Bug 37685 - Adding a new subpermission to a permission category grants new features to all staff with a top level permission
Summary: Adding a new subpermission to a permission category grants new features to al...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 29393
Blocks:
  Show dependency tree / graph
 
Reported: 2024-08-20 12:06 UTC by Nick Clemens (kidclamp)
Modified: 2024-08-28 18:19 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-08-20 12:06:17 UTC 
On bug 29393 there was a new subpermission added to the borrowers permission: "send_messages_to_borrowers"

This meant that all staff who were previously able to add/update/delete patrons could now also send them messages with any content. We have received complaints from libraries who do not wish all staff to have had this new permission added. Messaging and borrower CRUD are not necessarily related.

This points to a larger problem with our permissions, but I think in terms of updates/upgrades it is worth having the conversation of how we should go about adding new permissions/subpermissions and granting access to new features.