Bug 20632 - Staff users without superlibrarian can't log into OPAC
Summary: Staff users without superlibrarian can't log into OPAC
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
Depends on: 15492
  Show dependency treegraph
Reported: 2018-04-22 09:01 UTC by Katrin Fischer
Modified: 2018-12-03 20:03 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2018-04-22 09:01:50 UTC
Ok, I hope it's not me, but in case it isn't, this is a bad bug:

- Create or change your staff user to have all available permissions BUT superlibrarian
- Log out
- Log into staff - it works. Log out.
- Log into OPAC - it won't work. Not good at all.

This is bad for at least 2 reasons:
- Often staff accounts are used like normal patron accounts by staff.
- Because of permissions, sometimes the OPAC is the only place a staff user can change their password.

Tested on master after a reset_all.
Comment 1 Jonathan Druart 2018-04-23 13:57:53 UTC
Caused by bug 15492
Comment 2 Jonathan Druart 2018-04-23 14:00:27 UTC
It's not a bug actually, but we need to do something to avoid this configuration issue: the new permissions self_check must not be set for normal users, we may need to add a warning on the permission page.
Comment 3 Katrin Fischer 2018-04-24 05:32:19 UTC
Ok, I think adding a note to Self check modules permission could help here for now. At least then, staring on permissions will give you a hint :)

Maybe: Set only for self-check users, prevents OPAC login.

Comment 4 Jonathan Druart 2018-04-25 15:01:33 UTC
There is a note already:

" self_checkin_module Log into the self check-in module. Note: this permission prevents the patron from using any other OPAC functionality "

Comment 5 Katrin Fischer 2018-04-25 18:40:21 UTC
You are right, I missed it because i was looking at the top level permission with the others collapsed.
Comment 6 Jonathan Druart 2018-05-03 12:48:32 UTC
Maybe we should add a warning/message on the patron's defail page?
Comment 7 Tomás Cohen Arazi 2018-05-03 19:15:48 UTC
(In reply to Jonathan Druart from comment #6)
> Maybe we should add a warning/message on the patron's defail page?

I agree. We could add something noticeable that tells the patron situation. I'm not sure where to put it. Adding Owen to the conversation. Sorry Owen!