Bug 13582 - Able to view menu for Circulation History even when user does not have permission
Summary: Able to view menu for Circulation History even when user does not have permis...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-14 21:16 UTC by Thomas Wright
Modified: 2016-06-21 21:36 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13582 - Able to view menu for Circulation History even when user does not have permission Added check for borrowers that stops the Circulation History link being shown. This could be done through the css but that function currently appears to be broke (1.93 KB, patch)
2015-01-14 22:07 UTC, Thomas Wright
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13582 - Able to view menu for Circulation History even when user does not have permission (1.99 KB, patch)
2015-01-19 06:31 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 13582 - Able to view menu for Circulation History even when user does not have permission (2.04 KB, patch)
2015-01-19 13:16 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13582: (follow-up) Able to view menu for Circulation History even when user does not have permission (2.26 KB, patch)
2015-01-19 13:16 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Wright 2015-01-14 21:16:04 UTC
Same problem as Bug 10943. The page requires borrowers to access but the menu item is still shown to users who do not have the borrowers permission.

From readingrec.pl we see:
    flagsrequired => {borrowers => 1},

Yet in the include the only thing checked is:
    [% IF ( readingrecordview ) %]

So a user who doesn't have permission to access Circulation history can still see the menu item.
Comment 1 Thomas Wright 2015-01-14 21:16:25 UTC
I'm working on this.
Comment 2 Thomas Wright 2015-01-14 22:07:56 UTC Comment hidden (obsolete)
Comment 3 Thomas Wright 2015-01-14 22:27:32 UTC
After discussion with Chris the decision has been made to hide the unnavigable menu items. This could be done with the CSS and greying out the unavailable options but currently that appears to be broken.
This may in fact be a better solution as it removes any confusion users may have as to why when they click on things they don't work.
Comment 4 Katrin Fischer 2015-01-19 06:31:08 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-01-19 13:16:30 UTC
Created attachment 35382 [details] [review]
Bug 13582 - Able to view menu for Circulation History even when user does not have permission

Added check for borrowers that stops the Circulation History link being shown.
This could be done through the css but that function currently appears to be broken.

Testing Plan:

-Search for a patron with an account that does not have the 'borrowers' permission
*Circulation history should not be seen in the menu.

-Change the accounts permissions so they have the 'borrowers' permission
*Circulation history should be present in the menu.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Comment 6 Jonathan Druart 2015-01-19 13:16:37 UTC
Created attachment 35383 [details] [review]
Bug 13582: (follow-up) Able to view menu for Circulation History even when user does not have permission

Same changes as the previous patch, for the .tt file.
Comment 7 Tomás Cohen Arazi 2015-01-21 14:17:47 UTC
Patch pushed to master.

Thanks Thomas!
Comment 8 Tomás Cohen Arazi 2015-01-21 14:19:40 UTC
Patch pushed to master.

Thanks Jonathan!