Summary: | Don't allow staff to change their own permissions | ||
---|---|---|---|
Product: | Koha | Reporter: | Savitra Sirohi <savitra.sirohi> |
Component: | Patrons | Assignee: | Meenakshi <meenakshi.r> |
Status: | ASSIGNED --- | QA Contact: | Bugs List <koha-bugs> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | gmcharlt, katrin.fischer, kohapatch, veron |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10573 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7648 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: | Sending Improved Patch |
Description
Savitra Sirohi
2011-09-05 05:08:13 UTC
*** Bug 6784 has been marked as a duplicate of this bug. *** Created attachment 9906 [details] [review] Sending Improved Patch The Patch which I send was wrong Patch. Working on This Patch. This seems to work on current master. To verify: - Give a test user following permisson - borrowers Add, modify and view patron information - permissions Set user permissions - Log in as test user - Search a user, change the permission -> possible - Search test user, try to change the permission -> error page not allowed Though, because the borrowers permission is needed, somebody could create a new patron and set there a higher level of permissions. There is also the ProtectSuperlibrarianPrivileges system preference now, but I am not sure how to resolve the scenario Marc has pointed out. I think the only solution is to only give 'permissions' to users you trust. |