Summary: | need all acq permissions to search | ||
---|---|---|---|
Product: | Koha | Reporter: | Nicole C. Engard <nengard> |
Component: | Acquisitions | Assignee: | Fridolin Somers <fridolin.somers> |
Status: | CLOSED FIXED | QA Contact: | Katrin Fischer <katrin.fischer> |
Severity: | critical | ||
Priority: | P5 - low | CC: | chris, fridolin.somers, koha.sekjal, kyle.m.hall, mjr, paul.poulain |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Attachments: |
Bug 7018 - need all acq permissions to search
Bug 7018 - need all acq permissions to search [SIGNED-OFF] Bug 7018 - need all acq permissions to search [reopened] Proposed patch Bug 7018 : need all acq permissions to search [PASSED QA] Bug 7018 : need all acq permissions to search |
Description
Nicole C. Engard
2011-10-12 20:15:53 UTC
Bug still valid in 3.6. It happen on order histearch.pl. I agree with Nicole suggested behaviour Created attachment 7506 [details] [review] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring budget_add_del, budget_manage, and budget_modify Kyle, If my patron has: group_manage Manage orders & basketgroups order_manage Manage orders & basket order_receive Manage orders & basket The permissions needed to place an order I still can't do an order search. I'm not sure what you're saying about the budget stuff, but it's the order search that needs fixing. Nicole Created attachment 7653 [details] [review] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring group_manage, order_manage, and order_receive Created attachment 7671 [details] [review] [SIGNED-OFF] Bug 7018 - need all acq permissions to search Single line fix. Changes permissions required for histsearch.pl from requiring * for acquisitions to only requiring group_manage, order_manage, and order_receive Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com> Changes permission call only to allow for partial acq permissions to access this page. Marking Passed QA. This fix was included in the 3.6.x branch prior to 3.6.4. I reopen this bug because it does not behave like wanted. Using : flagsrequired => { acquisition => 'group_manage', acquisition => 'order_manage', acquisition => 'order_receive' }, flagsrequired is a hash so setting 3 times the same key results in a hash with only : { acquisition => 'order_receive' } So instead of requiring group_manage, order_manage and order_receive permissions, acq search page only needs order_receive. Tested with only group_manage or only order_manage, permission is denied. Using several permissions on same module will need development in C4::Auth. It should allow a boolean combination of permissions I think. Created attachment 15721 [details] [review] [reopened] Proposed patch I propose to use any acqui permission to allow order search. See commit message. Created attachment 15781 [details] [review] Bug 7018 : need all acq permissions to search All acquisition module permissions are needed to allow order search (acqui/histsearch.pl). With this patch any acquisition permission allows to order search. Many other pages of this module have this behavior. Test plan : - Set for a user only one permission in acquisition module (not order_receive) => they also need catalogue permission to be able to log in - Login with this user and try to perform an order search => you get access to page - Set for a user no permission in acquisition module - Login with this user and try to perform an order search => you do not get access to page Signed-off-by: MJ Ray <mjr@phonecoop.coop> Looking at this now. Created attachment 16481 [details] [review] [PASSED QA] Bug 7018 : need all acq permissions to search All acquisition module permissions are needed to allow order search (acqui/histsearch.pl). With this patch any acquisition permission allows to order search. Many other pages of this module have this behavior. Test plan : - Set for a user only one permission in acquisition module (not order_receive) => they also need catalogue permission to be able to log in - Login with this user and try to perform an order search => you get access to page - Set for a user no permission in acquisition module - Login with this user and try to perform an order search => you do not get access to page Signed-off-by: MJ Ray <mjr@phonecoop.coop> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Works as expected and passes tests. This patch has been pushed to master. Pushed to 3.10.x and 3.8.x will be in 3.10.5 and 3.8.12 |