Bug 18906 - Superlibrarian and budget_manage_all users should always see all funds
Summary: Superlibrarian and budget_manage_all users should always see all funds
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-06 17:48 UTC by Katrin Fischer
Modified: 2017-09-15 23:23 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18906: Display all funds the logged in user can use (1.27 KB, patch)
2017-07-06 21:11 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 18906: Display all funds the logged in user can use (1.44 KB, patch)
2017-07-26 22:39 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 18906: Display all funds the logged in user can use (1.50 KB, patch)
2017-07-31 15:29 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2017-07-06 17:48:22 UTC
If you have the superlibrarian or budget_manage_all permission you should be able to see all funds at all times - otherwise it's not possible to centrally manage and edit funds in a multi-branch system. Also, if someone logged themselves out from a fund by wrong configuration, users with those permissions need to be able to fix it.

To test:
- Make sure your user has superlibrarian permission
- Go into acquisisitions
- Create a new budget
- Create a new fund
  - set library to 'not your home library'
  - set restricted to 'owner, users and library'
- Verify that after saving the fund, you can no longer access it.
- Change your home branch
- log out and log in again
- Verify you can now see the fund

Repeat with all acq permissions including budget_manage_all - you will also experience that you are logged out from accessing the fund you created.

Note: visibility on the acq start page will work correctly in these scenarios.
Comment 1 Jonathan Druart 2017-07-06 21:11:48 UTC
Created attachment 64874 [details] [review]
Bug 18906: Display all funds the logged in user can use

There are complex conditions to know if a librarian can use a fund, we
cannot do that with a SQL query, we need to use C4::Budgets::CanUserUseBudget
Comment 2 Jonathan Druart 2017-07-06 21:12:26 UTC
I do not provide a test plan as I am not sure what is the expected behaviours.
Comment 3 Alex Buckley 2017-07-26 22:39:46 UTC
Created attachment 65288 [details] [review]
Bug 18906: Display all funds the logged in user can use

There are complex conditions to know if a librarian can use a fund, we
cannot do that with a SQL query, we need to use C4::Budgets::CanUserUseBudget

When this patch is applied then all funds are visible to both
superlibrarian patrons and patrons with all acq permissions

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 4 Nick Clemens 2017-07-31 15:29:38 UTC
Created attachment 65361 [details] [review]
Bug 18906: Display all funds the logged in user can use

There are complex conditions to know if a librarian can use a fund, we
cannot do that with a SQL query, we need to use C4::Budgets::CanUserUseBudget

When this patch is applied then all funds are visible to both
superlibrarian patrons and patrons with all acq permissions

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Nick Clemens 2017-07-31 15:30:59 UTC
Permissions could be more thought out, but this ensures that superlibrarians and users that can manage_all_budgets can access any fund to correct permissions/add users/etc.
Comment 6 Jonathan Druart 2017-08-09 19:54:13 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 7 Fridolin SOMERS 2017-09-12 14:01:13 UTC
Pushed to 17.05.x, will be in 17.05.04.
Comment 8 Katrin Fischer 2017-09-15 23:23:02 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.