https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260
Andrew Fuerste-Henry <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #457 from Andrew Fuerste-Henry <[email protected]> --- Setting the status of "sent" for a notice that has been printed seems misleading/confusing, especially for a notice in a transport type other than Print. How is the user to tell the difference between an email notice that was actually sent vs one that was printed? This issue is exacerbated by the fact that printing an Email notice adds a delivery note of the from: address that would have been used to email it. A delivery note recording that this notice was manually printed would be more useful. Updating the notice status as soon as a print interface is opened also seems problematic. What if the user clicks Print but then closes the print interface without actually printing the notice? In the search interface, the Library filter looks like it should be filtering based on which library a notice is from, but actually filters based on the home library of the patron. We should either: 1 - add a column to message_queue to record the from: branch (Bug 43928) and filter on that 2 - relabel the filter here to "Patron library" I'm glad to see a user without view_borrower_infos_from_any_libraries permission can only see notices for users at their own library or other libraries in a patron data library group. It would make sense to hide the Library filter in this case, since only one library will return results. On the patron notices tab, I am not given the option to print any Pending notices. I am allowed to print Sent, Failed, and Deleted notice. Is this the intent for the Notices Management page as well? I can print Pending notices from Notices Management. Claude points out: Password-reset links and 2FA codes are visible with a low permission. tools.view_generated_notices alone lets someone read any visible patron’s notice content, including STAFF_PASSWORD_RESET (which contains <<passwordreseturl>>) and 2FA_OTP_TOKEN. That could include a superlibrarian’s reset link. Before this patch, reading notice content needed borrowers.edit_borrowers. Fix: exclude those letter codes, or require edit_borrowers as well. QA tool complaint: [FAIL] tools/print_notice.pl FAIL git_manipulation The file has been added and deleted or renamed in the same patchset -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
