[Bug 39848] New: Unauthorized users can delete the record if no items remain from the batch item deletion tool
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Bug ID: 39848 Summary: Unauthorized users can delete the record if no items remain from the batch item deletion tool Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: catrina@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Users without the edit_catalogue permission can delete the record if no items remain from the batch item deletion tool. To test, 1. Create a user with the following permissions: edit_any_item, edit_items, items_batchdel, items_batchmod. 2. When logged in as that user, use the batch item deletion tool to delete a few items. 3. Select “Delete records if no items remain” and “Delete selected items.” When the job has processed, notice that X item(s) deleted. X record(s) deleted. The record deletion shouldn’t be possible without the edit_catalogue permission. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #1 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 182010 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182010&action=edit Bug 39848: Restrict record deletion to staff who have edit_catalogue permission To test, 1. Create a user with the following permissions: edit_any_item, edit_items, items_batchdel, items_batchmod. 2. When logged in as that user, use the batch item deletion tool to delete a few items. 3. Select “Delete records if no items remain” and “Delete selected items.” When the job has processed, notice that X item(s) deleted. X record(s) deleted. 4. APPLY PATCH 5. With the same user repeat step 2. 6. This time there should be no option to 'Delete records if no items remain'. 7. Give the same use the Edit catalog (Modify bibliographic/holdings data) (edit_catalogue) permission. 8. Make sure you can successfully delete a record using the 'Delete records if no items remain'. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal Patch complexity|--- |Trivial patch CC| |lucas@bywatersolutions.com Assignee|koha-bugs@lists.koha-commun |lucas@bywatersolutions.com |ity.org | Version|24.11 |Main -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182010|0 |1 is obsolete| | --- Comment #2 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 182030 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182030&action=edit Bug 39848: Restrict record deletion to staff who have edit_catalogue permission To test, 1. Create a user with the following permissions: edit_any_item, edit_items, items_batchdel, items_batchmod. 2. When logged in as that user, use the batch item deletion tool to delete a few items. 3. Select “Delete records if no items remain” and “Delete selected items.” When the job has processed, notice that X item(s) deleted. X record(s) deleted. 4. APPLY PATCH 5. With the same user repeat step 2. 6. This time there should be no option to 'Delete records if no items remain'. 7. Give the same use the Edit catalog (Modify bibliographic/holdings data) (edit_catalogue) permission. 8. Make sure you can successfully delete a record using the 'Delete records if no items remain'. Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |major -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182030|0 |1 is obsolete| | --- Comment #3 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 182077 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182077&action=edit Bug 39848: Restrict record deletion to staff who have edit_catalogue permission To test, 1. Create a user with the following permissions: edit_any_item, edit_items, items_batchdel, items_batchmod. 2. When logged in as that user, use the batch item deletion tool to delete a few items. 3. Select “Delete records if no items remain” and “Delete selected items.” When the job has processed, notice that X item(s) deleted. X record(s) deleted. 4. APPLY PATCH 5. With the same user repeat step 2. 6. This time there should be no option to 'Delete records if no items remain'. 7. Give the same use the Edit catalog (Modify bibliographic/holdings data) (edit_catalogue) permission. 8. Make sure you can successfully delete a record using the 'Delete records if no items remain'. Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Unauthorized users can |Users without |delete the record if no |edit_catalogue permission |items remain from the batch |can delete the record if no |item deletion tool |items remain from the batch | |item deletion tool --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Updated description slightly - unauthorized would be a bit worse :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Is it really enough to remove the checkbox here? Should we not also check for the flag in the script itself? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Anneli Österman <anneli.osterman@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |anneli.osterman@koha-suomi. | |fi --- Comment #7 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- It seems I'm a bit late with my comment but we have used item batch deletion to delete bibliographic records on purpose. We do not want to give the edit_catalogue permission to everyone who needs to delete records because it also gives them the permission to edit records (wicht nowadays takes lots of professional competence). With this change we would need a new permission delete_catalogue (or delete_biblio_records) to obtain our current way of deleting bibliographic records. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Anneli Österman from comment #7)
It seems I'm a bit late with my comment but we have used item batch deletion to delete bibliographic records on purpose. We do not want to give the edit_catalogue permission to everyone who needs to delete records because it also gives them the permission to edit records (wicht nowadays takes lots of professional competence).
With this change we would need a new permission delete_catalogue (or delete_biblio_records) to obtain our current way of deleting bibliographic records.
Hi Anneli, thanks for reaching out. I am sorry, that this creates a problem for your workflow and I can understand your point. I checked and was surprised to only find your new bug and no older requests for this. I'd like to find a solution that works for all use cases, but developing a new permission at this point in cycle is a bit tricky, as we'd have to change a lot of other places too. This has been marked as major, so for some libraries it's bad... and for you the change is bad. We are in a bit of a hard stop. What we could do is maybe halt off backporting for a bit? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #9 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- This won't be an immediate problem for us because we do not update to newer version in a while (we have a quite slow update schedule except for security updates). Maybe the new permission has been added before our next update. I found bug https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35953 and commented on that one too. We will surely help with it - at the very least by testing it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- My worry is that since this is marked "major" it will be backported to all older releases - so it could hit you sooner with a security update. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #11 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- I will discuss about this with colleagues tomorrow, they can make a more accurate assessment than I can. Thank you for your concern! :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #12 from Anneli Österman <anneli.osterman@koha-suomi.fi> --- Sorry about the delay. We are fine with backporting. We will take our own actions if it is needed when the time comes. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Anneli Österman from comment #12)
Sorry about the delay. We are fine with backporting. We will take our own actions if it is needed when the time comes. :)
+1 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Katrin Fischer from comment #5)
Is it really enough to remove the checkbox here? Should we not also check for the flag in the script itself?
What about this question? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39926 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39926 [Bug 39926] Blocker users without edit_catalogue permission from deleting the record if no items remain from the batch item deletion tool at the script level -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|39926 | --- Comment #15 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- (In reply to Katrin Fischer from comment #14)
(In reply to Katrin Fischer from comment #5)
Is it really enough to remove the checkbox here? Should we not also check for the flag in the script itself?
What about this question?
I 100% agree, I opened Bug 39926 and assigned it to myself. I will get a patch up ASAP! Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39926 [Bug 39926] Blocker users without edit_catalogue permission from deleting the record if no items remain from the batch item deletion tool at the script level -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Lucas Gass (lukeg) from comment #15)
(In reply to Katrin Fischer from comment #14)
(In reply to Katrin Fischer from comment #5)
Is it really enough to remove the checkbox here? Should we not also check for the flag in the script itself?
What about this question?
I 100% agree, I opened Bug 39926 and assigned it to myself. I will get a patch up ASAP!
Thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 --- Comment #17 from Catrina Berka <catrina@bywatersolutions.com> --- Can we get this backported to 24.11? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_11_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39926 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39926 [Bug 39926] Block users without edit_catalogue permission from deleting the record if no items remain from the batch item deletion tool at the script level -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|39926 | --- Comment #18 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- (In reply to Catrina Berka from comment #17)
Can we get this backported to 24.11?
Marked it as a candidate for 24.11. Now it will be up to the release maintainer. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39926 [Bug 39926] Block users without edit_catalogue permission from deleting the record if no items remain from the batch item deletion tool at the script level -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39926 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39926 [Bug 39926] Block users without edit_catalogue permission from deleting the record if no items remain from the batch item deletion tool at the script level -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to main |Pushed to stable Version(s)|25.05.00 |25.05.00,24.11.08 released in| | --- Comment #19 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #20 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org