Bug 40392

Summary: Staff without create_public_lists can create public list from search results
Product: Koha Reporter: Sara Brown <sbrown>
Component: ListsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: dcook, m.de.rooy
Version: 24.11   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13888
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40396
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Sara Brown 2025-07-15 14:23:52 UTC
In 24.11, staff can create public lists from search results even if they don't have the create_public_lists permission put in place by Bug 13888 - 'Lists' permission should allow/disallow using the lists module in staff. 

To recreate:

-Find or create a staff member with no permissions from the lists group
-While logged in as that staff member, perform a catalog search, select the checkboxes on multiple search results, and click the 'Add to list' button 
-Select the 'New list' option
-Note the option to set the new list to public or private - set to 'Public'
-Go to Lists, and note that no Public lists tab shows (so you can't see the list you just created)
-Next, log in as a staff member with edit_public_list_contents
-Go to Lists, and note that the list created by the permission-less staff member shows up in Public lists
-Note that the list is also visible in the OPAC
Comment 1 Sara Brown 2025-07-15 15:22:15 UTC
Edited to clarify: the staff member who can see the list (not the creator) needs edit_public_list_contents *and* use_public_lists
Comment 2 David Cook 2025-07-16 00:34:53 UTC
This sounds familiar.

I recently did a local blitz on lists where I locked them down both in the staff interface and the OPAC.

I've only posted the work for the OPAC (bug 39372) as I think fixing the staff interface was too difficult to do quickly, so I did a hacky workaround...