https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30557 --- Comment #213 from Olivia Reynolds <olivia.reynolds@openfifth.co.uk> --- Thanks for the detailed review Pedro. I'll outline the changes I have and haven't made to try and address the feedback. Blocker 1: I haven't done anything to address this, as I don't think there's a way of doing so that isn't security theater. A mischievous user with an edit share on an item list can already render it functionally useless, simply by deleting every item on there. I think we have to accept that granting somebody edit permission is giving them a lot of trust. If there's some way of threading that needle I haven't thought of, I'm happy to take another look. Blocker 2: Addressed by adding a missing DISTINCT. Blocker 3: Addressed by treating ownerless lists as belonging to nobody rather than everybody. To make this work intuitively with group-shared item lists this required some schema changes to remember the branchcode of the last owner. Blocker 4: Addressed by correcting a typo. Blocker 5: Addressed by removing the `disable_share` setting and using proper table settings for the item list tables, which I hadn't realised could be made to work properly with Vue. Code design question 1: Addressed by moving the batch buttons to the toolbar. This required some chicanery to get access to the DataTable and retrieve the selection, but I've implemented a new helper in BaseResource that makes things somewhat readable. The additionalButtons setting has been dropped for both the staff and OPAC interfaces. Code design question 2: Addressed by factoring out the shared logic between doResourceDelete and doResourceRemove into a separate function. The original functions delegate to this one with concrete parameters to specify their differing behaviour. Thanks again for taking a look. -- You are receiving this mail because: You are watching all bug changes.