Bug 14354 - Only superlibrarian should see edit links for other branches' items in staff detail
Summary: Only superlibrarian should see edit links for other branches' items in staff ...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 15256
  Show dependency treegraph
 
Reported: 2015-06-06 21:43 UTC by Katrin Fischer
Modified: 2016-06-21 21:38 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 14354: Prevent edition of items from other branches if IndependentBranches is on (4.30 KB, patch)
2015-07-14 17:15 UTC, Jonathan Druart
Details | Diff | Splinter Review
[Signed-off] Bug 14354: Prevent edition of items from other branches if IndependentBranches is on (4.49 KB, patch)
2015-09-03 14:42 UTC, Marc Véron
Details | Diff | Splinter Review
[PASSED QA] Bug 14354: Prevent edition of items from other branches if IndependentBranches is on (4.53 KB, patch)
2015-09-03 21:43 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2015-06-06 21:43:48 UTC
Testing bug 6559 I noticed that if you are not superlibrarian and IndependentBranches is turned on, you can't edit items from the item form as the edit links are not shown. 
But when you use the edit link from the staff detail page, you can. 

We shouldn't show edit link for other branches' items on the staff detail page when IndependentBranches is turned on and the staff user doesn't have superlibrarian permission.
Comment 1 Jonathan Druart 2015-07-14 17:15:04 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2015-09-03 14:42:41 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2015-09-03 21:43:10 UTC
Created attachment 42362 [details] [review]
[PASSED QA] Bug 14354: Prevent edition of items from other branches if IndependentBranches is on

If IdependentBranches is ON, to edit/delete items from other branches
you need to be superlibrarian.
Currently a "simple" staff user cannot edit them from the edit item page
but from the catalogue detail page.

The edit links should not be displayed on this table.

Test plan:
O/ Set IndependentBranches to "Prevent".
Create a record and add 2 items:
   Set homebranch to L1 for item I1.
   Set homebranch to L2 for item I2.
1/ With a superlibrarian user, you should be able to edit both items.
2/ With a "simple" user attached to L1, you should only be able to edit
I1. The edit links should not be displayed for I2.

Note that the checkbox is displayed on the catalogue detail page (item
list), but on the batch tools, it won't be possible to select non-modifiable
items.

TODO: Add a server-side check. Indeed it is still possible to edit an
item if the user know the url.

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Tomás Cohen Arazi 2015-09-07 14:28:40 UTC
Patch pushed to master.

Thanks Jonathan!
Comment 5 Chris Cormack 2015-09-22 01:46:06 UTC
Pushed to 3.20.x will be in 3.20.4
Comment 6 Liz Rea 2015-09-22 03:21:58 UTC
Pushed to 3.18.x will be in 3.18.11