Bug 5986 - Inconsistent handling of patron deletion permission
Summary: Inconsistent handling of patron deletion permission
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Kyle M Hall
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks: 6261
  Show dependency treegraph
 
Reported: 2011-03-29 12:28 UTC by Owen Leonard
Modified: 2015-12-03 22:00 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2011-03-29 12:28:26 UTC
In some places the permission to delete patrons is governed by whether or not the user has the "borrowers" permission set: "Add or modify borrowers." In moremember.pl there is a different check governed by a "candeleteuser" variable (line 386):

my $candeleteuser;
my $userenv = C4::Context->userenv;
if($userenv->{flags} % 2 == 1){
    $candeleteuser = 1;
}elsif ( C4::Context->preference("IndependantBranches") ) {
    $candeleteuser = ( $data->{'branchcode'} eq $userenv->{branch} );
}else{
    if( C4::Auth::getuserflags( $userenv->{flags},$userenv->{number})->{borrowers} ) {
        $candeleteuser = 1;
    }else{
        $candeleteuser = 0;
    }
}

This means that a user viewing a patron record on moremember.pl might have different delete permissions than the same user viewing a patron record in circulation or another patron-related page. A user prevented from deleting by moremember.pl could switch to another page and delete from there.
Comment 1 Liz Rea 2013-07-02 07:18:24 UTC
This bug still exists in master.
Comment 2 Jonathan Druart 2015-03-24 09:58:58 UTC
This is now fixed, the code is not used anymore.
I have submitted a patch on bug 13898 to remove it.