Bug 22617 - Checkout notes pending dashboard link - error received even though manage_checkout_notes permission set
Summary: Checkout notes pending dashboard link - error received even though manage_che...
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Fridolin SOMERS
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-01 16:37 UTC by Lucy Vaux-Harvey
Modified: 2019-08-14 17:24 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
This fixes an error that occurs when an account with full circulate permissions (but not super librarian permissions) clicks on 'Checkout notes pending' and is then automatically logged out with the message "Error: you do not have permission to view this page. Log in as a different user".
Version(s) released in:
19.11.00,19.05.02


Attachments
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage (1.68 KB, patch)
2019-06-14 08:48 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage (1.73 KB, patch)
2019-06-18 00:57 UTC, M. Tompsett
Details | Diff | Splinter Review
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage (1.78 KB, patch)
2019-06-21 11:19 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lucy Vaux-Harvey 2019-04-01 16:37:00 UTC
When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the ‘Checkout notes pending’ link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.
Comment 1 Fridolin SOMERS 2019-06-14 08:28:40 UTC
I'm on it.
Comment 2 Fridolin SOMERS 2019-06-14 08:48:53 UTC
Created attachment 90589 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access
Comment 3 M. Tompsett 2019-06-18 00:56:35 UTC
It is quite annoying to not be able to get to circulation home. You need circulate_remaining_permissions to get to the circulation home. However, I was able to cut-and-paste the checkout notes URL and confirm this patch does get the person into the page. So for that specific problem it does work. As such, I'm going to sign off.
Comment 4 M. Tompsett 2019-06-18 00:57:29 UTC
Created attachment 90711 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 5 M. Tompsett 2019-06-18 00:58:45 UTC
Comment on attachment 90711 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

Review of attachment 90711 [details] [review]:
-----------------------------------------------------------------

::: circ/checkout-notes.pl
@@ +33,4 @@
>          query           => $query,
>          type            => "intranet",
>          authnotrequired => 0,
> +        flagsrequired   => { circulate => "manage_checkout_notes" },

Nice catch on this typo, as:
   $ git grep "circulation ="
gives nothing, but
   $ git grep "circulate ="
shows that this is what it should be.
Comment 6 Nick Clemens 2019-06-21 11:19:44 UTC
Created attachment 90895 [details] [review]
Bug 22617: Fix checkout notes typo in manage_checkout_notes permission usage

When logged into the staff client with an account with full circulate permissions (and therefore including the manage_checkout_notes permission) an error occurs when clicking on the Checkout notes pending link.  The account is logged out automatically with the message:  "Error: you do not have permission to view this page.  Log in as a different user".
The same error occurs for both the link on the home page dashboard and from the Circulation module button.  Works as expected if Superlibrarian permission is set.

This is just a typo in perl script : circulation instead of circulate

Test plan :
1) Set preference "AllowCheckoutNotes" to "Allow"
2) Create a user with only permissions "catalogue" and "circulate > manage_checkout_notes"
3) Loggin with this user
4) Go to "Circulation" home page
5) Click on "Checkout notes"
6) You should be allowed to access

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Martin Renvoize 2019-06-21 12:13:49 UTC
Nice work!

Pushed to master for 19.11.00
Comment 8 Fridolin SOMERS 2019-07-16 06:38:45 UTC
Pushed to 19.05.x for 19.05.02
Comment 9 Lucas Gass 2019-08-14 17:24:44 UTC
backported to 18.11.x for 18.11.09