Bug 41127

Summary: Unneeded Permission required when adding child record.
Product: Koha Reporter: Esther Melander <esther.melander>
Component: CatalogingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: m.de.rooy
Version: 25.05   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Esther Melander 2025-10-28 17:30:46 UTC
To replicate:

1. Set EasyAnalyticalRecords to don't show and UseControlNumber to Use. Enable ShowComponentRecords to show in both staff and OPAC.
2. Create a patron with permissions to login into the staff interface. Grant all cataloging permissions except edit_items and edit_items_restricted.
3. Before logging as the example patron, prepare a bibliographic record. Add a child record with an attached item. The title of the child record should be:

245##$aTitle$p1967-1968

4. Login as the example patron. Find the prepared bibliographic child record and click Edit > Edit as new (duplicate).
5. Edit the record so the duplicate child record has a title like:

245##$aTitle$p1968-1969

6. Save.

Note the user will be prompted to confirm saving because the system detects the new child record as a duplicate. Confirm the save.

The user is logged out.

7. Relogin as the example patron and find the parent record. Click on Components and see there are now two child records. Koha did save the record, but inappropriately logged out the user.

I would not expect the cataloger to need the edit_items permission because the user is not editing an item, but duplicating a bibliographic record.

8. Repeat the steps but grant the example patron the edit_items permission. See that the user is able to add a new child record and is not logged out.