Bug 27811 - Manage patrons fines and fees (updatecharges) subpermissions shows links/buttons that cannot be accessed
Summary: Manage patrons fines and fees (updatecharges) subpermissions shows links/but...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Fines and fees (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-26 17:16 UTC by Nick Clemens
Modified: 2021-05-25 13:56 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.06,20.05.12


Attachments
Bug 27811: Hide payment buttons if not enough permission (2.09 KB, patch)
2021-04-22 12:25 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 27811: Hide the Accounting tab if needed (1.33 KB, patch)
2021-04-22 12:25 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 27811: Hide payment buttons if not enough permission (2.15 KB, patch)
2021-04-29 10:27 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 27811: Hide the Accounting tab if needed (1.39 KB, patch)
2021-04-29 10:27 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2021-02-26 17:16:47 UTC
pay.pl requires 'remaining_permissions' but links to pay.pl show in a patrons account if you have any of the other subpermissions.
 
To recreate:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
5 - You see the accounting tab and option to pay fines
6 - Clicking on those lead to a log in screen
Comment 1 Jonathan Druart 2021-04-22 12:25:48 UTC
Created attachment 120002 [details] [review]
Bug 27811: Hide payment buttons if not enough permission

If the logged in librarian does not have the updatecharges >
remaining_permissions subpermission, we should hide the 2 "Make payment"
and "Pay all fines" button from the patron detail/circ page.

Test plan:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
=> The two buttons are not displayed
Comment 2 Jonathan Druart 2021-04-22 12:25:53 UTC
Created attachment 120003 [details] [review]
Bug 27811: Hide the Accounting tab if needed

Same as the previous patch for the "Accounting" tab of the circulation
module.
Comment 3 Nick Clemens 2021-04-29 10:27:28 UTC
Created attachment 120303 [details] [review]
Bug 27811: Hide payment buttons if not enough permission

If the logged in librarian does not have the updatecharges >
remaining_permissions subpermission, we should hide the 2 "Make payment"
and "Pay all fines" button from the patron detail/circ page.

Test plan:
1 - Grant an account circulation/staffaccess permissions and any subpermissions in updatechagres but NOT 'remaining_permissions'
2 - Add some charges to a patron account
3 - Sign in with the account created in #1
4 - Bring up the patron you added charges to
=> The two buttons are not displayed

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Nick Clemens 2021-04-29 10:27:32 UTC
Created attachment 120304 [details] [review]
Bug 27811: Hide the Accounting tab if needed

Same as the previous patch for the "Accounting" tab of the circulation
module.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Nick Clemens 2021-04-29 10:27:54 UTC
Trivial fix, passing QA
Comment 6 Jonathan Druart 2021-04-30 15:17:41 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Fridolin Somers 2021-05-05 13:54:44 UTC
Pushed to 20.11.x for 20.11.06
Comment 8 Andrew Fuerste-Henry 2021-05-25 11:08:49 UTC
Pushed to 20.05.x for 20.05.12
Comment 9 Victor Grousset/tuxayo 2021-05-25 13:56:55 UTC
Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed.