Bug 7805

Summary:	Exposing the new list permissions in opac and staff
Product:	Koha	Reporter:	Marcel de Rooy <m.de.rooy>
Component:	Lists	Assignee:	Marcel de Rooy <m.de.rooy>
Status:	CLOSED FIXED	QA Contact:	Jonathan Druart <jonathan.druart>
Severity:	enhancement
Priority:	P5 - low	CC:	chris, jonathan.druart, liz, nengard, paul.poulain
Version:	3.10
Hardware:	All
OS:	All
See Also:	http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8635
Change sponsored?:	---	Patch complexity:	Small patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Patch Rebased patch Bug 7805: Exposing the new list permissions in opac and staff Patch for perlcritic comments [SIGNED-OFF] Bug 7805 Followup for perlcritic messages PATCH] [3.8.x] 7805 Exposing the new list permissions in opac and staff [PATCH] [3.8.X] 7805 Followup for perlcritic messages

Description Marcel de Rooy 2012-03-22 15:23:07 UTC

The next step after 7310: Exposing the new permissions to add and delete. Will submit the patch now, but give a more detailed test plan later (if needed).

What should be tested here is: 
1 Adding a list and checking various permission settings on opac and staff (edit again or look in the shelves table via sql).
2 Editing a list, changing perm settings and checking them again.
3 Try to add an item to a list without permissions to add (note: you should not be the owner). Try this via interface or even try to hack a URL. It should not be possible.
4 Try to delete an item that you added yourself to a list while delete_own is Do not allow. Even as owner you should not be able to.
5 Try to delete an item that another one added to a list while delete_other is Do not allow. Even as owner you should not be able to.
6 Try some things that you should be allowed to do so.

Important note: The owner can always add, but needs perms to remove.

Comment 1 Marcel de Rooy 2012-03-22 15:26:56 UTC Comment hidden (obsolete)

Created attachment 8529 [details] [review]
Patch

Comment 2 Marcel de Rooy 2012-05-02 13:44:27 UTC Comment hidden (obsolete)

Created attachment 9387 [details] [review]
Rebased patch

Comment 3 Marcel de Rooy 2012-05-02 14:50:01 UTC

Here is a more detailed test plan:

1 Test new list, open for everything.
User1 on OPAC : Add public list P1 on OPAC. Set perms to AAA (3xAllow). 
User1 on Staff: Check perms P1. Do you see AAA?
User1 on OPAC : Add few items. Delete one.
User2 on Staff: Add item to P1. Delete an item from P1 that you added and one that you did not add.

2 Change to closed list.
User1 on Staff: Edit P1. Set perms to DDD (3xDon't). 
User1 on OPAC : Check perms P1. Do you see DDD?
User2 on OPAC : Try to add items to P1 or delete items from P1. Should not be possible. (NOTE: The interface should not even present you an option to Remove selected records when opening a list via the Lists button. Search results should not offer you list P1 in the Add to-combo.)
User1 on Staff: Try to add items to P1. Should be possible (because of ownership).
User1 on Staff: Try to delete items from P1. Should not be possible.

3 Mixed lists.
User1 on Staff: Add private list V1. Set perms to DDD. Add an item. Try to delete it (not possible).
User1 on OPAC : Try to delete item from V1 (not possible).
User1 on Staff: Add public list P2. Set perms to AAD.
User2 on OPAC : Add two items to P2. Remember which.
User1 on OPAC : Add two items to P2.
User1 on Staff: Delete one item of your own (OK). Try to delete an item of User2 (not possible: warned).
User2 on OPAC : Delete one item of your own (OK). Try to delete an item of User1 (not possible: Warned).
User1 on Staff: Set perms to DDA. Try to delete own item (not possible).
User2 on OPAC : Delete item of User1 (OK). Try to delete one item of your own (not possible: warned).

Comment 4 Jared Camins-Esakov 2012-05-28 19:36:21 UTC Comment hidden (obsolete)

Created attachment 9805 [details] [review]
Bug 7805: Exposing the new list permissions in opac and staff

This report builds on 7310.
Had to correct some lines in ModShelf and AddShelf as well in order to
save 0 values correctly for the permission columns.

Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>

Comment 5 Marcel de Rooy 2012-05-29 11:24:26 UTC

(In reply to comment #4)
> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Thank you, Jared!

Comment 6 Paul Poulain 2012-06-09 11:35:37 UTC

QA comment:
 * discussing of this feature with Marcel=if you select "private" list, the other 3 flags are irrelevant. In the future, users will be able to share private lists with who they want.
 * perlcritic in C4/VirtualShelves.pm was complaining before the patch and after the patch, so I won't reject it, but it would be nice to fix it in a later patch:
C4/VirtualShelves.pm: Subroutine prototypes used at line 224, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Subroutine prototypes used at line 255, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: "return" statement with explicit "undef" at line 354, column 22.  See page 199 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Subroutine prototypes used at line 661, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Don't modify $_ in list functions at line 664, column 5.  See page 114 of PBP.  (Severity: 5)

No other comment, passed QA

Comment 7 Marcel de Rooy 2012-06-14 10:40:32 UTC

Sending a followup for QA comments. Just housekeeping.
Removed the prototypes and return undef. The obsolete code of each_biblionumbers has been removed.

Comment 8 Marcel de Rooy 2012-06-14 10:48:53 UTC

Test the patch (with call to GetShelf and GetShelfContents) by going to Lists and doubleclicking a list to see its contents (in opac or staff).
Does it work? No warnings in your log too? You are ready to sign off ;)

Comment 9 Marcel de Rooy 2012-06-14 10:49:52 UTC Comment hidden (obsolete)

Created attachment 10274 [details] [review]
Patch for perlcritic comments

Comment 10 Owen Leonard 2012-08-07 13:21:05 UTC Comment hidden (obsolete)

Created attachment 11417 [details] [review]
[SIGNED-OFF] Bug 7805 Followup for perlcritic messages

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Tested by going to Lists and doubleclicking a list to see
its contents (in opac or staff). It works. No warnings
in the log. I am ready to sign off.

Comment 11 Jonathan Druart 2012-08-10 13:15:59 UTC

Last patch marked as Passed QA

Comment 12 Nicole C. Engard 2012-08-13 20:53:20 UTC

*** Bug 8635 has been marked as a duplicate of this bug. ***

Comment 13 Paul Poulain 2012-09-03 13:57:43 UTC

Follow-up pushed

Comment 14 Marcel de Rooy 2012-11-07 16:00:59 UTC

Created attachment 13288 [details] [review]
PATCH] [3.8.x] 7805 Exposing the new list permissions in opac and staff

3.8.X

Comment 15 Marcel de Rooy 2012-11-07 16:02:18 UTC

Created attachment 13289 [details] [review]
[PATCH] [3.8.X] 7805 Followup for perlcritic messages

Comment 16 Marcel de Rooy 2012-11-07 16:02:53 UTC

Tested the latest two patches for 3.8.X on commit d39283175622ddecaa3797566d1b4bc910ecdaa0

Comment 17 Chris Cormack 2012-11-08 03:12:00 UTC

Pushed to 3.8.x, will be in 3.8.7

Thanks Marcel

Comment 18 Liz Rea 2012-11-28 01:01:20 UTC

Patch does not apply to 3.6.x - please attach a 3.6 patch if required.

Thanks!