Bug 36061 - With IndependentBranches on a non-superlibrarian cannot modify password
Summary: With IndependentBranches on a non-superlibrarian cannot modify password
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-09 20:02 UTC by Marie-Luce Laflamme
Modified: 2024-04-04 18:54 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marie-Luce Laflamme 2024-02-09 20:02:50 UTC
When the IndependentBranches system preference is turned on, non-superlibrarian staff without the 'view_borrower_infos_from_any_libraries' permission cannot change the patron's passwords, even if those patrons are from the same library. With the current behaviour, it's impossible to reset passwords from the intranet if your library doesn't have a staff member with superlibrarian powers.

There are other bugs on similar topic, see: bug 12793 and bug 12599.
Comment 1 Marie-Luce Laflamme 2024-02-09 20:04:27 UTC
to test...

Set-up

- Ensure that the IndependentBranches system preference is turned on.
- Add a new staff account with limited permissions to access the intranet
  minimum permissions required:
  - all (circulate)
  - access to staff interface (catalogue)
  - In borrowers, select only:
      - delete_borrowers
      - edit_borrowers
     --> do not check view_borrower_infos_from_any_libraries
  - all reserveforothers

Test plan

1. Log in to the intranet using the newly created non-superlibrarian account.
2. Find a patron account from the same library as the logged-in staff account.
3. Click on "Modify password"
--> Koha prevents this action and displays the message: "You do not have permission to edit this patron's login information."
Comment 2 Marie-Luce Laflamme 2024-04-04 14:22:04 UTC
It has recently come to my attention that there are certain scenarios I failed to consider during my testing of independentbranches and non-superlibrarian staff permissions. It turns out that you can change a "regular" patron password, but you can't do the same for another staff member when the permission "view_borrower_infos_from_any_libraries" is not granted.

While this restriction may seem justified, it prompts the question: Should we think about adding a way for a library manager, who doesn't have superlibrarian powers but oversee staff actions, to change their staff members' passwords?
Comment 3 Katrin Fischer 2024-04-04 18:54:06 UTC
I thought staffaccess permission would allow this. Have you tested?