Bug 39927 - Add permissions check to PatronSelfRegistrationAlert on home page
Summary: Add permissions check to PatronSelfRegistrationAlert on home page
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on: 35028
Blocks:
  Show dependency treegraph
 
Reported: 2025-05-16 17:01 UTC by Owen Leonard
Modified: 2025-05-31 20:39 UTC (History)
3 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement fixes the staff interface home page so that the "Self-registrations from" alert is only shown if the staff patron has the correct permissions. Before this, the alert was shown when the staff patron didn't have any borrower permissions.
Version(s) released in:
Circulation function:


Attachments
Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page (4.78 KB, patch)
2025-05-16 17:11 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 39927: (follow-up) Add permission check to display of page section (3.02 KB, patch)
2025-05-27 14:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page (4.82 KB, patch)
2025-05-31 20:18 UTC, David Nind
Details | Diff | Splinter Review
Bug 39927: (follow-up) Add permission check to display of page section (3.06 KB, patch)
2025-05-31 20:18 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2025-05-16 17:01:19 UTC
From Bug 35028:

(In reply to Katrin Fischer from comment #14)> 1) Permission check

> We don't have a permission check. I feel that could lead to the situation
> where a staff user tries to resolve, but is then faced with a permission
> error trying to access the patron page as they are not allowed to view
> patron accounts of this library.
Comment 1 Owen Leonard 2025-05-16 17:11:26 UTC
Created attachment 182547 [details] [review]
Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page

This patch adds a permissions check around the display of
PatronSelfRegistrationAlert information on the staff interface home
page.

To test, apply the patch and follow the test plan on Bug 35028:

1. Create patron category SELFREG
2. Enable PatronSelfRegistration and set
   PatronSelfRegistrationDefaultCategory to SELFREG and
   PatronSelfRegistrationAlert to "Show"
3. Go to OPAC, logout if needed, and create a new account. Remember the
   value you set for home library.
4. Go to staff interface, set the current library to the one you set in
   step 3.

Now view the staff interface home page as two different users:
- A user with either CAN_user_borrowers_edit_borrowers or
  CAN_user_borrowers_list_borrowers permission.
- A user with neither.
- The self-registration information should display or not depending on
  the user's permission.

Sponsored-by: Athens County Public Libraries
Comment 2 David Nind 2025-05-23 23:47:19 UTC
I've Failed QA.

The only difference I noted was that with no borrowers permission:
1. After the patch you don't see the the "Self-registrations from: XX" section on the home page (as expected).
2. However, there is a white section under the links to the modules with no text.

Note that you also get a 403: Forbidden error and "Processing" message with edit_borrowers permission, both before and after the patch. Possibly this should be on another bug (if it doesn't already exist)?

Testing notes (using KTD):
1. System prference set up:
   . Already enabled by default in KTD: PatronSelfRegistration and set PatronSelfRegistrationDefaultCategory to SELFREG
   . Need to set PatronSelfRegistrationAlert to "Show"
2. Used Henry Acevedo, Midway library, set up with permission: Staff access, allows viewing of catalogue in staff interface (catalogue).
3. Self-registration patron created - Centerville library
4. Permissions to experiment with:
   - Add, modify and view patron information (borrowers)
   - Add, modify and view patron information (edit_borrowers)
   - Search, list and view patrons (list_borrowers)
5. Before the patch:
  - With no borrowers permission: 
    . sees Self-registrations from: All libraries: 1
    . if you try to access, you get a log in screen with "Error: You do not have permission to access this page."
  - With borrowers permission: 
    . sees Self-registrations from: All libraries: 1
    . this lists all the borrowers in the self-registration category
    . can edit and delete borrowers listed
  - With edit_borrowers permission only: 
    . sees Self-registrations from: All libraries: 1
    . pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK"
    . table is shown, but sits with "Processing" shown.
  - With list_borrowers permission only: 
    . sees Self-registrations from: All libraries: 1
    . no patrons listed
    . the Library filter only shows Midway - can't select any other library
6. After the patch:
  - With no borrowers permission: 
    . Sees a white section under the links to the modules
  - With borrowers permission (same as before the patch): 
    . sees Self-registrations from: All libraries: 1
    . this lists all the borrowers in the seff-registration category
    . can edit and delete borrowers listed
  - With edit_borrowers permission only (same as before the patch): 
    . sees Self-registrations from: All libraries: 1
    . pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK"
    . table is shown, but sits with "Processing" shown.
  - With list_borrowers (same as before the patch): 
    . sees Self-registrations from: All libraries: 1
    . no patrons listed
    . the Library filter only shows Midway - can't select any other library
Comment 3 Owen Leonard 2025-05-27 14:38:04 UTC
Created attachment 182799 [details] [review]
Bug 39927: (follow-up) Add permission check to display of page section
Comment 4 David Nind 2025-05-31 20:18:57 UTC
Created attachment 182882 [details] [review]
Bug 39927: Add permissions check to PatronSelfRegistrationAlert on home page

This patch adds a permissions check around the display of
PatronSelfRegistrationAlert information on the staff interface home
page.

To test, apply the patch and follow the test plan on Bug 35028:

1. Create patron category SELFREG
2. Enable PatronSelfRegistration and set
   PatronSelfRegistrationDefaultCategory to SELFREG and
   PatronSelfRegistrationAlert to "Show"
3. Go to OPAC, logout if needed, and create a new account. Remember the
   value you set for home library.
4. Go to staff interface, set the current library to the one you set in
   step 3.

Now view the staff interface home page as two different users:
- A user with either CAN_user_borrowers_edit_borrowers or
  CAN_user_borrowers_list_borrowers permission.
- A user with neither.
- The self-registration information should display or not depending on
  the user's permission.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Comment 5 David Nind 2025-05-31 20:18:59 UTC
Created attachment 182883 [details] [review]
Bug 39927: (follow-up) Add permission check to display of page section

Signed-off-by: David Nind <david@davidnind.com>
Comment 6 David Nind 2025-05-31 20:39:01 UTC
Thanks Owen for the follow-up!

Updated testing notes:

1. After the patch and with no borrowers permissions, there is no empty white section under the links to the modules (as expected).

2. Both before and after the patch, if a staff patron has only the edit_borrowers permission: 
   - The staff patron sees "Self-registrations from: All libraries: 2 / Midway: 1" (I created two self-registrations - one for Centerville, one for Midway)
   - When you access the self-registrations page, you get a pop-up error message saying "Something went wrong when loading the table. 403: Forbiddden. OK"
   - The table to list self-registration patrons is shown, but has a "Processing" message shown, and no patrons listed.
   - This is the same as when you go to the patrons module, and search or browse for patrons.
   - In this case, you would need edit_borrowers and list_borrowers permissions for this to work correctly - that is, if you have edit_borrowers you also need list_borrowers. Otherwise, this would be another bug.