Bug 13910 - Prevent delete of one's own patron account
Summary: Prevent delete of one's own patron account
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Marc Véron
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 14077
  Show dependency treegraph
 
Reported: 2015-03-25 22:30 UTC by David Cook
Modified: 2015-12-03 22:02 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13910 - Prevent delete of one's own patron account (4.15 KB, patch)
2015-04-23 21:10 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 13910 - Prevent delete of one's own patron account (4.07 KB, patch)
2015-04-29 05:33 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 13910 - Prevent delete of one's own patron account (4.21 KB, patch)
2015-04-29 07:35 UTC, M. Tompsett
Details | Diff | Splinter Review
[Follow-up] Bug 13910 - Line with AUTH_UPDATE_FAILED restored (1023 bytes, patch)
2015-04-29 09:20 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 13910 - Prevent delete of one's own patron account (4.27 KB, patch)
2015-04-29 09:31 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13910 - Line with AUTH_UPDATE_FAILED restored (1.16 KB, patch)
2015-04-29 09:31 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 13910 - Prevent delete of one's own patron account (4.34 KB, patch)
2015-04-29 20:01 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored (1.23 KB, patch)
2015-04-29 20:01 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2015-03-25 22:30:41 UTC
When deleting accounts, it should be impossible to delete one's own borrower account.

Over the years, I've had a few librarians accidentally delete themselves and lock themselves out of Koha. 

I suppose there are quite a few ways this could be implemented. I don't have a patch yet, but this report here is mostly a placeholder for when I do...
Comment 1 Sheila Kearns 2015-04-23 19:08:43 UTC
It may be a different area of permissions, but it would also be useful if permission to delete patrons was separate from permissions to add and modify patrons. Circulation staff need to add and modify, but an option to prevent them from deleting patrons would be usefuo.
Comment 2 Marc Véron 2015-04-23 21:10:05 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-04-28 15:21:57 UTC
Set ExportWithCsvProfile and the export column won't appear anymore with your patch.
It's certainly related to this change:
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
@@ -1,4 +1,4 @@
-[% USE Koha %]
+

Why did you remove that?
Comment 4 Marc Véron 2015-04-29 05:33:49 UTC Comment hidden (obsolete)
Comment 5 M. Tompsett 2015-04-29 07:35:19 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-04-29 08:33:22 UTC
Comment on attachment 38638 [details] [review]
Bug 13910 - Prevent delete of one's own patron account

Review of attachment 38638 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
@@ +144,3 @@
>  [% IF ( error ) %]
>  <div class="dialog alert">
> +    [% IF ( error == 'AUTH_UPDATE_FAILED' ) %]

I don't manager to trigger this one.
Looking at the code, it is never set.
I would prefer not to see this one changed in this bug report but remove in its own bug.
Comment 7 Marc Véron 2015-04-29 09:20:48 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-04-29 09:31:13 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-04-29 09:31:21 UTC Comment hidden (obsolete)
Comment 10 Marc Véron 2015-04-29 10:05:14 UTC
(In reply to Jonathan Druart from comment #9)
(...)
> This should be fixed in a separate patch, this error is not sent to the
> template and the related code could be removed.

See Bug 14077
Comment 11 Katrin Fischer 2015-04-29 20:01:15 UTC
Created attachment 38678 [details] [review]
[PASSED QA] Bug 13910 - Prevent delete of one's own patron account

This patch adds a check to prevent deleting the user's own account.
Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting.

To test:
- Apply patch
- Create a user with sufficient privileges to delete users
- Log in as this new user
- Try to delete this user. Confirm message box "Are you sure..."
- Confirm that you get a message "Not allowed to delete own account" and that the user still exists.

Bonus test:
Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE'
(You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF  etc.)
Without patch, no message appears. With patch, messages appear as appropriate.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

NOTE: Attempted all CANT combinations. From reading the code,
this is kind of an important patch, because I'm not sure
deleting error messages work at all right now based on what
I read.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 12 Katrin Fischer 2015-04-29 20:01:33 UTC
Created attachment 38679 [details] [review]
[PASSED QA] Bug 13910 - Line with AUTH_UPDATE_FAILED restored

As of comment #6

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
This should be fixed in a separate patch, this error is not sent to the
template and the related code could be removed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Tomás Cohen Arazi 2015-05-14 14:56:31 UTC
Patches pushed to master.

Thanks Marc!
Comment 14 Chris Cormack 2015-05-17 22:59:24 UTC
Pushed to 3.18.x will be in 3.18.7