[Bug 40392] New: Staff without create_public_lists can create public list from search results
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 Bug ID: 40392 Summary: Staff without create_public_lists can create public list from search results Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Lists Assignee: koha-bugs@lists.koha-community.org Reporter: sbrown@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl In 24.11, staff can create public lists from search results even if they don't have the create_public_lists permission put in place by Bug 13888 - 'Lists' permission should allow/disallow using the lists module in staff. To recreate: -Find or create a staff member with no permissions from the lists group -While logged in as that staff member, perform a catalog search, select the checkboxes on multiple search results, and click the 'Add to list' button -Select the 'New list' option -Note the option to set the new list to public or private - set to 'Public' -Go to Lists, and note that no Public lists tab shows (so you can't see the list you just created) -Next, log in as a staff member with edit_public_list_contents -Go to Lists, and note that the list created by the permission-less staff member shows up in Public lists -Note that the list is also visible in the OPAC -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 Sara Brown <sbrown@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=13888 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 --- Comment #1 from Sara Brown <sbrown@bywatersolutions.com> --- Edited to clarify: the staff member who can see the list (not the creator) needs edit_public_list_contents *and* use_public_lists -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- This sounds familiar. I recently did a local blitz on lists where I locked them down both in the staff interface and the OPAC. I've only posted the work for the OPAC (bug 39372) as I think fixing the staff interface was too difficult to do quickly, so I did a hacky workaround... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40396 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|24.11 |25.11 CC| |alex@rcls.org --- Comment #3 from Alex Carver [Acerock7] <alex@rcls.org> --- This is still true in 25.11. I'd also like to add that creating a list from a cart has the same problem. The Private/Public dropdown is still present and accessible when logged in as a user without the create_public_lists permission and a list created this way can be public. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392 Chris Slone <cslone@camdencountylibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cslone@camdencountylibrary. | |org -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org