| Summary: | Don't allow staff to change their own permissions | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Savitra Sirohi <savitra.sirohi> |
| Component: | Patrons | Assignee: | Meenakshi <meenakshi.r> |
| Status: | ASSIGNED --- | QA Contact: | Bugs List <koha-bugs> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | gmcharlt, kohapatch, veron |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10573 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 |
||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: | Sending Improved Patch | ||
|
Description
Savitra Sirohi
2011-09-05 05:08:13 UTC
*** Bug 6784 has been marked as a duplicate of this bug. *** Created attachment 9906 [details] [review] Sending Improved Patch The Patch which I send was wrong Patch. Working on This Patch. This seems to work on current master.
To verify:
- Give a test user following permisson
- borrowers Add, modify and view patron information
- permissions Set user permissions
- Log in as test user
- Search a user, change the permission -> possible
- Search test user, try to change the permission -> error page not allowed
Though, because the borrowers permission is needed, somebody could create a new patron and set there a higher level of permissions.
There is also the ProtectSuperlibrarianPrivileges system preference now, but I am not sure how to resolve the scenario Marc has pointed out. I think the only solution is to only give 'permissions' to users you trust. |