Bug 34971 - Permission to close a serial subscription
Summary: Permission to close a serial subscription
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Baptiste Wojtkowski (bwoj)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-02 12:12 UTC by pierre.genty
Modified: 2025-01-01 03:25 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the serials receiving (receive_serials) permission - staff that only have this permission can now only receive serials, and can no longer (incorrectly) close a subscription. Previously, the "Close" action was incorrectly shown on the subscription details page and this allowed staff to close (but not reopen) a subscription (Serials > Search > [select a serial from the results] > Subscriptions detail page for a serial).
Version(s) released in:
Circulation function:

Attachments
Bug 34971: Permission to close a serial subscription (edit) (1.89 KB, patch)
2024-07-03 15:29 UTC, Baptiste Wojtkowski (bwoj) 		Details | Diff | Splinter Review
Screenshots - Close serials permissions (613.36 KB, application/pdf)
2024-12-30 01:42 UTC, David Nind 		Details
Bug 34971: Fix reopen button display on serial-collection (2.47 KB, patch)
2024-12-30 14:32 UTC, Baptiste Wojtkowski (bwoj) 		Details | Diff | Splinter Review
Bug 34971: Fix permission to close a serial subscription (edit) (3.35 KB, patch)
2024-12-30 14:32 UTC, Baptiste Wojtkowski (bwoj) 		Details | Diff | Splinter Review
Bug 34971: Fix reopen button display on serial-collection (2.52 KB, patch)
2025-01-01 02:43 UTC, David Nind 		Details | Diff | Splinter Review
Bug 34971: Fix permission to close a serial subscription (edit) (3.41 KB, patch)
2025-01-01 02:43 UTC, David Nind 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description pierre.genty 2023-10-02 12:12:05 UTC 
Hi, 
With only receive_serials permission it is possible to close a serial subscription. This should require edit_subscription permission.
Comment 1 Baptiste Wojtkowski (bwoj) 2024-07-03 13:39:07 UTC 
It looks like it has been corrected on main but I cannot figure out why
Comment 2 Baptiste Wojtkowski (bwoj) 2024-07-03 15:29:09 UTC 
Created attachment 168461 [details] [review]
Bug 34971: Permission to close a serial subscription (edit)

TEST PLAN (for 22.11):
Before applying patch :
1 - log in as a user with only receive_serial right
2 - Select a serial
3 - Try to close it -> you can
4 - try to reopen the closed serial -> you can
5 - Make sure you have one opened and one closed serial

Apply patch
6 - Try to close a serial -> you cannot
7 - Try to reopen a closed serial -> you cannot
As a user that has the right delete_subscription:
8 - Try to delete the subscription -> you can (non regression test)

Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights.

Note : this should also be tested for superior version
Comment 3 David Nind 2024-07-04 01:03:27 UTC 
Added assignee.
Comment 4 David Nind 2024-12-30 01:42:09 UTC 
Created attachment 175972 [details]
Screenshots - Close serials permissions

I had a go at testing (using koha-testing-docker) on 22.11.22 and on main.

What I found:
1. On 22.11.22:
   - there is a "Close" button only on the serial collection page
   - you can close a serial
   - I couldn't get the patch to apply on 22.11.22 (I got a weird error 
     I've never seen before), so I couldn't test the patch
2. On main:
   - same as 22.11.22, there is "Close" button only on the serial
     collection page
   - you can close a serial
   - after the patch (which applies on main), the "Close" button is still there 
     on the serial collection page
   - if you click "Close" you get the login screen with "Error: You do not have
     permission to access this page.”

I've attached a document with screenshots, hopefully that will make it easier to see what I saw.

I've changed to Failed QA, as:
- It isn't fixed on main.
- I think the "Close" button shouldn't be there on the serial collection page if you don't have the correct permissions.
- As an aside, I don't think the "Manage frequencies" and "Manage numbering patterns" menu items should be shown if the staff patron doesn't have the correct permissions (this should probably be another bug).
Comment 5 Baptiste Wojtkowski (bwoj) 2024-12-30 14:32:29 UTC 
Created attachment 175997 [details] [review]
Bug 34971: Fix reopen button display on serial-collection

Patch 1 - (this one) When a user is on serial collection information, the subscription is
not passed to the template, and therefore not passed to serials-toolbar.inc.
This makes sense if collection information is called with a biblionumber
but not if collection information is called with a subscription id.
Consequently, subscription.closed is always false and it is not possible
to reopen a basket.

Patch 2 - User with incorrect permission can close serials, they just
need to access to the page. This is due to serials-toolbar.inc expecting
a variable named "cannotedit", which is provided by
"subscription-details.pl" and not by "serials-collection.pl"

TEST PLAN:
Before applying patches :
1 - log in as a user with only receive_serial permission
2 - Open two pages one on
  /serials-collection.pl?subscriptionid=ID_A, another on
  /serials-collection.pl?subscriptionid=ID_B
3 - On serial A's collection page, check you can close the serial (wrong
  behaviour), note you can close it again but not reopen it
4 - Apply first patch
5 - Check you can reopen the serial (wrong behaviour) keep the page open
6 - On serial B's collection page, close the serial, keep the page open
7 - Apply second patch
8 - On page left open on 3 -, click on close, you are redirected to a
  login page.
8 - Go back to serial A's collection page -> there is no close button
  anymore
9 - On page left open on 4 -, click on reopen, you are redirected to a
  login page
10 - Go back to serial B's collection page -> there is no close button
  anymore
Comment 6 Baptiste Wojtkowski (bwoj) 2024-12-30 14:32:32 UTC 
Created attachment 175998 [details] [review]
Bug 34971: Fix permission to close a serial subscription (edit)

Note: there is a minor bug I had to correct, I don't split into two
patches since it is very minor and necessary to test that one.

