Bug 643 - Allow override of 'debarred' status
Summary: Allow override of 'debarred' status
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: PC All
: P2 enhancement (vote)
Assignee: paxed
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 35188 12914
  Show dependency treegraph
 
Reported: 2003-10-30 10:33 UTC by Owen Leonard
Modified: 2023-10-30 12:50 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
screenshot (33.24 KB, image/png)
2012-04-08 10:02 UTC, Katrin Fischer
Details
Add a button to temporarily override patron debarment. (6.22 KB, patch)
2014-05-23 05:03 UTC, paxed
Details | Diff | Splinter Review
Bug 643: Allow override of 'debarred' status (6.27 KB, patch)
2014-06-10 05:30 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 643: Allow override of 'debarred' status (6.40 KB, patch)
2014-08-11 19:36 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 643: Followup: Display override button only if issuing staff member has force_checkout permission (1.56 KB, patch)
2014-08-11 20:50 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 643: Allow override of 'debarred' status (6.45 KB, patch)
2014-08-12 04:43 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 643: Followup: Display override button only if issuing staff member has force_checkout permission (1.60 KB, patch)
2014-08-12 04:44 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 643: Followup: Encrypt param 'forceallow' to prevent unauthorized override (5.90 KB, patch)
2014-09-12 15:35 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 643: QA Followup - server-side verification of permissions (1.54 KB, patch)
2014-09-23 14:18 UTC, Mark Tompsett
Details | Diff | Splinter Review
[SIGNED OFF] Bug 643: Allow override of 'debarred' status (6.51 KB, patch)
2014-10-05 01:47 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
[SIGNED OFF] Bug 643: Followup: Display override button only if issuing staff member has force_checkout permission (1.68 KB, patch)
2014-10-05 01:47 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
[SIGNED OFF] Bug 643: QA Followup - server-side verification of permissions (1.61 KB, patch)
2014-10-05 01:47 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
[PASSED QA] Bug 643: Allow override of 'debarred' status (6.70 KB, patch)
2014-10-09 22:52 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 643: Followup: Display override button only if issuing staff member has force_checkout permission (1.73 KB, patch)
2014-10-09 22:52 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 643: QA Followup - server-side verification of permissions (1.65 KB, patch)
2014-10-09 22:52 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 643 [Template follow-up] Allow override of 'debarred' status (2.61 KB, patch)
2014-10-29 15:25 UTC, Owen Leonard
Details | Diff | Splinter Review
[PASSED QA] Bug 643 [Template follow-up] Allow override of 'debarred' status (2.69 KB, patch)
2014-10-29 21:48 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-20 23:33:34 UTC


---- Reported by oleonard@myacpl.org 2003-10-30 10:33:30 ----

Librarians should have the option of overriding the 'debarred' status of a
patron and issuing items during that session.  For instance: when the librarian
brings up a member's record and scans a book to check it out, a message appears
that says "Patron is Debarred.  Override? Y/N"



---- Additional Comments From paul.poulain@biblibre.com 2009-04-18 16:25:24 ----

should be easy using granular permissions, as we want some patrons to be able to override, and some not to be able.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-20 23:33 UTC  ---

This bug was previously known as _bug_ 643 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=643

Actual time not defined. Setting to 0.0
CC member arm@hanover.ca does not have an account here

Comment 1 Chris Cormack 2012-04-08 07:07:52 UTC
Is this still valid?
Comment 2 Katrin Fischer 2012-04-08 10:02:23 UTC
Created attachment 9010 [details]
screenshot

When a user is restricted, the checkout box is hidden. This is still valid, you can't check out to a restricted user without removing the restriction.
Comment 3 paxed 2014-05-23 05:03:12 UTC Comment hidden (obsolete)
Comment 4 Biblibre Sandboxes 2014-06-10 05:29:48 UTC
Patch tested with a sandbox, by Aleisha <aleishaamohia@hotmail.com>
Comment 5 Biblibre Sandboxes 2014-06-10 05:30:08 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2014-06-19 12:10:33 UTC
Bug 10863 introduced the lift_restriction permission.
I think this button/action should be only displayed/possible if the librarian has this permission.

