Bug 34971 - Permission to close a serial subscription
Summary: Permission to close a serial subscription
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: 22.11
Hardware: All All
: P5 - low normal (vote)
Assignee: Baptiste Wojtkowski (bwoj)
QA Contact: Testopia
Depends on:
Reported: 2023-10-02 12:12 UTC by pierre.genty
Modified: 2024-07-04 01:03 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:

Bug 34971: Permission to close a serial subscription (edit) (1.89 KB, patch)
2024-07-03 15:29 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description pierre.genty 2023-10-02 12:12:05 UTC
With only receive_serials permission it is possible to close a serial subscription. This should require edit_subscription permission.
Comment 1 Baptiste Wojtkowski (bwoj) 2024-07-03 13:39:07 UTC
It looks like it has been corrected on main but I cannot figure out why
Comment 2 Baptiste Wojtkowski (bwoj) 2024-07-03 15:29:09 UTC
Created attachment 168461 [details] [review]
Bug 34971: Permission to close a serial subscription (edit)

TEST PLAN (for 22.11):
Before applying patch :
1 - log in as a user with only receive_serial right
2 - Select a serial
3 - Try to close it -> you can
4 - try to reopen the closed serial -> you can
5 - Make sure you have one opened and one closed serial

Apply patch
6 - Try to close a serial -> you cannot
7 - Try to reopen a closed serial -> you cannot
As a user that has the right delete_subscription:
8 - Try to delete the subscription -> you can (non regression test)

Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights.

Note : this should also be tested for superior version
Comment 3 David Nind 2024-07-04 01:03:27 UTC
Added assignee.