Bug 6846 - Don't allow staff to change their own permissions
Summary: Don't allow staff to change their own permissions
Status: ASSIGNED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Meenakshi
QA Contact: Bugs List
URL:
Keywords:
: 6784 (view as bug list)
Depends on:
Blocks:
 
Reported: 2011-09-05 05:08 UTC by Savitra Sirohi
Modified: 2019-03-13 07:05 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Sending Improved Patch (2.43 KB, patch)
2012-06-04 06:26 UTC, Meenakshi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Savitra Sirohi 2011-09-05 05:08:13 UTC
Unless the staff is a superlibrarian, don't allow them to change their own permissions. 

This will prevent staff who have permission to set permissions, to assign themselves higher levels of permissions.
Comment 1 Savitra Sirohi 2011-09-05 05:27:37 UTC
*** Bug 6784 has been marked as a duplicate of this bug. ***
Comment 2 Meenakshi 2012-06-04 06:26:33 UTC Comment hidden (obsolete)
Comment 3 Meenakshi 2012-06-04 06:28:44 UTC
The Patch which I send was wrong Patch. Working on This Patch.
Comment 4 Marc Véron 2016-01-06 09:05:24 UTC
This seems to work on current master. 

To verify:

- Give a test user following permisson
    - borrowers Add, modify and view patron information
    - permissions Set user permissions 
- Log in as test user
- Search a user, change the permission -> possible
- Search test user, try to change the permission -> error page not allowed

Though, because the borrowers permission is needed, somebody could create a new patron and set there a higher level of permissions.
Comment 5 Katrin Fischer 2019-03-13 07:05:02 UTC
There is also the ProtectSuperlibrarianPrivileges system preference now, but I am not sure how to resolve the scenario Marc has pointed out. I think the only solution is to only give 'permissions' to users you trust.