Marked as Failed QA.
Comment 7 Marc Véron 2014-08-11 19:36:38 UTC Comment hidden (obsolete)
Comment 8 Marc Véron 2014-08-11 20:50:49 UTC Comment hidden (obsolete)
Comment 9 Biblibre Sandboxes 2014-08-12 04:43:31 UTC
Patch tested with a sandbox, by Aleisha <aleishaamohia@hotmail.com>
Comment 10 Biblibre Sandboxes 2014-08-12 04:43:59 UTC Comment hidden (obsolete)
Comment 11 Biblibre Sandboxes 2014-08-12 04:44:02 UTC Comment hidden (obsolete)
Comment 12 Jonathan Druart 2014-08-22 10:00:09 UTC
The second patch does not fix correctly the problem. If I set forceallow=1 in the url, I can checkout an item without the force_checkout_permission.

Marked as Failed QA.
Comment 13 Marc Véron 2014-09-12 15:35:02 UTC Comment hidden (obsolete)
Comment 14 Mark Tompsett 2014-09-23 12:19:00 UTC
Sorry, but this doesn't solve the problem raised in comment #12.

The issue is there is no equivalent CAN_user_force_checkout on the server-side, not whether someone can fake it or not. And also, even a lousy hacker can still read the randomish forceallow code from the page source and fake the url in this.
Comment 15 Jonathan Druart 2014-09-23 12:34:23 UTC
You can use C4::Auth::haspermission to check if the user has this permission.
Comment 16 Mark Tompsett 2014-09-23 14:18:48 UTC Comment hidden (obsolete)
Comment 17 Nick Clemens (kidclamp) 2014-10-05 01:47:00 UTC Comment hidden (obsolete)
Comment 18 Nick Clemens (kidclamp) 2014-10-05 01:47:16 UTC Comment hidden (obsolete)
Comment 19 Nick Clemens (kidclamp) 2014-10-05 01:47:31 UTC Comment hidden (obsolete)
Comment 20 Katrin Fischer 2014-10-09 22:52:00 UTC
Created attachment 32120 [details] [review]
[PASSED QA] Bug 643: Allow override of 'debarred' status

Add a button to temporarily override patron debarment.

To test:
1) Go to patron check out page
2) If patron has been debarred (eg. due to having fees),
   there is no way to check out to that patron.
3) Apply patch
4) A debarred patron check out page now has a button for
   "Override debarment temporarily" - clicking on it
   should allow checking out to that patron.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Rebased because patch did not apply

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested with/without force_checkout and superlibrarian permission.
Also checked crafting a URL is no longer working.
No regressions found.
Comment 21 Katrin Fischer 2014-10-09 22:52:14 UTC
Created attachment 32121 [details] [review]
[PASSED QA] Bug 643: Followup: Display override button only if issuing staff member has force_checkout permission

To test:
Apply first patch
Apply this patch
Log in as superlibrarian
Go to Home > Patrons > Set permissions for issuing staff member
Disable circulate - force_checkout
Log in as issuing staff member
Try to checkout to a debarred patron
=> should not be possible
Log in again as superlibrarian
Enable circulate - force_checkout for issuing staff member
Log in as issuing staff_member
Try to checkout to a debarred person
=> You should get the button 'Override debarment temporarily'

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 22 Katrin Fischer 2014-10-09 22:52:27 UTC
Created attachment 32122 [details] [review]
[PASSED QA] Bug 643: QA Followup - server-side verification of permissions

Only allow $force_allow=1 if the logged in user has permissions.

TEST PLAN
---------
Attempt to intentionally override the checkout by passing an
appropriately handcrafted URL.
-- Regardless of the force_allow value, it should be not allowed
   for those lacking the force_checkout permission.

NOTE: I didn't test this. I figured Marc Veron could do that. :)
      (Sorry, couldn't easily get git bz to work with the accent)

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 23 Owen Leonard 2014-10-29 15:25:28 UTC Comment hidden (obsolete)
Comment 24 Katrin Fischer 2014-10-29 21:48:32 UTC
Created attachment 32946 [details] [review]
[PASSED QA] Bug 643 [Template follow-up] Allow override of 'debarred' status

This minor followup makes two changes:

- Replaced instances of "Debarment" with "Restriction"
- Moved the override button into the block where the "View restrictions"
  button is, making the section slightly more compact.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Some small template changes, no problems found.
Comment 25 Tomás Cohen Arazi 2014-10-31 18:55:18 UTC
Patches pushed to master.

Thanks Pasi, Marc, Mark and Owen!