Bug 40001 - edit_items permission allows deletion of individual items. Should be separate.
Summary: edit_items permission allows deletion of individual items. Should be separate.
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: 24.11
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-05-27 05:12 UTC by Hanan Mustafa
Modified: 2025-05-27 05:21 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hanan Mustafa 2025-05-27 05:12:20 UTC
Currently, the edit_items permission allows a user to delete individual items using the "Action" button on the edit item page.

This behavior persists even when the user does not have the delete_all_items permission, which is intended (according to documentation) to manage bulk deletion.

This creates a permissions flaw: staff with rights to edit items can also delete items, which may not always be desirable from a library’s operational or security perspective.

Steps to Reproduce:
Create a staff account with only the edit_items permission (without delete_all_items)

Go to: catalogue/itemsearch.pl

Edit an item (via cataloguing/additem.pl?op=edititem&...)

Click the Action button, then Delete the item

The item is deleted successfully — despite lacking delete_all_items permission

Expected Behavior:
There should be a separate delete_items permission for deleting individual items
OR
Deleting any item (individual or bulk) should require the delete_all_items permission.