https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 Bug ID: 40392 Summary: Staff without create_public_lists can create public list from search results Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Lists Assignee: koha-bugs@lists.koha-community.org Reporter: sbrown@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl In 24.11, staff can create public lists from search results even if they don't have the create_public_lists permission put in place by Bug 13888 - 'Lists' permission should allow/disallow using the lists module in staff. To recreate: -Find or create a staff member with no permissions from the lists group -While logged in as that staff member, perform a catalog search, select the checkboxes on multiple search results, and click the 'Add to list' button -Select the 'New list' option -Note the option to set the new list to public or private - set to 'Public' -Go to Lists, and note that no Public lists tab shows (so you can't see the list you just created) -Next, log in as a staff member with edit_public_list_contents -Go to Lists, and note that the list created by the permission-less staff member shows up in Public lists -Note that the list is also visible in the OPAC -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.