Bug 33440 - A public list can be transferred to a staff member without list permissions
Summary: A public list can be transferred to a staff member without list permissions
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Kelly McElligott
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-06 19:17 UTC by Kelly McElligott
Modified: 2023-04-06 19:18 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly McElligott 2023-04-06 19:17:47 UTC
With the introduction of this bug, https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25498, public lists can now be transferred to other staff.  When testing this new feature, I was able to transfer a list a staff member without any list permissions.  Once this transfer was successful, this staff member could edit the list, add and remove titles from this public list.  The one thing this staff member (who had no permissions for lists) could not do was transfer the list to another person.  I believe that this transfer option should only be allowed to staff with list permissions.

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.