Bug 11911 - Add separate permission for managing suggestions
Summary: Add separate permission for managing suggestions
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Keywords:
: 6889 13160 15506 (view as bug list)
Depends on:
Blocks: 22868
  Show dependency treegraph
 
Reported: 2014-03-08 00:12 UTC by Nicole C. Engard
Modified: 2020-11-12 15:07 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Medium patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 11911: Add a separate permission for managing suggestions (7.91 KB, patch)
2018-05-20 03:58 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission (1.07 KB, patch)
2018-05-28 21:58 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 11911: Add a separate permission for managing suggestions (8.06 KB, patch)
2018-05-29 12:51 UTC, Séverine Queune
Details | Diff | Splinter Review
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission (1.21 KB, patch)
2018-05-29 12:51 UTC, Séverine Queune
Details | Diff | Splinter Review
Bug 11911: Add a separate permission for managing suggestions (8.18 KB, patch)
2018-06-01 13:34 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission (1.29 KB, patch)
2018-06-01 13:34 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nicole C. Engard 2014-03-08 00:12:25 UTC
If I don’t give an account a permission to the purchase suggestions, but they have a copy of the link, such as http://mysite/cgi-bin/koha/suggestion/suggestion.pl?displayby=STATUS&branchcode=__ANY__, they can go straight into the feature without permission.  Shouldn’t the suggestion.pl be checking permissions upon loading?  Do most pages function in this manner?
Comment 1 Katrin Fischer 2015-01-06 22:40:01 UTC
Suggestions are tied to a very low level permission:
flagsrequired   => { catalogue => 1 }

So everyone can access the page, even without any acq related permission.

I think fixing this cleanly we should add a permission for the suggestions and make sure its set for all existing staff.
Comment 2 Katrin Fischer 2016-07-19 11:32:01 UTC
*** Bug 13160 has been marked as a duplicate of this bug. ***
Comment 3 Katrin Fischer 2016-07-19 11:32:28 UTC
*** Bug 15506 has been marked as a duplicate of this bug. ***
Comment 4 Katrin Fischer 2016-07-19 11:32:40 UTC
*** Bug 6889 has been marked as a duplicate of this bug. ***
Comment 5 Ray Delahunty 2017-01-17 09:04:15 UTC
May I respectfully ask that this bug **not** be fixed to ensure that permissions are checked, without the action in duplicate 15506 being attended to at the same time. Here we are delighted at this permissions bug as only a handful of central office staff have Acquisitions permissions (and hence Purchase Suggestions permissions).
We have distributed the link included below out to college library staff at all of our various sites, and this means the staff there can deal with Suggestions themselves without central bibliographic services staff having to be involved. 
Perhaps Purchase Suggestions permissions belong under Tools, rather than Acquisitions?

Ray Delahunty
University of the Arts London
Comment 6 Katrin Fischer 2017-01-17 23:13:29 UTC
Hi Ray, that's exactly what I suggested here. We should add a new permission and make sure it's set for all existing staff acounts - that way there will be no change of behaviour on update.

We also use the suggestions outside of the acquisitions module. We have added the link to the suggestions to the intranet navigation bar using IntranetNav. A downside of the curent behaviour is that the dashboard doesn't show information about new suggestions to users without acq permissions. Having a separate permission we could also fix this.
Comment 7 Fiona Borthwick 2017-06-30 13:43:49 UTC
I definitely think a separate permission to manage suggestions would be very welcome. We have a range of customers who make use of purchase suggestions but want to have the ability to control which members of the staff can actually manage the suggestions.
Comment 8 Katrin Fischer 2018-05-20 03:58:58 UTC
Created attachment 75448 [details] [review]
Bug 11911: Add a separate permission for managing suggestions

Without this patch only catalogue permission was required
for managing suggestions. This patch adds a new permission
in the acquisition module do manage suggestions and updates
staff user permissions accordingly.

To test:
- Make sure there is a pending suggestion
- Create a few users with different permission sets:
  - User 1: only catalogue
  - User 2: any acquisition permission
  - User 3: cataloguing permission
- Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl
- Apply the patch
- Verify all of them now have the suggestions_manage permission
- Verify everything displays correctly on:
  - intranet start page
  - patron account in staff
  - acquisition start page
  - suggestion page (try to access by URL too)
- Remove suggestions_manage for a staff user
- Repeat tests above, access should be denied/links not visible

Bonus:
- Fixes the link on the acquisition start page for late orders
  to mage the permissions of the page itself: order_receive
Comment 9 Séverine Queune 2018-05-23 16:07:20 UTC
All behaviours are correct (the bonus one too !).

