Bug 37258 - Locked records can still be modified/deleted by an unauthorized librarian with merge and in advanced editor
Summary: Locked records can still be modified/deleted by an unauthorized librarian wit...
Status: ASSIGNED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor
Assignee: Arthur Suzuki
QA Contact: Testopia
URL:
Keywords:
Depends on: 36372
Blocks:
  Show dependency treegraph
 
Reported: 2024-07-04 18:45 UTC by Janusz Kaczmarek
Modified: 2025-03-31 09:05 UTC (History)
4 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Janusz Kaczmarek 2024-07-04 18:45:24 UTC
Locked records can still be modified/deleted by an unauthorized librarian with merge and in advanced editor.

Although the Edit record action is grayed out from the regular Edit pulldown, and also an attempt to open directly the basic editor (.../cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=<biblionumber>) results with Error 403 page, an unauthorized user is still able to modify/delete a locked record in several ways, including:

1. merge operation: if a locked record has been chosen as the destination (ref) record, fields can be inserted/deleted from it as a result of a merge and so modifying the locked record;

2. merge operation: if a locked record has NOT been chosen as the destination (ref) record, the locked record will be deleted;

3. a user cat launch directly the advanced editor (wit URL .../cgi-bin/koha/cataloguing/editor.pl#catalog/<biblionumber>) and save the modified version, with no respect for the lock status and edit_locked_records permission.

Theoretically, such an a user could be restricted from using advanced editor, but this does not seem as a right way of solving this issue.  And the merge path would still remain open.
Comment 1 Arthur Suzuki 2025-02-26 10:35:56 UTC
Hello Janusz,
I see different ways of solving this issue.
Anyway i'm working on a bz to be able to modify locked record (or change the record source with marc modification template).
I wonder what solution would be best, either of which:
- not letting users without the permission to edit locked records to be able to enqueue a mass modification job (that would make sense).
-let simple users launch there jobs but "bypassing" the changes for any locked record which is in the list.
I'd say I prefer the first solution, otherwise you might get quite a huge mess in your records.
Plus it quite make sense to me that only "power-users" would be able to batch modify records...
Comment 2 Arthur Suzuki 2025-02-26 10:37:11 UTC
+ I'd say this bug could be solved in BZ36975
Comment 3 Arthur Suzuki 2025-02-26 12:56:43 UTC
Oh, after carefully reading your comment I see that it is a different problem. I'll try to provide a patch for that as well.
Comment 4 Arthur Suzuki 2025-03-26 10:21:08 UTC
methods to add some checks to :
Koha/Biblio.pl -> merge_with
C4/Biblio.pm -> ModBiblio, DelBiblio
Comment 5 Arthur Suzuki 2025-03-26 10:37:35 UTC
perl tests can use t::lib::Mocks::mock_userenv( { patron => $patron } )
to mock restricted user and check for return value.