Bug 40115 - Extensive acquisition permissions needed to search vendors
Summary: Extensive acquisition permissions needed to search vendors
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: 25.05
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-11 09:27 UTC by Christian Nelson
Modified: 2025-06-16 16:18 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Nelson 2025-06-11 09:27:11 UTC
In the acquitions module (acqui-home.pl) when searching for vendors (eg. for receiving orders) the user gets the message "Something went wrong: Error: Authorization failure. Missing required permission(s)." and the page stays on loading forever. This happens unless the user has extensive acquisition permissions, such as managing budget plannings (planning_manage). It should be possible to perform routine acquitions tasks such as creating baskets and receiving orders without permissions to modify budgets.

Koha version: 25.05.00.000
Comment 1 Andrii Nugged 2025-06-16 16:18:28 UTC
The issue might be here:

api/v1/swagger/paths/acquisitions_vendors_config.yaml:36-38

    x-koha-authorization:
      permissions:
        acquisition: 1

If we compare with the pre-Vue version in acqui/vendors.pl:35:

        flagsrequired => { acquisition => '*' },

So the YAML should be:

        acquisition: "*"

to allow to GET /acquisitions/vendors/config if user has ANY of sub-parameters in "acquisition" permissions group.