Bug 41777

Summary: Allow patron import tool to overwrite passwords for "staff" category type when used by staff with appropriate permissions
Product: Koha Reporter: Michael Adamyk <michael.adamyk>
Component: ToolsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Michael Adamyk 2026-02-05 17:15:50 UTC
Currently, staff users can change passwords or permissions for any other user if they have the "superlibrarian" (Access to all librarian functions) or "staffaccess" (Allow staff members to modify permissions, usernames, and passwords for other staff members) permission. 

However, the patron import tool blocks password changes to any patron categories using the "Staff" category type, regardless of the tool user's permission level. It would make sense for the tool to allow password changes to all accounts for at least superlibrarians, possibly also for "staffaccess" permissions. 

A use case would be a superlibrarian who "rotates" passwords on a regular basis for staff security.
Comment 1 Michael Adamyk 2026-02-05 17:17:05 UTC
However... this has broad security implications for accidentally locking out all staff at once. And with the ability to enforce password expiration and complex passwords through patron categories, this may be a feature that is unnecessary in the patron import tool. 

Because of this, I suggest  it be discussed by the community before action is taken.
Comment 2 Michael Adamyk 2026-02-05 17:18:09 UTC
See Bug 41776 for the documentation need of how patron import currently handles staff passwords.