https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43829 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pedro.amorim@openfifth.co.u | |k Status|Passed QA |Failed QA --- Comment #6 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi all, The new toolbar on the patron list page shows 'Edit list' and 'Delete list' to staff who don't own the list. The patron lists page hides both for lists shared by someone else, but the toolbar doesn't. 'Delete list' then fails with an error page, and 'Edit list' lets a non-owner change someone else's list. To reproduce: 1) Go to Tools > Patron lists (http://localhost:8081/cgi-bin/koha/patron_lists/lists.pl), click 'New patron list', enter 'Shared list' as the name, tick 'Shared' and click 'Save' 2) Go to patron Tanya Daniels (http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=3), click 'More' > 'Set permissions', tick 'catalogue' and, under 'tools', 'manage_patron_lists', then save 3) Click 'Change password' and set username 'tanya' and password 'Kohatest123' 4) Log out, log in as tanya, go to Tools > Patron lists and confirm 'Shared list' has no 'Edit' or 'Delete' under 'Actions' 5) Click 'Shared list' and confirm the toolbar shows 'Edit list' and 'Delete list' 6) Click 'Delete list', confirm, and see the error page -- You are receiving this mail because: You are watching all bug changes.