Bug 33440

Summary: A public list can be transferred to a staff member without list permissions
Product: Koha Reporter: Kelly McElligott <kelly>
Component: ListsAssignee: Laura Escamilla <Laura.escamilla>
Status: Pushed to stable --- QA Contact: Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski>
Severity: normal    
Priority: P5 - low CC: baptiste.wojtkowski, david, jzairo, Laura.escamilla, lucas, m.de.rooy
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
This fixes the transfer of public lists to staff patrons that do not have list permissions - when attempting to transfer the list, and the staff member doesn't have list permissions, an error message is now shown. Previously, the list could be transferred and then be edited by the staff patron without list permissions.
Version(s) released in:
25.11.00,25.05.01
Circulation function:
Attachments: Bug 33440: Added permission requirements to unauthorized_transfer
Bug 33440: Updated wording for unauthorized_transfer error message
Bug 33440: Updated wording for unauthorized_transfer OPAC message
Bug 33440: Tests
Bug 33440: Added permission requirements to unauthorized_transfer
Bug 33440: Updated wording for unauthorized_transfer error message
Bug 33440: Updated wording for unauthorized_transfer OPAC message
Bug 33440: Tests
Bug 33440: Added permission requirements to unauthorized_transfer
Bug 33440: Updated wording for unauthorized_transfer error message
Bug 33440: Updated wording for unauthorized_transfer OPAC message
Bug 33440: Tests

Description Kelly McElligott 2023-04-06 19:17:47 UTC
With the introduction of this bug, https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25498, public lists can now be transferred to other staff.  When testing this new feature, I was able to transfer a list a staff member without any list permissions.  Once this transfer was successful, this staff member could edit the list, add and remove titles from this public list.  The one thing this staff member (who had no permissions for lists) could not do was transfer the list to another person.  I believe that this transfer option should only be allowed to staff with list permissions.

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
Comment 1 Laura Escamilla 2025-04-22 16:36:25 UTC
Created attachment 181299 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer
Comment 2 Laura Escamilla 2025-04-22 16:36:27 UTC
Created attachment 181300 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message
Comment 3 Laura Escamilla 2025-04-22 16:36:30 UTC
Created attachment 181301 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message
Comment 4 Laura Escamilla 2025-04-22 16:36:32 UTC
Created attachment 181302 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D
Comment 5 Roman Dolny 2025-04-22 21:12:00 UTC
Created attachment 181315 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 6 Roman Dolny 2025-04-22 21:12:02 UTC
Created attachment 181316 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 7 Roman Dolny 2025-04-22 21:12:05 UTC
Created attachment 181317 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 8 Roman Dolny 2025-04-22 21:12:08 UTC
Created attachment 181318 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 9 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:19 UTC
Created attachment 183058 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 10 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:23 UTC
Created attachment 183059 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 11 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:26 UTC
Created attachment 183060 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 12 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:29 UTC
Created attachment 183061 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 13 Lucas Gass (lukeg) 2025-06-13 19:31:34 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 14 Paul Derscheid 2025-06-22 21:46:52 UTC
Nice work everyone!

Pushed to 25.05.x for 25.05.03
Comment 15 David Nind 2025-07-01 21:08:25 UTC
I've attempted a release note. Please update if I haven't got this right.

I've also changed the bug importance from an enhancement to a normal bug - it is something that is not working as it should, rather than an improvement.