When you try to access a list you haven't created/you are not the owner of by manipulating the URL, you can't see the entries, but you can see the name of the list: ../cgi-bin/koha/opac-shelves.pl?op=view&shelfnumber=1&sortfield=title
Confirmed. Name of list is visible in breadcrumbs as well...
Created attachment 55707 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed
Same problem on the staff interface.
Created attachment 55708 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface
Created attachment 55709 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed
Created attachment 55710 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface
Created attachment 55711 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 55712 [details] [review] Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface Signed-off-by: Marc Véron <veron@veron.ch>
Much better, thx for fixing!
Created attachment 55802 [details] [review] [PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 55803 [details] [review] [PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Pushed to master for 16.11, thanks Jonathan!
Pushed in 16.05. Will be in 16.05.05.
Pushed to 3.22.x, will be in 3.22.12