Bug 19323 - subscription edit permission issue
Summary: subscription edit permission issue
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Fridolin SOMERS
QA Contact: Kyle M Hall
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-15 09:10 UTC by Fridolin SOMERS
Modified: 2017-10-18 21:20 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 19323: subscription edit permission issue (1.62 KB, patch)
2017-09-15 09:28 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
Bug 19323: subscription edit permission issue (1.69 KB, patch)
2017-09-15 19:10 UTC, Caroline Cyr La Rose
Details | Diff | Splinter Review
Bug 19323: subscription edit permission issue (1.74 KB, patch)
2017-09-29 12:00 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin SOMERS 2017-09-15 09:10:08 UTC
If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.
Comment 1 Fridolin SOMERS 2017-09-15 09:28:14 UTC
Created attachment 67141 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page
Comment 2 Caroline Cyr La Rose 2017-09-15 19:10:44 UTC
Created attachment 67153 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 3 Caroline Cyr La Rose 2017-09-15 19:11:43 UTC
Worked!
Comment 4 Kyle M Hall 2017-09-29 12:00:04 UTC
Created attachment 67440 [details] [review]
Bug 19323: subscription edit permission issue

If a librarian has edit_subscription but not create_subscription :
When trying to edit a subscription, after saving permission is denied.

This is because permissions in serials/subscription-add.pl depends on arg 'op' and on edit this arg starts with 'modify' but changes to 'modsubscription' when saving.

Test plan :
- Create a user with staff access
- Define its permissions on serials : only edit_subscription
- Edit a subscription
- Click 'Next'
- Click 'Test prediction pattern'
- Click 'Save subscription'
=> Without patch you get to page serials/subscription-add.pl with permission denied
=> With patch subscription is saved and you get to subscription details page

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Jonathan Druart 2017-09-29 15:48:29 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin SOMERS 2017-10-17 07:59:01 UTC
Pushed to 17.05.x, will be in 17.05.05.
Comment 7 Katrin Fischer 2017-10-18 21:20:48 UTC
This patch has been pushed to 16.11.x and will be in 16.11.13.