[Bug 10679] New: Lists interface offers delete option when user doesn't have permission
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679 Bug ID: 10679 Summary: Lists interface offers delete option when user doesn't have permission Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Lists Assignee: m.de.rooy@rijksmuseum.nl Reporter: oleonard@myacpl.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl In both the OPAC and the staff client a "allowremovingitems" variable is used in the template to determine whether the logged in user should be able to delete items from a list. In both the OPAC and staff client this variable is true when it should be false. Fortunately the user can't actually remove something from the list. Instead the page returns an error message. However, the "remove" option should not be visible in that case. To confirm this bug, log in to the OPAC or staff client and open a public list which was created by another user. The "remove from list" option will be available but submitting the form will return an error like "You could not delete any selected items from this shelf." -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679 --- Comment #1 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Just from recall: Isn't it so that the variable is set to true (and the remove button is displayed) as long as it is possible that this user might be able to delete at least some items of this list? The permissions now differentiate deleting items you added yourself and items of someone else. It would not be very effective to do this check on item level every time you display a list? BICBW.. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- (In reply to M. de Rooy from comment #1)
Isn't it so that the variable is set to true as long as it is possible that this user might be able to delete at least some items of this list?
Why would it be possible that I might be able to delete some items from a list which I didn't create and which wasn't created with permission for others to add items? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679 --- Comment #3 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Owen Leonard from comment #2)
Why would it be possible that I might be able to delete some items from a list which I didn't create and which wasn't created with permission for others to add items?
Just thinking: Permissions can be changed at any time. So if I just disallowed adding items by others on my list, there could still be items added earlier on? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=7310 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org