Bug 7805 - Exposing the new list permissions in opac and staff
Summary: Exposing the new list permissions in opac and staff
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: 3.10
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Marcel de Rooy
QA Contact: Jonathan Druart
URL:
Keywords:
: 8635 (view as bug list)
Depends on:
Blocks:
 
Reported: 2012-03-22 15:23 UTC by Marcel de Rooy
Modified: 2013-05-23 06:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Patch (15.29 KB, patch)
2012-03-22 15:26 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Rebased patch (15.21 KB, patch)
2012-05-02 13:44 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 7805: Exposing the new list permissions in opac and staff (15.31 KB, patch)
2012-05-28 19:36 UTC, Jared Camins-Esakov
Details | Diff | Splinter Review
Patch for perlcritic comments (1.75 KB, patch)
2012-06-14 10:49 UTC, Marcel de Rooy
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 7805 Followup for perlcritic messages (1.96 KB, patch)
2012-08-07 13:21 UTC, Owen Leonard
Details | Diff | Splinter Review
PATCH] [3.8.x] 7805 Exposing the new list permissions in opac and staff (15.23 KB, patch)
2012-11-07 16:00 UTC, Marcel de Rooy
Details | Diff | Splinter Review
[PATCH] [3.8.X] 7805 Followup for perlcritic messages (1.75 KB, patch)
2012-11-07 16:02 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2012-03-22 15:23:07 UTC
The next step after 7310: Exposing the new permissions to add and delete. Will submit the patch now, but give a more detailed test plan later (if needed).

What should be tested here is: 
1 Adding a list and checking various permission settings on opac and staff (edit again or look in the shelves table via sql).
2 Editing a list, changing perm settings and checking them again.
3 Try to add an item to a list without permissions to add (note: you should not be the owner). Try this via interface or even try to hack a URL. It should not be possible.
4 Try to delete an item that you added yourself to a list while delete_own is Do not allow. Even as owner you should not be able to.
5 Try to delete an item that another one added to a list while delete_other is Do not allow. Even as owner you should not be able to.
6 Try some things that you should be allowed to do so.

Important note: The owner can always add, but needs perms to remove.
Comment 1 Marcel de Rooy 2012-03-22 15:26:56 UTC Comment hidden (obsolete)
Comment 2 Marcel de Rooy 2012-05-02 13:44:27 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2012-05-02 14:50:01 UTC
Here is a more detailed test plan:

1 Test new list, open for everything.
User1 on OPAC : Add public list P1 on OPAC. Set perms to AAA (3xAllow). 
User1 on Staff: Check perms P1. Do you see AAA?
User1 on OPAC : Add few items. Delete one.
User2 on Staff: Add item to P1. Delete an item from P1 that you added and one that you did not add.

2 Change to closed list.
User1 on Staff: Edit P1. Set perms to DDD (3xDon't). 
User1 on OPAC : Check perms P1. Do you see DDD?
User2 on OPAC : Try to add items to P1 or delete items from P1. Should not be possible. (NOTE: The interface should not even present you an option to Remove selected records when opening a list via the Lists button. Search results should not offer you list P1 in the Add to-combo.)
User1 on Staff: Try to add items to P1. Should be possible (because of ownership).
User1 on Staff: Try to delete items from P1. Should not be possible.

3 Mixed lists.
User1 on Staff: Add private list V1. Set perms to DDD. Add an item. Try to delete it (not possible).
User1 on OPAC : Try to delete item from V1 (not possible).
User1 on Staff: Add public list P2. Set perms to AAD.
User2 on OPAC : Add two items to P2. Remember which.
User1 on OPAC : Add two items to P2.
User1 on Staff: Delete one item of your own (OK). Try to delete an item of User2 (not possible: warned).
User2 on OPAC : Delete one item of your own (OK). Try to delete an item of User1 (not possible: Warned).
User1 on Staff: Set perms to DDA. Try to delete own item (not possible).
User2 on OPAC : Delete item of User1 (OK). Try to delete one item of your own (not possible: warned).
Comment 4 Jared Camins-Esakov 2012-05-28 19:36:21 UTC Comment hidden (obsolete)
Comment 5 Marcel de Rooy 2012-05-29 11:24:26 UTC
(In reply to comment #4)
> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Thank you, Jared!
Comment 6 Paul Poulain 2012-06-09 11:35:37 UTC
QA comment:
 * discussing of this feature with Marcel=if you select "private" list, the other 3 flags are irrelevant. In the future, users will be able to share private lists with who they want.
 * perlcritic in C4/VirtualShelves.pm was complaining before the patch and after the patch, so I won't reject it, but it would be nice to fix it in a later patch:
C4/VirtualShelves.pm: Subroutine prototypes used at line 224, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Subroutine prototypes used at line 255, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: "return" statement with explicit "undef" at line 354, column 22.  See page 199 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Subroutine prototypes used at line 661, column 1.  See page 194 of PBP.  (Severity: 5)
C4/VirtualShelves.pm: Don't modify $_ in list functions at line 664, column 5.  See page 114 of PBP.  (Severity: 5)

No other comment, passed QA
Comment 7 Marcel de Rooy 2012-06-14 10:40:32 UTC
Sending a followup for QA comments. Just housekeeping.
Removed the prototypes and return undef. The obsolete code of each_biblionumbers has been removed.
Comment 8 Marcel de Rooy 2012-06-14 10:48:53 UTC
Test the patch (with call to GetShelf and GetShelfContents) by going to Lists and doubleclicking a list to see its contents (in opac or staff).
Does it work? No warnings in your log too? You are ready to sign off ;)
Comment 9 Marcel de Rooy 2012-06-14 10:49:52 UTC Comment hidden (obsolete)
Comment 10 Owen Leonard 2012-08-07 13:21:05 UTC Comment hidden (obsolete)
Comment 11 Jonathan Druart 2012-08-10 13:15:59 UTC
Last patch marked as Passed QA
Comment 12 Nicole C. Engard 2012-08-13 20:53:20 UTC
*** Bug 8635 has been marked as a duplicate of this bug. ***
Comment 13 Paul Poulain 2012-09-03 13:57:43 UTC
Follow-up pushed
Comment 14 Marcel de Rooy 2012-11-07 16:00:59 UTC
Created attachment 13288 [details] [review]
PATCH] [3.8.x] 7805 Exposing the new list permissions in opac and staff

3.8.X
Comment 15 Marcel de Rooy 2012-11-07 16:02:18 UTC
Created attachment 13289 [details] [review]
[PATCH] [3.8.X] 7805 Followup for perlcritic messages
Comment 16 Marcel de Rooy 2012-11-07 16:02:53 UTC
Tested the latest two patches for 3.8.X on commit d39283175622ddecaa3797566d1b4bc910ecdaa0
Comment 17 Chris Cormack 2012-11-08 03:12:00 UTC
Pushed to 3.8.x, will be in 3.8.7

Thanks Marcel
Comment 18 Liz Rea 2012-11-28 01:01:20 UTC
Patch does not apply to 3.6.x - please attach a 3.6 patch if required.

Thanks!