https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41971 Sara Brown <sbrown@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sbrown@bywatersolutions.com --- Comment #1 from Sara Brown <sbrown@bywatersolutions.com> --- This is still the case as of 25.11.05. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41971 --- Comment #2 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 202604 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202604&action=edit Bug 41971: Prevent access to pages belonging to another library To test: 1. Create two patron accounts: * One patron whose home library matches the library assigned to the page. * One patron whose home library is different from the library assigned to the page. 2. Create a new page with the following settings: * Display location = OPAC * Library = a specific library * Publication date = Today * Title and Content = minimally necessary content 3. Save the page. 4. Right-click the OPAC link and copy the link address. 5. Open the link in an incognito or private browser window without signing in. * Confirm that the library-specific page is not displayed. * Confirm that a 404 page is shown. 6. In the incognito window, sign in using the patron account whose home library matches the page library. 7. Open the copied OPAC link again. * Confirm that the page is displayed. 8. Sign out and sign in using the patron account whose home library does not match the page library. 9. Open the copied OPAC link again. * Confirm that the page is not displayed. * Confirm that a 404 page is shown. 10. Edit the page and change Library to All libraries. 11. Open the OPAC link in an incognito or private browser window without signing in. * Confirm that the page is displayed. 12. While signed in as each patron account, open the OPAC link again. * Confirm that the page is displayed for patrons from both libraries. 13. Create or edit a page with the following settings: * Display location = Staff interface * Library = a specific library * Publication date = Today * Title and Content = minimally necessary content 14. Sign in to the staff interface using a staff account whose library matches the page library. 15. Open the page from the staff interface. * Confirm that the page is displayed. 16. Sign out and sign in using a staff account whose library does not match the page library. 17. Open the staff page link directly. * Confirm that the page is not displayed. * Confirm that a 404 page is shown. 18. Edit the staff page and change Library to All libraries. 19. Open the page while signed in with staff accounts from both libraries. * Confirm that the page is displayed for both accounts. 20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC. * Confirm that the page is displayed in both interfaces for users from the matching library. * Confirm that users from a different library receive a 404 page. * Confirm that pages assigned to All libraries are available in both interfaces. -- You are receiving this mail because: You are watching all bug changes.