When deleting accounts, it should be impossible to delete one's own borrower account. Over the years, I've had a few librarians accidentally delete themselves and lock themselves out of Koha. I suppose there are quite a few ways this could be implemented. I don't have a patch yet, but this report here is mostly a placeholder for when I do...
It may be a different area of permissions, but it would also be useful if permission to delete patrons was separate from permissions to add and modify patrons. Circulation staff need to add and modify, but an option to prevent them from deleting patrons would be usefuo.
Created attachment 38469 [details] [review] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate.
Set ExportWithCsvProfile and the export column won't appear anymore with your patch. It's certainly related to this change: +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ -1,4 +1,4 @@ -[% USE Koha %] + Why did you remove that?
Created attachment 38629 [details] [review] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. --- Amended to restore accidentally removed line in moremember.tt, see comment #3 /mv
Created attachment 38638 [details] [review] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read.
Comment on attachment 38638 [details] [review] Bug 13910 - Prevent delete of one's own patron account Review of attachment 38638 [details] [review]: ----------------------------------------------------------------- ::: koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ +144,3 @@ > [% IF ( error ) %] > <div class="dialog alert"> > + [% IF ( error == 'AUTH_UPDATE_FAILED' ) %] I don't manager to trigger this one. Looking at the code, it is never set. I would prefer not to see this one changed in this bug report but remove in its own bug.
Created attachment 38650 [details] [review] [Follow-up] Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6
Created attachment 38651 [details] [review] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Created attachment 38652 [details] [review] Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6 Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> This should be fixed in a separate patch, this error is not sent to the template and the related code could be removed.
(In reply to Jonathan Druart from comment #9) (...) > This should be fixed in a separate patch, this error is not sent to the > template and the related code could be removed. See Bug 14077
Created attachment 38678 [details] [review] [PASSED QA] Bug 13910 - Prevent delete of one's own patron account This patch adds a check to prevent deleting the user's own account. Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. To test: - Apply patch - Create a user with sufficient privileges to delete users - Log in as this new user - Try to delete this user. Confirm message box "Are you sure..." - Confirm that you get a message "Not allowed to delete own account" and that the user still exists. Bonus test: Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' (You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) Without patch, no message appears. With patch, messages appear as appropriate. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> NOTE: Attempted all CANT combinations. From reading the code, this is kind of an important patch, because I'm not sure deleting error messages work at all right now based on what I read. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Created attachment 38679 [details] [review] [PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored As of comment #6 Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> This should be fixed in a separate patch, this error is not sent to the template and the related code could be removed. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Patches pushed to master. Thanks Marc!
Pushed to 3.18.x will be in 3.18.7