Bug 7648

Summary: staff can make themselves superlibrarians
Product: Koha Reporter: Nicole C. Engard <nengard>
Component: PatronsAssignee: Kyle M Hall <kyle.m.hall>
Status: RESOLVED DUPLICATE QA Contact:
Severity: enhancement    
Priority: P5 - low CC: chris, gmcharlt, katrin.fischer, veron
Version: Main   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10537
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6846
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Nicole C. Engard 2012-03-06 03:16:55 UTC
This seems like an oversight to me, but if you give a staff patron the ability to set permissions for other staff members they can then update their own permissions and make themselves superlibrarians.  I would say that only superlibrarians can make other staff superlibrarians, and I'd go even further to say that only superlibrarians should be able to change their own permissions - but I think this is probably due for some discussion either way because it's a pretty big oversight.
Comment 1 Chris Cormack 2012-03-06 07:12:24 UTC
I don't think it's an oversight, if you trust people enough to let them set staff permissions for others, including making others super librarians. I think it's fair to trust them to not act unethically with their own permissions.

If you can't trust them to not escalate their own permissions, there is no way you should give them permission to change others.

Maybe just fire people who act unethically.
Comment 2 Nicole C. Engard 2012-03-11 19:46:17 UTC
I would say that giving superlibrarian permissions needs to be another permission.  If you're in a consortium you have to let someone at each branch set permissions for their staff, but you don't want them going in and changing the system preferences, and if they can assign superlibrarian permissions then they can access the system preferences.

And no matter how many times I tell people to fire those in their libraries who don't follow the rules they won't.  Instead they'd like more protection on the system.

Nicole
Comment 3 Chris Cormack 2012-03-11 21:45:17 UTC
(In reply to comment #2)
> I would say that giving superlibrarian permissions needs to be another
> permission.  If you're in a consortium you have to let someone at each
> branch set permissions for their staff, but you don't want them going in and
> changing the system preferences, and if they can assign superlibrarian
> permissions then they can access the system preferences.

What about giving yourself every permission except superlibrarian .. how many are you allowed to set with the permission to set permissions. You would have to disable the management permissions to in your case above.

> 
> And no matter how many times I tell people to fire those in their libraries
> who don't follow the rules they won't.  Instead they'd like more protection
> on the system.
> 

Definitely not a bug, perhaps a possible enhancement, but would have to be done in a way that doesn't annoy the rest of the world who have staff they can actually trust.
Comment 4 Katrin Fischer 2018-05-16 23:30:03 UTC

*** This bug has been marked as a duplicate of bug 20100 ***