Bug 37702

Summary:	Fast Cataloging does not work with fast_cataloging permission when duplicate suspected
Product:	Koha	Reporter:	holly
Component:	Cataloging	Assignee:	Bugs List <koha-bugs>
Status:	NEW ---	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	blawlor, chlee, gmcharlt, kyle.m.hall, m.de.rooy, mnero, phil
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description holly 2024-08-21 17:39:06 UTC

Fast cataloging should work seamlessly with the patron permission fast_cataloging, and has in the past. 
This is no longer working in 23.05, 23.11 and 24.05.
To replicate: 
-Set a user with no cataloging permissions except fast_cataloging. 
-Log in as that user.
-Attempt a checkout with some nonsense barcode.
-Follow prompt to add record via fast cataloging.
-Fill out fast add MARC with a title that already exists in catalog and save.
-Koha will ask if this is a duplicate
*Select yes, edit existing items: you are taken to the normal view of the record and cannot add items. 
*Select no, save as new record: Instead of this directing into item creation, you are directed to the normal view of the record you just created. You can add an item from New or Edit. 

-If no duplicate suspected, saving the record does direct to the item creation screen as expected, and then you run into bug 37407, which has been fixed for upcoming versions.

Comment 1 Phil Ringnalda 2024-08-21 21:43:29 UTC

If someone with only fast_cataloging permission can't add an item to a regular record, then it doesn't seem like they should be able to add an item to a regular record even if they get there via creating a duplicate fastadd record. Doing so sounds like the sort of privilege escalation I would remember and abuse once I happened upon it :)

Should Koha check for the only-fast_cataloging permission case before doing the duplicate check, and skip doing it if the user won't be able to do anything if there is a duplicate?

Comment 2 Phil Ringnalda 2024-08-23 01:55:11 UTC

Actually, probably shouldn't skip the duplicate check, but should only check for duplicate fast add records.