Patch 1 - (this one) When a user is on serial collection information, the subscription is
not passed to the template, and therefore not passed to serials-toolbar.inc.
This makes sense if collection information is called with a biblionumber
but not if collection information is called with a subscription id.
Consequently, subscription.closed is always false and it is not possible
to reopen a basket.

Patch 2 - User with incorrect permission can close serials, they just
need to access to the page. This is due to serials-toolbar.inc expecting
a variable named "cannotedit", which is provided by
"subscription-details.pl" and not by "serials-collection.pl"

TEST PLAN:
Before applying patches :
1 - log in as a user with only receive_serial permission
2 - Open two pages one on
  /serials-collection.pl?subscriptionid=ID_A, another on
  /serials-collection.pl?subscriptionid=ID_B
3 - On serial A's collection page, check you can close the serial (wrong
  behaviour), note you can close it again but not reopen it
4 - Apply first patch
5 - Check you can reopen the serial (wrong behaviour) keep the page open
6 - On serial B's collection page, close the serial, keep the page open
7 - Apply second patch
8 - On page left open on 3 -, click on close, you are redirected to a
  login page.
8 - Go back to serial A's collection page -> there is no close button
  anymore
9 - On page left open on 4 -, click on reopen, you are redirected to a
  login page
10 - Go back to serial B's collection page -> there is no close button
  anymore
Comment 7 Baptiste Wojtkowski (bwoj) 2024-12-30 14:33:40 UTC 
Note: No patch for 22.11 anymore since I could reproduce and test on main
Comment 8 David Nind 2025-01-01 02:43:52 UTC 
Created attachment 176040 [details] [review]
Bug 34971: Fix reopen button display on serial-collection

Patch 1 - (this one) When a user is on serial collection information, the subscription is
not passed to the template, and therefore not passed to serials-toolbar.inc.
This makes sense if collection information is called with a biblionumber
but not if collection information is called with a subscription id.
Consequently, subscription.closed is always false and it is not possible
to reopen a basket.

Patch 2 - User with incorrect permission can close serials, they just
need to access to the page. This is due to serials-toolbar.inc expecting
a variable named "cannotedit", which is provided by
"subscription-details.pl" and not by "serials-collection.pl"

TEST PLAN:
Before applying patches :
1 - log in as a user with only receive_serial permission
2 - Open two pages one on
  /serials-collection.pl?subscriptionid=ID_A, another on
  /serials-collection.pl?subscriptionid=ID_B
3 - On serial A's collection page, check you can close the serial (wrong
  behaviour), note you can close it again but not reopen it
4 - Apply first patch
5 - Check you can reopen the serial (wrong behaviour) keep the page open
6 - On serial B's collection page, close the serial, keep the page open
7 - Apply second patch
8 - On page left open on 3 -, click on close, you are redirected to a
  login page.
8 - Go back to serial A's collection page -> there is no close button
  anymore
9 - On page left open on 4 -, click on reopen, you are redirected to a
  login page
10 - Go back to serial B's collection page -> there is no close button
  anymore

Signed-off-by: David Nind <david@davidnind.com>
Comment 9 David Nind 2025-01-01 02:43:55 UTC 
Created attachment 176041 [details] [review]
Bug 34971: Fix permission to close a serial subscription (edit)

Note: there is a minor bug I had to correct, I don't split into two
patches since it is very minor and necessary to test that one.

Patch 1 - (this one) When a user is on serial collection information, the subscription is
not passed to the template, and therefore not passed to serials-toolbar.inc.
This makes sense if collection information is called with a biblionumber
but not if collection information is called with a subscription id.
Consequently, subscription.closed is always false and it is not possible
to reopen a basket.

Patch 2 - User with incorrect permission can close serials, they just
need to access to the page. This is due to serials-toolbar.inc expecting
a variable named "cannotedit", which is provided by
"subscription-details.pl" and not by "serials-collection.pl"

TEST PLAN:
Before applying patches :
1 - log in as a user with only receive_serial permission
2 - Open two pages one on
  /serials-collection.pl?subscriptionid=ID_A, another on
  /serials-collection.pl?subscriptionid=ID_B
3 - On serial A's collection page, check you can close the serial (wrong
  behaviour), note you can close it again but not reopen it
4 - Apply first patch
5 - Check you can reopen the serial (wrong behaviour) keep the page open
6 - On serial B's collection page, close the serial, keep the page open
7 - Apply second patch
8 - On page left open on 3 -, click on close, you are redirected to a
  login page.
8 - Go back to serial A's collection page -> there is no close button
  anymore
9 - On page left open on 4 -, click on reopen, you are redirected to a
  login page
10 - Go back to serial B's collection page -> there is no close button
  anymore

Signed-off-by: David Nind <david@davidnind.com>