronSelfRegistration and set PatronSelfRegistrationDefaultCategory to SELFREG and PatronSelfRegistrationAlert to "Show" 3. Go to OPAC, logout if needed, and create a new account. Remember the value you set for home library. 4. Go to staff interface, set the current library to the one you set in step 3. Now view the staff interface home page as two different users: - A user with either CAN_user_borrowers_edit_borrowers or CAN_user_borrowers_list_borrowers permission. - A user with neither. - The self-registration information should display or not depending on the user's permission. Sponsored-by: Athens County Public Libraries I've Failed QA. The only difference I noted was that with no borrowers permission: 1. After the patch you don't see the the "Self-registrations from: XX" section on the home page (as expected). 2. However, there is a white section under the links to the modules with no text. Note that you also get a 403: Forbidden error and "Processing" message with edit_borrowers permission, both before and after the patch. Possibly this should be on another bug (if it doesn't already exist)? Testing notes (using KTD): 1. System prference set up: . Already enabled by default in KTD: PatronSelfRegistration and set PatronSelfRegistrationDefaultCategory to SELFREG . Need to set PatronSelfRegistrationAlert to "Show" 2. Used Henry Acevedo, Midway library, set up with permission: Staff access, allows viewing of catalogue in staff interface (catalogue). 3. Self-registration patron created - Centerville library 4. Permissions to experiment with: - Add, modify and view patron information (borrowers) - Add, modify and view patron information (edit_borrowers) - Search, list and view patrons (list_borrowers) 5. Before the patch: - With no borrowers permission: . sees Self-registrations from: All libraries: 1 . if you try to access, you get a log in screen with "Error: You do not have permission to access this page." - With borrowers permission: . sees Self-registrations from: All libraries: 1 . this lists all the borrowers in the self-registration category . can edit and delete borrowers listed - With edit_borrowers permission only: . sees Self-registrations from: All libraries: 1 . pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK" . table is shown, but sits with "Processing" shown. - With list_borrowers permission only: . sees Self-registrations from: All libraries: 1 . no patrons listed . the Library filter only shows Midway - can't select any other library 6. After the patch: - With no borrowers permission: . Sees a white section under the links to the modules - With borrowers permission (same as before the patch): . sees Self-registrations from: All libraries: 1 . this lists all the borrowers in the seff-registration category . can edit and delete borrowers listed - With edit_borrowers permission only (same as before the patch): . sees Self-registrations from: All libraries: 1 . pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK" . table is shown, but sits with "Processing" shown. - With list_borrowers (same as before the patch): . sees Self-registrations from: All libraries: 1 . no patrons listed . the Library filter only shows Midway - can't select any other library Created attachment 182799 [details] [review] Bug 39927: (follow-up) Add permission check to display of page section Created attachment 182882 [details] [review] Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page This patch adds a permissions check around the display of PatronSelfRegistrationAlert information on the staff interface home page. To test, apply the patch and follow the test plan on Bug 35028: 1. Create patron category SELFREG 2. Enable PatronSelfRegistration and set PatronSelfRegistrationDefaultCategory to SELFREG and PatronSelfRegistrationAlert to "Show" 3. Go to OPAC, logout if needed, and create a new account. Remember the value you set for home library. 4. Go to staff interface, set the current library to the one you set in step 3. Now view the staff interface home page as two different users: - A user with either CAN_user_borrowers_edit_borrowers or CAN_user_borrowers_list_borrowers permission. - A user with neither. - The self-registration information should display or not depending on the user's permission. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Created attachment 182883 [details] [review] Bug 39927: (follow-up) Add permission check to display of page section Signed-off-by: David Nind <david@davidnind.com> Thanks Owen for the follow-up! Updated testing notes: 1. After the patch and with no borrowers permissions, there is no empty white section under the links to the modules (as expected). 2. Both before and after the patch, if a staff patron has only the edit_borrowers permission: - The staff patron sees "Self-registrations from: All libraries: 2 / Midway: 1" (I created two self-registrations - one for Centerville, one for Midway) - When you access the self-registrations page, you get a pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK" - The table to list self-registration patrons is shown, but has a "Processing" message shown, and no patrons listed. - This is the same as when you go to the patrons module, and search or browse for patrons. - In this case, you would need edit_borrowers and list_borrowers permissions for this to work correctly - that is, if you have edit_borrowers you also need list_borrowers. Otherwise, this would be another bug. |