Bug 10232 - Permission check for editing help files is broken
Summary: Permission check for editing help files is broken
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Galen Charlton
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-12 14:26 UTC by Katrin Fischer
Modified: 2017-04-30 20:10 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2013-05-12 14:26:47 UTC
To test:
- Try editing a help file as superlibrarian, confirm you get to the editor. You might not be able to save your changes though, because of file permissions.

- Try editing a help file with any of the listed permissions from the edithelp.pl file:

  43 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
  44     {
  45         template_name   => "help/edithelp.tt",
  46         query           => $input,
  47         type            => "intranet",
  48         authnotrequired => 0,
  49         flagsrequired   => {
  50             catalogue        => 1,
  51             circulate        => 1,
  52             parameters       => 1,
  53             borrowers        => 1,
  54             permissions      => 1,
  55             reserveforothers => 1,
  56             borrow           => 1,
  57             reserveforself   => 1,
  58             editcatalogue    => 1,
  59             updatecharges    => 1,
  60         },
  61         debug => 1,
  62     }
  63 );

Verify it doesn't work.

I think reserveforself doesn't exist in current Koha and the choice of permissions seems a bit arbitrary.
Comment 1 Katrin Fischer 2013-07-07 09:47:56 UTC
I think this is kind of a bigger problem - only superlibrarians can currently edit help files. 

Of course, editing help files comes with its own set of problems, as any changes made will be overwritten when updating.
Comment 2 Jonathan Druart 2015-04-14 14:25:33 UTC
A fix could be to add a permission to edit help files.
Comment 3 Katrin Fischer 2015-04-14 14:32:02 UTC
Hi Jonathan, that would probably be the cleanest option. - Right now it's limited to the superlibrarian, but the code seems like it intended something else?
Comment 4 Tomás Cohen Arazi 2016-02-26 17:48:03 UTC
The only way to solve this, is to have a specific permission and, of course, an overlay help file so it is not overwritten on update.
Comment 5 Marc Véron 2017-04-30 20:10:16 UTC
Bug 18483 - "Customised help: Enhance staff client with news based, easily editable help system" adds two new user permissions: edit_news and edit_help