OpenILS::Application::Actor should check_perms for CREATE_CLOSED_DATE, not CREATE_CLOSEING

[Ben Ostrowsky]

Line 2647 of OpenILS/Application/Actor.pm says:

$evt = $U->check_perms($user->id, $cd->org_unit, 'CREATE_CLOSEING');

Since that permission doesn't exist in closed_dates.js, I'm guessing this should be:

$evt = $U->check_perms($user->id, $cd->org_unit, 'CREATE_CLOSED_DATE');

[Ben Ostrowsky (sylvar)]

The same goes for DELETE_CLOSEING and DELETE_CLOSED_DATE in Actor.pm.

[Ben Shum (bshum)]

Actually, I think the proper permission names are:

CREATE_ORG_UNIT_CLOSING
DELETE_ORG_UNIT_CLOSING
UPDATE_ORG_UNIT_CLOSING

The CREATE_CLOSED_DATE appears to be a function to actually perform the action, and not the permission's name.

[Ben Shum (bshum)]

Marking confirmed though, does seem to be a mismatched perm check in Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm

[Josh Stompro (u-launchpad-stompro-org)]

Working Branch added to fix this issue
user/stompro/lp1240657_closing_permissions
http://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/stompro/lp1240657_closing_permissions

Josh

[Galen Charlton (gmc)]

Noting that the affected methods, open-ils.actor.org_unit.closed_date.create and open-ils.actor.org_unit.closed_date.delete, aren't used. Instead, the closed date editor currently uses open-ils.actor.org_unit.closed.{create,date,update,retrieve}, and those are defined in ClosedDates.pm.

For the sake of bookkeeping, I've gone ahead and pushed Josh's patch to master (thanks!), but I won't bother backporting it. I'll open a separate bug for removing the unused methods.

[Galen Charlton (gmc)]

The new bug is bug 1545178.