Bug 33440 - A public list can be transferred to a staff member without list permissions
Summary: A public list can be transferred to a staff member without list permissions
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Laura Escamilla
QA Contact: Baptiste Wojtkowski (bwoj)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-06 19:17 UTC by Kelly McElligott
Modified: 2025-07-01 21:08 UTC (History)
6 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the transfer of public lists to staff patrons that do not have list permissions - when attempting to transfer the list, and the staff member doesn't have list permissions, an error message is now shown. Previously, the list could be transferred and then be edited by the staff patron without list permissions.
Version(s) released in:
25.11.00,25.05.01
Circulation function:


Attachments
Bug 33440: Added permission requirements to unauthorized_transfer (1.21 KB, patch)
2025-04-22 16:36 UTC, Laura Escamilla
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer error message (1.26 KB, patch)
2025-04-22 16:36 UTC, Laura Escamilla
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer OPAC message (1.33 KB, patch)
2025-04-22 16:36 UTC, Laura Escamilla
Details | Diff | Splinter Review
Bug 33440: Tests (2.86 KB, patch)
2025-04-22 16:36 UTC, Laura Escamilla
Details | Diff | Splinter Review
Bug 33440: Added permission requirements to unauthorized_transfer (1.27 KB, patch)
2025-04-22 21:12 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer error message (1.32 KB, patch)
2025-04-22 21:12 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer OPAC message (1.38 KB, patch)
2025-04-22 21:12 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 33440: Tests (2.92 KB, patch)
2025-04-22 21:12 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 33440: Added permission requirements to unauthorized_transfer (1.33 KB, patch)
2025-06-06 08:48 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer error message (1.38 KB, patch)
2025-06-06 08:48 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 33440: Updated wording for unauthorized_transfer OPAC message (1.44 KB, patch)
2025-06-06 08:48 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 33440: Tests (2.98 KB, patch)
2025-06-06 08:48 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly McElligott 2023-04-06 19:17:47 UTC
With the introduction of this bug, https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25498, public lists can now be transferred to other staff.  When testing this new feature, I was able to transfer a list a staff member without any list permissions.  Once this transfer was successful, this staff member could edit the list, add and remove titles from this public list.  The one thing this staff member (who had no permissions for lists) could not do was transfer the list to another person.  I believe that this transfer option should only be allowed to staff with list permissions.

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
Comment 1 Laura Escamilla 2025-04-22 16:36:25 UTC
Created attachment 181299 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer
Comment 2 Laura Escamilla 2025-04-22 16:36:27 UTC
Created attachment 181300 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message
Comment 3 Laura Escamilla 2025-04-22 16:36:30 UTC
Created attachment 181301 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message
Comment 4 Laura Escamilla 2025-04-22 16:36:32 UTC
Created attachment 181302 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D
Comment 5 Roman Dolny 2025-04-22 21:12:00 UTC
Created attachment 181315 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 6 Roman Dolny 2025-04-22 21:12:02 UTC
Created attachment 181316 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 7 Roman Dolny 2025-04-22 21:12:05 UTC
Created attachment 181317 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 8 Roman Dolny 2025-04-22 21:12:08 UTC
Created attachment 181318 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 9 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:19 UTC
Created attachment 183058 [details] [review]
Bug 33440: Added permission requirements to unauthorized_transfer

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 10 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:23 UTC
Created attachment 183059 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer error message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 11 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:26 UTC
Created attachment 183060 [details] [review]
Bug 33440: Updated wording for unauthorized_transfer OPAC message

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 12 Baptiste Wojtkowski (bwoj) 2025-06-06 08:48:29 UTC
Created attachment 183061 [details] [review]
Bug 33440: Tests

Test Plan
1. Staff member A creates a public list.
2. Staff member A transfers this public list to another staff member (staff member b) without list permissions.
3. Staff Member B now has the ability to edit this public list and add/remove items from this list.
4. Apply the patch
5. Repeat steps 1 and 2. An error message should now appear stating that the “Transfer not allowed: You or the selected user do not have the required permissions.”
6. Provide the correct permissions to Staff Member B. Initiate the transfer again. The transfer should be successful.
7. Test these steps in the OPAC as well.
8. Prove t/db_dependent/Virtualshelves.t
9. Sign off and have a wonderful day! :D

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 13 Lucas Gass (lukeg) 2025-06-13 19:31:34 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 14 Paul Derscheid 2025-06-22 21:46:52 UTC
Nice work everyone!

Pushed to 25.05.x for 25.05.03
Comment 15 David Nind 2025-07-01 21:08:25 UTC
I've attempted a release note. Please update if I haven't got this right.

I've also changed the bug importance from an enhancement to a normal bug - it is something that is not working as it should, rather than an improvement.