[Koha-bugs] [Bug 10679] Lists interface offers delete option when user doesn' t have permission

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10679

--- Comment #5 from Marcel de Rooy <m.de.rooy at rijksmuseum.nl> ---
(In reply to Aleisha Amohia from comment #4)
> The reason the delete button was still showing is because, by default,
> we allow anyone to remove THEIR OWN contributions from a list. So, the
> delete button will always show. This patch makes sure that the delete
> button will only show if permission for anyone else to add or delete
> their own entries is granted.

The permission to add is not relevant here.
The only way to make sure if you can delete is check permissions and optionally
check if loggedinuser 'owns' entries on that list (or perhaps on the page we
show).

> To test:
> 1) Make a public list setting all permissions to 'do not allow' EXCEPT
> 'remove own contributed entries' (set this to Allow). This should be
> done by default, but just make sure
> 2) Log in as a different user and go to that list. notice the 'remove
> selected' button shows, but attempting to delete any records fails.

This assumption is not correct. If I added an entry to a public list and the 
owner later sets the list to 'D-A-D', I should still be able to delete my
entry. But you removed the button !

-- 
You are receiving this mail because:
You are watching all bug changes.