| Summary: | Inconsistent handling of patron deletion permission | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Owen Leonard <oleonard> |
| Component: | Patrons | Assignee: | Kyle M Hall (khall) <kyle> |
| Status: | CLOSED FIXED | QA Contact: | Bugs List <koha-bugs> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | gmcharlt, jonathan.druart, wizzyrea |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13898 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | --- | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: | Circulation function: | ||
| Bug Depends on: | |||
| Bug Blocks: | 6261 | ||
This bug still exists in master. |
In some places the permission to delete patrons is governed by whether or not the user has the "borrowers" permission set: "Add or modify borrowers." In moremember.pl there is a different check governed by a "candeleteuser" variable (line 386): my $candeleteuser; my $userenv = C4::Context->userenv; if($userenv->{flags} % 2 == 1){ $candeleteuser = 1; }elsif ( C4::Context->preference("IndependantBranches") ) { $candeleteuser = ( $data->{'branchcode'} eq $userenv->{branch} ); }else{ if( C4::Auth::getuserflags( $userenv->{flags},$userenv->{number})->{borrowers} ) { $candeleteuser = 1; }else{ $candeleteuser = 0; } } This means that a user viewing a patron record on moremember.pl might have different delete permissions than the same user viewing a patron record in circulation or another patron-related page. A user prevented from deleting by moremember.pl could switch to another page and delete from there.