The next step after 7310: Exposing the new permissions to add and delete. Will submit the patch now, but give a more detailed test plan later (if needed). What should be tested here is: 1 Adding a list and checking various permission settings on opac and staff (edit again or look in the shelves table via sql). 2 Editing a list, changing perm settings and checking them again. 3 Try to add an item to a list without permissions to add (note: you should not be the owner). Try this via interface or even try to hack a URL. It should not be possible. 4 Try to delete an item that you added yourself to a list while delete_own is Do not allow. Even as owner you should not be able to. 5 Try to delete an item that another one added to a list while delete_other is Do not allow. Even as owner you should not be able to. 6 Try some things that you should be allowed to do so. Important note: The owner can always add, but needs perms to remove.
Created attachment 8529 [details] [review] Patch
Created attachment 9387 [details] [review] Rebased patch
Here is a more detailed test plan: 1 Test new list, open for everything. User1 on OPAC : Add public list P1 on OPAC. Set perms to AAA (3xAllow). User1 on Staff: Check perms P1. Do you see AAA? User1 on OPAC : Add few items. Delete one. User2 on Staff: Add item to P1. Delete an item from P1 that you added and one that you did not add. 2 Change to closed list. User1 on Staff: Edit P1. Set perms to DDD (3xDon't). User1 on OPAC : Check perms P1. Do you see DDD? User2 on OPAC : Try to add items to P1 or delete items from P1. Should not be possible. (NOTE: The interface should not even present you an option to Remove selected records when opening a list via the Lists button. Search results should not offer you list P1 in the Add to-combo.) User1 on Staff: Try to add items to P1. Should be possible (because of ownership). User1 on Staff: Try to delete items from P1. Should not be possible. 3 Mixed lists. User1 on Staff: Add private list V1. Set perms to DDD. Add an item. Try to delete it (not possible). User1 on OPAC : Try to delete item from V1 (not possible). User1 on Staff: Add public list P2. Set perms to AAD. User2 on OPAC : Add two items to P2. Remember which. User1 on OPAC : Add two items to P2. User1 on Staff: Delete one item of your own (OK). Try to delete an item of User2 (not possible: warned). User2 on OPAC : Delete one item of your own (OK). Try to delete an item of User1 (not possible: Warned). User1 on Staff: Set perms to DDA. Try to delete own item (not possible). User2 on OPAC : Delete item of User1 (OK). Try to delete one item of your own (not possible: warned).
Created attachment 9805 [details] [review] Bug 7805: Exposing the new list permissions in opac and staff This report builds on 7310. Had to correct some lines in ModShelf and AddShelf as well in order to save 0 values correctly for the permission columns. Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
(In reply to comment #4) > Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Thank you, Jared!
QA comment: * discussing of this feature with Marcel=if you select "private" list, the other 3 flags are irrelevant. In the future, users will be able to share private lists with who they want. * perlcritic in C4/VirtualShelves.pm was complaining before the patch and after the patch, so I won't reject it, but it would be nice to fix it in a later patch: C4/VirtualShelves.pm: Subroutine prototypes used at line 224, column 1. See page 194 of PBP. (Severity: 5) C4/VirtualShelves.pm: Subroutine prototypes used at line 255, column 1. See page 194 of PBP. (Severity: 5) C4/VirtualShelves.pm: "return" statement with explicit "undef" at line 354, column 22. See page 199 of PBP. (Severity: 5) C4/VirtualShelves.pm: Subroutine prototypes used at line 661, column 1. See page 194 of PBP. (Severity: 5) C4/VirtualShelves.pm: Don't modify $_ in list functions at line 664, column 5. See page 114 of PBP. (Severity: 5) No other comment, passed QA
Sending a followup for QA comments. Just housekeeping. Removed the prototypes and return undef. The obsolete code of each_biblionumbers has been removed.
Test the patch (with call to GetShelf and GetShelfContents) by going to Lists and doubleclicking a list to see its contents (in opac or staff). Does it work? No warnings in your log too? You are ready to sign off ;)
Created attachment 10274 [details] [review] Patch for perlcritic comments
Created attachment 11417 [details] [review] [SIGNED-OFF] Bug 7805 Followup for perlcritic messages Signed-off-by: Owen Leonard <oleonard@myacpl.org> Tested by going to Lists and doubleclicking a list to see its contents (in opac or staff). It works. No warnings in the log. I am ready to sign off.
Last patch marked as Passed QA
*** Bug 8635 has been marked as a duplicate of this bug. ***
Follow-up pushed
Created attachment 13288 [details] [review] PATCH] [3.8.x] 7805 Exposing the new list permissions in opac and staff 3.8.X
Created attachment 13289 [details] [review] [PATCH] [3.8.X] 7805 Followup for perlcritic messages
Tested the latest two patches for 3.8.X on commit d39283175622ddecaa3797566d1b4bc910ecdaa0
Pushed to 3.8.x, will be in 3.8.7 Thanks Marcel
Patch does not apply to 3.6.x - please attach a 3.6 patch if required. Thanks!