Bug 41777 - Allow patron import tool to overwrite passwords for "staff" category type when used by staff with appropriate permissions
Summary: Allow patron import tool to overwrite passwords for "staff" category type whe...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-05 17:15 UTC by Michael Adamyk
Modified: 2026-02-05 17:18 UTC (History)
0 users

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Adamyk 2026-02-05 17:15:50 UTC
Currently, staff users can change passwords or permissions for any other user if they have the "superlibrarian" (Access to all librarian functions) or "staffaccess" (Allow staff members to modify permissions, usernames, and passwords for other staff members) permission. 

However, the patron import tool blocks password changes to any patron categories using the "Staff" category type, regardless of the tool user's permission level. It would make sense for the tool to allow password changes to all accounts for at least superlibrarians, possibly also for "staffaccess" permissions. 

A use case would be a superlibrarian who "rotates" passwords on a regular basis for staff security.
Comment 1 Michael Adamyk 2026-02-05 17:17:05 UTC
However... this has broad security implications for accidentally locking out all staff at once. And with the ability to enforce password expiration and complex passwords through patron categories, this may be a feature that is unnecessary in the patron import tool. 

Because of this, I suggest  it be discussed by the community before action is taken.
Comment 2 Michael Adamyk 2026-02-05 17:18:09 UTC
See Bug 41776 for the documentation need of how patron import currently handles staff passwords.