https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42974 Bug ID: 42974 Summary: Acquisitions receiving is not limited by basket owning library Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: lena.hernandez@equinoxoli.org QA Contact: testopia@bugs.koha-community.org Target Milestone: --- In acquisitions, when receiving order lines and adding them to the invoice, all pending items display, even those from other libraries. It is possible to update and receive items owned by other libraries on baskets managed by other libraries. I would expect that an account with the permissions order_manage and edit_items, but without the permissions order_manage_all or edit_any_item would not be able to receive or modify them. Indeed, the file basket.pl wants order_manage and then farther down it looks like it checks if you own the basket or have the order_manage_all perm, and if not throws the cannot_manage_basket, "You are not authorised to manage this basket." However, it appears that the parcel.pl file for receiving invoices only cares about the order_receive permission and doesn't check any other permissions. This stage of the process should follow other acq permissions and restrict receiving to managing libraries. Bug is applicable for at least versions 24.11 through 26.05. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.