Bug 40686

Summary: Permissions for views on moredetail.pl different from updates in updateitem.pl
Product: Koha Reporter: David Cook <dcook>
Component: CirculationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: andrew, gmcharlt, kyle
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 29002    
Bug Blocks:    

Description David Cook 2025-08-22 03:50:38 UTC
This is a fairly minor bug. 

On ./koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt you need CAN_user_circulate to be able to update the "Bookable" property.

However, on ./catalogue/updateitem.pl the permission that is required is circulate_remaining_permissions.

CAN_user_circulate means that you have at least 1 circulate subpermission.

So you can see the update form, but if you try to do it without circulate_remaining_permissions, it'll show you a login screen.

Fortunately, this one is an easy fix.
Comment 1 David Cook 2025-08-22 03:51:00 UTC
Of course, I don't think it's the right permission to use here, but we should be consistent.
Comment 2 David Cook 2025-08-22 04:04:41 UTC
Actually, it's not just Bookings. It's pretty much everything.
Comment 3 David Cook 2025-08-22 04:05:32 UTC
Re-thinking that dependency on bug 29002, although the oldest backports probably have 29002 so maybe it's OK...