[Bug 37258] New: Locked records can still be modified/deleted by an unauthorized librarian with merge and in advanced editor
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Bug ID: 37258 Summary: Locked records can still be modified/deleted by an unauthorized librarian with merge and in advanced editor Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: januszop@gmail.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Depends on: 31791 Locked records can still be modified/deleted by an unauthorized librarian with merge and in advanced editor. Although the Edit record action is grayed out from the regular Edit pulldown, and also an attempt to open directly the basic editor (.../cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=<biblionumber>) results with Error 403 page, an unauthorized user is still able to modify/delete a locked record in several ways, including: 1. merge operation: if a locked record has been chosen as the destination (ref) record, fields can be inserted/deleted from it as a result of a merge and so modifying the locked record; 2. merge operation: if a locked record has NOT been chosen as the destination (ref) record, the locked record will be deleted; 3. a user cat launch directly the advanced editor (wit URL .../cgi-bin/koha/cataloguing/editor.pl#catalog/<biblionumber>) and save the modified version, with no respect for the lock status and edit_locked_records permission. Theoretically, such an a user could be restricted from using advanced editor, but this does not seem as a right way of solving this issue. And the merge path would still remain open. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31791 [Bug 31791] Add the ability to lock records to prevent modification through the Koha staff interface -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Bug 37258 depends on bug 31791, which changed state. Bug 31791 Summary: Add the ability to lock records to prevent modification through the Koha staff interface https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31791 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Janusz Kaczmarek <januszop@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36372 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com --- Comment #1 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- Hello Janusz, I see different ways of solving this issue. Anyway i'm working on a bz to be able to modify locked record (or change the record source with marc modification template). I wonder what solution would be best, either of which: - not letting users without the permission to edit locked records to be able to enqueue a mass modification job (that would make sense). -let simple users launch there jobs but "bypassing" the changes for any locked record which is in the list. I'd say I prefer the first solution, otherwise you might get quite a huge mess in your records. Plus it quite make sense to me that only "power-users" would be able to batch modify records... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|31791 |36975 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31791 [Bug 31791] Add the ability to lock records to prevent modification through the Koha staff interface https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36975 [Bug 36975] Allow MarcModificationTemplates to change the record source for a batch of records -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 --- Comment #2 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- + I'd say this bug could be solved in BZ36975 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |arthur.suzuki@biblibre.com |ity.org | Depends on|36975 |31791 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31791 [Bug 31791] Add the ability to lock records to prevent modification through the Koha staff interface https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36975 [Bug 36975] Allow MarcModificationTemplates to change the record source for a batch of records -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 --- Comment #3 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- Oh, after carefully reading your comment I see that it is a different problem. I'll try to provide a patch for that as well. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|31791 |36372 Status|NEW |ASSIGNED Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31791 [Bug 31791] Add the ability to lock records to prevent modification through the Koha staff interface https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36372 [Bug 36372] Allow privileged users to set the 'record source' on cataloguing -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 --- Comment #4 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- methods to add some checks to : Koha/Biblio.pl -> merge_with C4/Biblio.pm -> ModBiblio, DelBiblio -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 --- Comment #5 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- perl tests can use t::lib::Mocks::mock_userenv( { patron => $patron } ) to mock restricted user and check for return value. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37258 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=35380 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org