Bug 35800 - edit_any_item permission required to see patron name in detail page
Summary: edit_any_item permission required to see patron name in detail page
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Lucas Gass
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 33167
Blocks:
  Show dependency treegraph
 
Reported: 2024-01-12 21:58 UTC by Caroline Cyr La Rose
Modified: 2024-03-20 18:02 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.10


Attachments
Bug 35800: Remove item.can.be.edited check (2.79 KB, patch)
2024-01-23 17:58 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 35800: Remove item.can.be.edited check (2.86 KB, patch)
2024-01-23 19:50 UTC, Caroline Cyr La Rose
Details | Diff | Splinter Review
Bug 35800: Remove item.can.be.edited check (2.95 KB, patch)
2024-01-26 11:00 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Caroline Cyr La Rose 2024-01-12 21:58:35 UTC
A staff member with limited permissions (mostly circulation-related) cannot see the name of the patron who has checked out an item from the detail page, if the patron is from another library, even if the staff member has view_borrower_infos_from_any_libraries.

To recreate:
1. Check out an item to a patron from library A
2. Give permissions to a patron from library B
   (example of a circulation staff account)
     - circulate
     - catalogue
     - borrowers
     - reserveforothers
     - updatecharges
     - suggestions
     - lists
     - clubs -> enroll
3. If necessary, change the username and password of that staff member in order to be able to log in
4. In a private browser window, log in as the staff member
5. View the record with the checked out item

--> Notice that it only says "Checked out" without any patron name

6. Back in the normal browser, give the additional permission "edit_any_item" to the staff member
7. Refresh the page in the private window (Ctrl+F5)

--> Notice the name of the patron now appears

I don't think not having the option to edit items from any library should impact the visibility of patron information. This should be managed by view_borrower_infos_from_any_libraries.

With git bisect, I found that it was related to bug 33167, although I don't understand what happened...
Comment 1 Donna 2024-01-23 17:44:30 UTC
Caroline is absolutely correct - edit_any_item should not prevent staff from being able to see who has the item checked out, it should depend on view_borrower_infos_from_any_libraries
Comment 2 Lucas Gass 2024-01-23 17:52:19 UTC
Im not sure why there is a check for [% IF item.can_be_edited %] before displaying the patron name. That seems to be what is wrong here. Removing this check will make this work properly and honor 'view_borrower_infos_from_any_libraries' instead of 'edit_any_items'.
Comment 3 Lucas Gass 2024-01-23 17:58:46 UTC
Created attachment 161313 [details] [review]
Bug 35800: Remove item.can.be.edited check

To test:
APPLY PATCH
1. Check out an item to a patron from library A
2. Give permissions to a patron from library B
   (example of a circulation staff account)
     - circulate
     - catalogue
     - borrowers ( including view_borrower_infos_from_any_libraries )
     - reserveforothers
     - updatecharges
     - suggestions
     - lists
     - clubs -> enroll
3. If necessary, change the username and password of that staff member in order to be able to log in
4. In a private browser window, log in as the staff member
5. View the record with the checked out item
6. You should see the name/cardnumber of the patron the item is checked out ot.
7. Turn off the view_borrower_infos_from_any_libraries for this patron.
8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`.
Comment 4 Caroline Cyr La Rose 2024-01-23 19:50:44 UTC
Created attachment 161316 [details] [review]
Bug 35800: Remove item.can.be.edited check

To test:
APPLY PATCH
1. Check out an item to a patron from library A
2. Give permissions to a patron from library B
   (example of a circulation staff account)
     - circulate
     - catalogue
     - borrowers ( including view_borrower_infos_from_any_libraries )
     - reserveforothers
     - updatecharges
     - suggestions
     - lists
     - clubs -> enroll
3. If necessary, change the username and password of that staff member in order to be able to log in
4. In a private browser window, log in as the staff member
5. View the record with the checked out item
6. You should see the name/cardnumber of the patron the item is checked out ot.
7. Turn off the view_borrower_infos_from_any_libraries for this patron.
8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`.

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 5 Caroline Cyr La Rose 2024-01-23 19:51:19 UTC
Thanks Lucas!
Comment 6 Marcel de Rooy 2024-01-26 11:00:24 UTC
Created attachment 161508 [details] [review]
Bug 35800: Remove item.can.be.edited check

To test:
APPLY PATCH
1. Check out an item to a patron from library A
2. Give permissions to a patron from library B
   (example of a circulation staff account)
     - circulate
     - catalogue
     - borrowers ( including view_borrower_infos_from_any_libraries )
     - reserveforothers
     - updatecharges
     - suggestions
     - lists
     - clubs -> enroll
3. If necessary, change the username and password of that staff member in order to be able to log in
4. In a private browser window, log in as the staff member
5. View the record with the checked out item
6. You should see the name/cardnumber of the patron the item is checked out ot.
7. Turn off the view_borrower_infos_from_any_libraries for this patron.
8. Now on the record detail page you should see text like `Checked out to A patron from library Midway : due 01/28/2024`.

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Marcel de Rooy 2024-01-26 11:00:37 UTC
Bug fix ?
Comment 8 Caroline Cyr La Rose 2024-01-26 14:08:38 UTC
(In reply to Marcel de Rooy from comment #7)
> Bug fix ?

You're right. I changed the "importance" to minor instead of enhancement.
Comment 9 Caroline Cyr La Rose 2024-01-26 14:10:18 UTC
I noticed this in 23.05 btw. So if it could be backported, it would be great! Thanks! :)
Comment 10 Katrin Fischer 2024-01-29 11:29:20 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 11 Fridolin Somers 2024-02-01 14:39:24 UTC
Pushed to 23.11.x for 23.11.03
Comment 12 Elise Konya 2024-03-20 17:11:00 UTC
Seconding Caroline's request! Could this be backported to 23.05?
Comment 13 Lucas Gass 2024-03-20 18:02:36 UTC
Backported to 23.05.x for upcoming 23.05.10