Bug 34288 - Cannot use cataloguing tools without cataloguing permissions
Summary: Cannot use cataloguing tools without cataloguing permissions
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Martin Renvoize
URL:
Keywords:
Depends on: 31162
Blocks: 34790
  Show dependency treegraph
 
Reported: 2023-07-14 20:11 UTC by Tomás Cohen Arazi
Modified: 2023-09-14 12:22 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02,22.11.08


Attachments
Bug 34288: Add CAN_user_tools to Cataloging home link (1.51 KB, patch)
2023-07-17 08:52 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 34288: Allow access to the cataloguing module with `tools` permission (7.35 KB, patch)
2023-07-17 15:15 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 34288: (follow-up) Tidy block (6.84 KB, patch)
2023-07-17 15:15 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 34288: Unit tests (3.63 KB, patch)
2023-07-17 15:15 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 34288: Allow access to the cataloguing module with `tools` permission (7.39 KB, patch)
2023-07-17 16:01 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 34288: (follow-up) Tidy block (6.89 KB, patch)
2023-07-17 16:02 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 34288: Unit tests (3.69 KB, patch)
2023-07-17 16:02 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 34288: Allow access to the cataloguing module with `tools` permission (7.46 KB, patch)
2023-07-17 18:18 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 34288: (follow-up) Tidy block (6.96 KB, patch)
2023-07-17 18:18 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 34288: Unit tests (3.75 KB, patch)
2023-07-17 18:19 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2023-07-14 20:11:19 UTC
As a side effect of moving the `cataloguing tools` to the cataloguing section, there's no way for a patron with all `tools permissions` to use the cataloguing tools.

To reproduce:
1. Have a patron with only 'catalogue' and 'tools' permissions.
2. Log into the staff interface
=> FAIL: You cannot access the Cataloguing section, thus have no access to the cataloguing tools
3. Point your browser to:
http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/tools/batchMod.pl
http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/labels/label-home.pl
=> SUCCESS: You actually have permissions to access the tool
Comment 1 Martin Renvoize 2023-07-17 08:52:29 UTC
Created attachment 153527 [details] [review]
Bug 34288: Add CAN_user_tools to Cataloging home link

This patch adds the CAN_user_tools permissions check to the options
checked when infering whether to display the Catagloging module link on
the staff interface main page.
Comment 2 Tomás Cohen Arazi 2023-07-17 13:26:25 UTC
Marking as assigned, there are some edge cases I've already been working on. Writing the unit tests now.
Comment 3 Tomás Cohen Arazi 2023-07-17 15:15:39 UTC
Created attachment 153560 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D
Comment 4 Tomás Cohen Arazi 2023-07-17 15:15:42 UTC
Created attachment 153561 [details] [review]
Bug 34288: (follow-up) Tidy block
Comment 5 Tomás Cohen Arazi 2023-07-17 15:15:45 UTC
Created attachment 153562 [details] [review]
Bug 34288: Unit tests
Comment 6 Kyle M Hall 2023-07-17 16:01:55 UTC
Created attachment 153565 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Kyle M Hall 2023-07-17 16:02:02 UTC
Created attachment 153566 [details] [review]
Bug 34288: (follow-up) Tidy block

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 8 Kyle M Hall 2023-07-17 16:02:05 UTC
Created attachment 153567 [details] [review]
Bug 34288: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Martin Renvoize 2023-07-17 17:53:15 UTC
Looking at the fastadd cataloging side of this is making me wonder if the page permissions are still wrong for that case.. we show the link from the home page with `( fast_cataloging && CAN_user_editcatalogue_fast_cataloging )` but then inside the page itself we're looking for 'editcatalogue'
Comment 10 Martin Renvoize 2023-07-17 17:56:55 UTC
Ah.. my mistake.. I think `editcatalogue => '*'` covers it as a subpermission 'any' case
Comment 11 Martin Renvoize 2023-07-17 18:18:56 UTC
Created attachment 153571 [details] [review]
Bug 34288: Allow access to the cataloguing module with `tools` permission

Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 12 Martin Renvoize 2023-07-17 18:18:59 UTC
Created attachment 153572 [details] [review]
Bug 34288: (follow-up) Tidy block

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 13 Martin Renvoize 2023-07-17 18:19:02 UTC
Created attachment 153573 [details] [review]
Bug 34288: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 14 Martin Renvoize 2023-07-17 18:20:10 UTC
Thanks Tomas.. Passing QA
Comment 15 Tomás Cohen Arazi 2023-07-18 15:47:56 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 16 Christopher Brannon 2023-07-18 18:39:30 UTC
Please backport this to 22.11.  We can't live with this issue for a year.  :)
Comment 17 Tomás Cohen Arazi 2023-07-18 19:13:38 UTC
(In reply to Christopher Brannon from comment #16)
> Please backport this to 22.11.  We can't live with this issue for a year.  :)

:-P
Comment 18 Martin Renvoize 2023-07-19 07:32:59 UTC
Thanks for all the hard work!

Pushed to 23.05.x for the next release
Comment 19 Matt Blenkinsop 2023-07-19 10:15:38 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x
Comment 20 Christopher Brannon 2023-07-19 14:45:48 UTC
(In reply to Matt Blenkinsop from comment #19)
> Nice work everyone!
> 
> Pushed to oldstable for 22.11.x

Nice!
Comment 21 Christopher Brannon 2023-09-13 22:04:02 UTC
Hmmmm....I can still get to the spine label tools without having permission to them.  Is something still broken?  I'm on 22.11.8
Comment 22 Christopher Brannon 2023-09-13 22:04:42 UTC
(In reply to Christopher Brannon from comment #21)
> Hmmmm....I can still get to the spine label tools without having permission
> to them.  Is something still broken?  I'm on 22.11.8

FYI, if I just have a link to the spine label page, I get in and can use it.
Comment 23 Nick Clemens (kidclamp) 2023-09-14 12:21:53 UTC
(In reply to Christopher Brannon from comment #22)
> (In reply to Christopher Brannon from comment #21)
> > Hmmmm....I can still get to the spine label tools without having permission
> > to them.  Is something still broken?  I'm on 22.11.8
> 
> FYI, if I just have a link to the spine label page, I get in and can use it.

Filed bug 34288
Comment 24 Nick Clemens (kidclamp) 2023-09-14 12:22:18 UTC
(In reply to Nick Clemens from comment #23)
> (In reply to Christopher Brannon from comment #22)
> > (In reply to Christopher Brannon from comment #21)
> > > Hmmmm....I can still get to the spine label tools without having permission
> > > to them.  Is something still broken?  I'm on 22.11.8
> > 
> > FYI, if I just have a link to the spine label page, I get in and can use it.
> 
> Filed bug 34288

I mean bug 34790