I just wondered about this setting : any acquisition permission except suggestions_manage : "Suggestions" link on acqui-home side menu is hidden, shouldn't it be the same for the "Manage suggestions" link on the "Pending suggestions" frame ?
Comment 10 Katrin Fischer 2018-05-28 21:58:25 UTC
Created attachment 75616 [details] [review]
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission

When the user is not superlibrarian or has the manage_suggestions
permission, the suggestion box on the left of the acq start page
needs to be hidden.
Comment 11 Katrin Fischer 2018-05-28 21:59:17 UTC
Hi Severine, thx for catching this! Could you maybe sign the follow-up too?
Comment 12 Séverine Queune 2018-05-29 12:51:04 UTC
Created attachment 75630 [details] [review]
Bug 11911: Add a separate permission for managing suggestions

Without this patch only catalogue permission was required
for managing suggestions. This patch adds a new permission
in the acquisition module do manage suggestions and updates
staff user permissions accordingly.

To test:
- Make sure there is a pending suggestion
- Create a few users with different permission sets:
  - User 1: only catalogue
  - User 2: any acquisition permission
  - User 3: cataloguing permission
- Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl
- Apply the patch
- Verify all of them now have the suggestions_manage permission
- Verify everything displays correctly on:
  - intranet start page
  - patron account in staff
  - acquisition start page
  - suggestion page (try to access by URL too)
- Remove suggestions_manage for a staff user
- Repeat tests above, access should be denied/links not visible

Bonus:
- Fixes the link on the acquisition start page for late orders
  to mage the permissions of the page itself: order_receive

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Comment 13 Séverine Queune 2018-05-29 12:51:07 UTC
Created attachment 75631 [details] [review]
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission

When the user is not superlibrarian or has the manage_suggestions
permission, the suggestion box on the left of the acq start page
needs to be hidden.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Comment 14 Séverine Queune 2018-05-29 12:52:15 UTC
Both patchs ok for me, thank you Katrin !
Comment 15 Jonathan Druart 2018-05-30 20:19:16 UTC
I am not sure it's a big deal but since bug 18403 the "borrowers" permissions has  subpermissions and so the SQL query should be adjusted a bit.
Comment 16 Katrin Fischer 2018-05-31 21:26:25 UTC
Sorry Joubu, but I don't understand what you mean.

I look for staff users with catalogue permission and the new permission is under acquisitions... where does the borrowers permission play in?
Comment 17 Jonathan Druart 2018-06-01 13:33:57 UTC
We should highlight the change in the release notes:

Before:
members/purchase-suggestions.pl required { borrowers => 'edit_borrowers' }
suggestion/suggestion.pl required { catalogue => 1 }

After the require the new { acquisition => 'suggestions_manage' }
Comment 18 Jonathan Druart 2018-06-01 13:34:15 UTC
(In reply to Jonathan Druart from comment #17)
> After the require the new { acquisition => 'suggestions_manage' }

they*
Comment 19 Jonathan Druart 2018-06-01 13:34:52 UTC
Created attachment 75736 [details] [review]
Bug 11911: Add a separate permission for managing suggestions

Without this patch only catalogue permission was required
for managing suggestions. This patch adds a new permission
in the acquisition module do manage suggestions and updates
staff user permissions accordingly.

To test:
- Make sure there is a pending suggestion
- Create a few users with different permission sets:
  - User 1: only catalogue
  - User 2: any acquisition permission
  - User 3: cataloguing permission
- Check all of them can access: /cgi-bin/koha/suggestion/suggestion.pl
- Apply the patch
- Verify all of them now have the suggestions_manage permission
- Verify everything displays correctly on:
  - intranet start page
  - patron account in staff
  - acquisition start page
  - suggestion page (try to access by URL too)
- Remove suggestions_manage for a staff user
- Repeat tests above, access should be denied/links not visible

Bonus:
- Fixes the link on the acquisition start page for late orders
  to mage the permissions of the page itself: order_receive

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 20 Jonathan Druart 2018-06-01 13:34:57 UTC
Created attachment 75737 [details] [review]
Bug 11911: (follow-up) Hide suggestion box on acq start page if no permission

When the user is not superlibrarian or has the manage_suggestions
permission, the suggestion box on the left of the acq start page
needs to be hidden.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 21 Nick Clemens 2018-07-23 15:37:26 UTC
Awesome work all!

Pushed to master for 18.11
Comment 22 Martin Renvoize 2018-08-03 13:36:42 UTC
Enhancement, will not be backported to 18.05.x series.