Bug 7648 - staff can make themselves superlibrarians
Summary: staff can make themselves superlibrarians
Status: RESOLVED DUPLICATE of bug 20100
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Kyle M Hall
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-06 03:16 UTC by Nicole C. Engard
Modified: 2018-05-16 23:30 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nicole C. Engard 2012-03-06 03:16:55 UTC
This seems like an oversight to me, but if you give a staff patron the ability to set permissions for other staff members they can then update their own permissions and make themselves superlibrarians.  I would say that only superlibrarians can make other staff superlibrarians, and I'd go even further to say that only superlibrarians should be able to change their own permissions - but I think this is probably due for some discussion either way because it's a pretty big oversight.
Comment 1 Chris Cormack 2012-03-06 07:12:24 UTC
I don't think it's an oversight, if you trust people enough to let them set staff permissions for others, including making others super librarians. I think it's fair to trust them to not act unethically with their own permissions.

If you can't trust them to not escalate their own permissions, there is no way you should give them permission to change others.

Maybe just fire people who act unethically.
Comment 2 Nicole C. Engard 2012-03-11 19:46:17 UTC
I would say that giving superlibrarian permissions needs to be another permission.  If you're in a consortium you have to let someone at each branch set permissions for their staff, but you don't want them going in and changing the system preferences, and if they can assign superlibrarian permissions then they can access the system preferences.

And no matter how many times I tell people to fire those in their libraries who don't follow the rules they won't.  Instead they'd like more protection on the system.

Nicole
Comment 3 Chris Cormack 2012-03-11 21:45:17 UTC
(In reply to comment #2)
> I would say that giving superlibrarian permissions needs to be another
> permission.  If you're in a consortium you have to let someone at each
> branch set permissions for their staff, but you don't want them going in and
> changing the system preferences, and if they can assign superlibrarian
> permissions then they can access the system preferences.

What about giving yourself every permission except superlibrarian .. how many are you allowed to set with the permission to set permissions. You would have to disable the management permissions to in your case above.

> 
> And no matter how many times I tell people to fire those in their libraries
> who don't follow the rules they won't.  Instead they'd like more protection
> on the system.
> 

Definitely not a bug, perhaps a possible enhancement, but would have to be done in a way that doesn't annoy the rest of the world who have staff they can actually trust.
Comment 4 Katrin Fischer 2018-05-16 23:30:03 UTC

*** This bug has been marked as a duplicate of bug 20100 ***