https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40392
Bug ID: 40392
Summary: Staff without create_public_lists can create public
list from search results
Change sponsored?: ---
Product: Koha
Version: 24.11
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P5 - low
Component: Lists
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
In 24.11, staff can create public lists from search results even if they don't
have the create_public_lists permission put in place by Bug 13888 - 'Lists'
permission should allow/disallow using the lists module in staff.
To recreate:
-Find or create a staff member with no permissions from the lists group
-While logged in as that staff member, perform a catalog search, select the
checkboxes on multiple search results, and click the 'Add to list' button
-Select the 'New list' option
-Note the option to set the new list to public or private - set to 'Public'
-Go to Lists, and note that no Public lists tab shows (so you can't see the
list you just created)
-Next, log in as a staff member with edit_public_list_contents
-Go to Lists, and note that the list created by the permission-less staff
member shows up in Public lists
-Note that the list is also visible in the OPAC
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[email protected]
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
