Bug 7602 - Spent and Ordered pages require full acquisition permissions
Summary: Spent and Ordered pages require full acquisition permissions
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: 3.8
Hardware: All All
: P5 - low normal (vote)
Assignee: Katrin Fischer
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 929
  Show dependency treegraph
 
Reported: 2012-02-26 06:10 UTC by Katrin Fischer
Modified: 2015-12-03 22:00 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 7602: Spent and ordered pages require full acquisition permissions (1.46 KB, patch)
2012-02-26 06:13 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 7602: Spent and ordered pages require full acquisition permissions (1.65 KB, patch)
2012-02-26 21:19 UTC, Nicole C. Engard
Details | Diff | Splinter Review
Bug 7602: Followup: Spent and ordered pages require full acquisition permissions (1.46 KB, patch)
2012-03-02 10:52 UTC, Jonathan Druart
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 7602: Followup: Spent and ordered pages require full acquisition permissions (1.52 KB, patch)
2012-03-06 07:33 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2012-02-26 06:10:05 UTC
The spent and ordered pages linked from the funds table on acquisition home page require full (all) acquisition rights.

Patch will change the required permission, so that one permission in acquisition will be enough to access the pages.
Comment 1 Katrin Fischer 2012-02-26 06:13:43 UTC Comment hidden (obsolete)
Comment 2 Nicole C. Engard 2012-02-26 21:19:59 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2012-03-01 14:51:45 UTC
QA Comment: The proposed patch works as expected. But on the ordered.pl page, there is a link to neworderempty.pl. This one is strictly accessible if you have the order_manage permission. 

Shouldn't the permission be order_manage for these 2 pages ?
Comment 4 Katrin Fischer 2012-03-01 14:58:45 UTC
Hi Jonathan,
that's a good question. I figured that it would not hurt to make it accessible to users with 1 acq permission, because it's only a report. You can't change order or budget information from that page. As an enhancement the links could be hidden, if you lack the proper permission (order_manage). I am not sure how others think about this - perhaps we can do a quick poll?
Comment 5 Nicole C. Engard 2012-03-01 17:11:28 UTC
I'm with Katrin, I think that it could be enhanced, but I'm not sure it should hold this patch back.
Comment 6 Katrin Fischer 2012-03-02 08:26:54 UTC
Hi Jonathan, 

I looked at the permission table again, because I wanted to change to your suggestion. But I am not sure order_manage is the way to go. There are lots of reasons why this information could be important for people with other acq permissions:

- order_receive - find out what has not been delivered yet
- budget_* - checking what the money is being spent for
- order_manage - ...
- ...

I wonder if someone without any of these permissions will have access to acquisitions at all?
Comment 7 Jonathan Druart 2012-03-02 10:52:37 UTC Comment hidden (obsolete)
Comment 8 Katrin Fischer 2012-03-06 07:32:04 UTC
I think it's a good thing - but we should change the spent page to take permissions into account too. There is a link to the receive page that should depend on the right permission.
Comment 9 Katrin Fischer 2012-03-06 07:33:31 UTC Comment hidden (obsolete)
Comment 10 Ian Walls 2012-03-12 10:16:37 UTC
First patch:  simple change to permissions.  Passed QA

Second patch:  adds conditional to template to links only show if they're relevant to the user.  Passed QA.
Comment 11 Katrin Fischer 2012-03-17 16:09:53 UTC
Patch for "spent" still missing, so obsoleting patches and changing status to reflect that.
Comment 12 Katrin Fischer 2015-01-06 13:55:18 UTC
We could be more strict like only showing the link to the invoice if the user has the corresponding permission, but I will move this idea to a separate bug.
Comment 13 Katrin Fischer 2015-01-06 14:06:12 UTC
After looking at the pages:
The only links on the ordered page are to the vendor and to the invoice page - both are accessible with * (any acq permission). So I think there are no more changes needed.