Summary: | Don't allow staff to change their own permissions | ||
---|---|---|---|
Product: | Koha | Reporter: | Savitra Sirohi <savitra.sirohi> |
Component: | Patrons | Assignee: | Meenakshi <meenakshi.r> |
Status: | ASSIGNED --- | QA Contact: | Bugs List <koha-bugs> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | gmcharlt, kohapatch, veron |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10573 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 |
||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Attachments: | Sending Improved Patch |
Description
Savitra Sirohi
2011-09-05 05:08:13 UTC
*** Bug 6784 has been marked as a duplicate of this bug. *** Created attachment 9906 [details] [review] Sending Improved Patch The Patch which I send was wrong Patch. Working on This Patch. This seems to work on current master. To verify: - Give a test user following permisson - borrowers Add, modify and view patron information - permissions Set user permissions - Log in as test user - Search a user, change the permission -> possible - Search test user, try to change the permission -> error page not allowed Though, because the borrowers permission is needed, somebody could create a new patron and set there a higher level of permissions. There is also the ProtectSuperlibrarianPrivileges system preference now, but I am not sure how to resolve the scenario Marc has pointed out. I think the only solution is to only give 'permissions' to users you trust. |