[Bug 33440] New: A public list can be transferred to a staff member without list permissions
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Bug ID: 33440 Summary: A public list can be transferred to a staff member without list permissions Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Lists Assignee: koha-bugs@lists.koha-community.org Reporter: kelly@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl With the introduction of this bug, https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25498, public lists can now be transferred to other staff. When testing this new feature, I was able to transfer a list a staff member without any list permissions. Once this transfer was successful, this staff member could edit the list, add and remove titles from this public list. The one thing this staff member (who had no permissions for lists) could not do was transfer the list to another person. I believe that this transfer option should only be allowed to staff with list permissions. Test Plan 1. Staff member A creates a public list. 2. Staff member A transfers this public list to another staff member (staff member b) without list permissions. 3. Staff Member B now has the ability to edit this public list and add/remove items from this list. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Kelly McElligott <kelly@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzairo@bywatersolutions.com QA Contact|testopia@bugs.koha-communit |kelly@bywatersolutions.com |y.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #1 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 181299 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181299&action=edit Bug 33440: Added permission requirements to unauthorized_transfer -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #2 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 181300 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181300&action=edit Bug 33440: Updated wording for unauthorized_transfer error message -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #3 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 181301 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181301&action=edit Bug 33440: Updated wording for unauthorized_transfer OPAC message -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #4 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 181302 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181302&action=edit Bug 33440: Tests Test Plan 1. Staff member A creates a public list. 2. Staff member A transfers this public list to another staff member (staff member b) without list permissions. 3. Staff Member B now has the ability to edit this public list and add/remove items from this list. 4. Apply the patch 5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.” 6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful. 7. Test these steps in the OPAC as well. 8. Prove t/db_dependent/Virtualshelves.t 9. Sign off and have a wonderful day! :D -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|kelly@bywatersolutions.com |testopia@bugs.koha-communit | |y.org CC| |Laura.escamilla@bywatersolu | |tions.com Assignee|koha-bugs@lists.koha-commun |Laura.escamilla@bywatersolu |ity.org |tions.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181299|0 |1 is obsolete| | Attachment #181300|0 |1 is obsolete| | Attachment #181301|0 |1 is obsolete| | Attachment #181302|0 |1 is obsolete| | --- Comment #5 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 181315 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181315&action=edit Bug 33440: Added permission requirements to unauthorized_transfer Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #6 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 181316 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181316&action=edit Bug 33440: Updated wording for unauthorized_transfer error message Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #7 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 181317 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181317&action=edit Bug 33440: Updated wording for unauthorized_transfer OPAC message Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #8 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 181318 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181318&action=edit Bug 33440: Tests Test Plan 1. Staff member A creates a public list. 2. Staff member A transfers this public list to another staff member (staff member b) without list permissions. 3. Staff Member B now has the ability to edit this public list and add/remove items from this list. 4. Apply the patch 5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.” 6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful. 7. Test these steps in the OPAC as well. 8. Prove t/db_dependent/Virtualshelves.t 9. Sign off and have a wonderful day! :D Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181315|0 |1 is obsolete| | --- Comment #9 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 183058 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183058&action=edit Bug 33440: Added permission requirements to unauthorized_transfer Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181316|0 |1 is obsolete| | --- Comment #10 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 183059 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183059&action=edit Bug 33440: Updated wording for unauthorized_transfer error message Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181317|0 |1 is obsolete| | --- Comment #11 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 183060 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183060&action=edit Bug 33440: Updated wording for unauthorized_transfer OPAC message Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181318|0 |1 is obsolete| | --- Comment #12 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 183061 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183061&action=edit Bug 33440: Tests Test Plan 1. Staff member A creates a public list. 2. Staff member A transfers this public list to another staff member (staff member b) without list permissions. 3. Staff Member B now has the ability to edit this public list and add/remove items from this list. 4. Apply the patch 5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.” 6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful. 7. Test these steps in the OPAC as well. 8. Prove t/db_dependent/Virtualshelves.t 9. Sign off and have a wonderful day! :D Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |baptiste.wojtkowski@biblibr | |e.com QA Contact|testopia@bugs.koha-communit |baptiste.wojtkowski@biblibr |y.org |e.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #13 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00 |25.11.00,25.05.01 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #14 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x for 25.05.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal Text to go in the| |This fixes the transfer of release notes| |public lists to staff | |patrons that do not have | |list permissions - when | |attempting to transfer the | |list, and the staff member | |doesn't have list | |permissions, an error | |message is now shown. | |Previously, the list could | |be transferred and then be | |edited by the staff patron | |without list permissions. Keywords|release-notes-needed | CC| |david@davidnind.com --- Comment #15 from David Nind <david@davidnind.com> --- I've attempted a release note. Please update if I haven't got this right. I've also changed the bug importance from an enhancement to a normal bug - it is something that is not working as it should, rather than an improvement. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Pushed to oldstable Version(s)|25.11.00,25.05.01 |25.11.00,25.05.01,24.11.08 released in| | --- Comment #16 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Needs documenting CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #17 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- 39987 - Batch item deletion breadcrumb uses wrong link -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 --- Comment #19 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33440 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #20 from David Nind <david@davidnind.com> --- Bug fix, no changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org