| Summary: | Patrons subpermissions should be fetched with borrowernumber instead of userid | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Emmi Takkinen <emmi.takkinen> |
| Component: | Authentication | Assignee: | Emmi Takkinen <emmi.takkinen> |
| Status: | Failed QA --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | trivial | ||
| Priority: | P5 - low | CC: | david, dpavlin, m.de.rooy |
| Version: | Main | Keywords: | release-notes-needed |
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 41269: Use borrowernumber to fetch patrons subpermissions
Bug 41269: Use borrowernumber to fetch patrons subpermissions |
||
|
Description
Emmi Takkinen
2025-11-19 09:12:19 UTC
Created attachment 190103 [details] [review] Bug 41269: Use borrowernumber to fetch patrons subpermissions Koha currently fetches patrons subpermissions with userid in method get_user_subpermissions. If for some reason patron doesn't have userid their subpermissions aren't displayed on Koha UI. Althougt this shouldn't really happen (unless there are some local use cases where userid can be empty), this method is only used to either display patrons subpermissions on page Set permissions or to check if SCO user only has SCO permissions. In both of these cases we can use patrons borrowernumber instead of userid since they check existing patrons permissions, not the ones for patron who is about to log into Koha. To test: 1. Apply this patch. 2. Enable sysprefs WebBasedSelfCheck and AutoSelfCheckAllowed and add some patrons userid to AutoSelfCheckID. 3. Make sure patron whose userid you used doesn't have permissions to use SCO and has other subpermissions instead. 4. Navigate to page About Koha>System infromation. => Confirm that warnings starting with "The patron used for the self-checkout..." are displayed. 5. Check patrons permissions. => Confirm that patrons subpermissions are displayed normally. Sponsored-by: Koha-Suomi Oy Created attachment 190875 [details] [review] Bug 41269: Use borrowernumber to fetch patrons subpermissions Koha currently fetches patrons subpermissions with userid in method get_user_subpermissions. If for some reason patron doesn't have userid their subpermissions aren't displayed on Koha UI. Althougt this shouldn't really happen (unless there are some local use cases where userid can be empty), this method is only used to either display patrons subpermissions on page Set permissions or to check if SCO user only has SCO permissions. In both of these cases we can use patrons borrowernumber instead of userid since they check existing patrons permissions, not the ones for patron who is about to log into Koha. To test: 1. Apply this patch. 2. Enable sysprefs WebBasedSelfCheck and AutoSelfCheckAllowed and add some patrons userid to AutoSelfCheckID. 3. Make sure patron whose userid you used doesn't have permissions to use SCO and has other subpermissions instead. 4. Navigate to page About Koha>System infromation. => Confirm that warnings starting with "The patron used for the self-checkout..." are displayed. 5. Check patrons permissions. => Confirm that patrons subpermissions are displayed normally. Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> (In reply to Emmi Takkinen from comment #0) > In Koha-Suomi libraries we use cardnumbers as userids. This is done with a > database trigger which sets cardnumber as userid when user is saved to > database. This seems risky to me. We also have a similar mixup already in the code. (I am using a plugin to copy email address to userid btw.) git grep get_user_subpermissions
C4/Auth.pm: get_all_subpermissions get_cataloguing_page_permissions get_user_subpermissions in_iprange
C4/Auth.pm: my $user_subperms = get_user_subpermissions($userid);
C4/Auth.pm:=head2 get_user_subpermissions
C4/Auth.pm: $user_perm_hashref = get_user_subpermissions($userid);
C4/Auth.pm:sub get_user_subpermissions {
C4/Auth.pm:has the same structure as that of C<get_user_subpermissions>,
about.pl:use C4::Auth qw( get_template_and_user get_user_subpermissions );
about.pl: my $all_permissions = C4::Auth::get_user_subpermissions($borrowernumber);
members/member-flags.pl:use C4::Auth qw( get_template_and_user get_all_subpermissions get_user_subpermissions );
members/member-flags.pl: my $user_perms = get_user_subpermissions( $bor->{'borrowernumber'} );
It looks like you forgot some places.
I do agree that it is more logical to look for borrowernumber btw, although we often tend to keep the parameters of such longstanding routines the same. Note that plugins and customizations etc might use them too and will need attention locally.
So this needs to be communicated clearly and should stand out in the release notes. Perhaps add an additional dbrev to print a warn.
Or just keep the userid?
And please add/adjust tests. |