Bug 40392 - Staff without create_public_lists can create public list from search results
Summary: Staff without create_public_lists can create public list from search results
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: 24.11
Hardware: All All
: P5 - low minor
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-07-15 14:23 UTC by Sara Brown
Modified: 2025-07-16 00:35 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sara Brown 2025-07-15 14:23:52 UTC
In 24.11, staff can create public lists from search results even if they don't have the create_public_lists permission put in place by Bug 13888 - 'Lists' permission should allow/disallow using the lists module in staff. 

To recreate:

-Find or create a staff member with no permissions from the lists group
-While logged in as that staff member, perform a catalog search, select the checkboxes on multiple search results, and click the 'Add to list' button 
-Select the 'New list' option
-Note the option to set the new list to public or private - set to 'Public'
-Go to Lists, and note that no Public lists tab shows (so you can't see the list you just created)
-Next, log in as a staff member with edit_public_list_contents
-Go to Lists, and note that the list created by the permission-less staff member shows up in Public lists
-Note that the list is also visible in the OPAC
Comment 1 Sara Brown 2025-07-15 15:22:15 UTC
Edited to clarify: the staff member who can see the list (not the creator) needs edit_public_list_contents *and* use_public_lists
Comment 2 David Cook 2025-07-16 00:34:53 UTC
This sounds familiar.

I recently did a local blitz on lists where I locked them down both in the staff interface and the OPAC.

I've only posted the work for the OPAC (bug 39372) as I think fixing the staff interface was too difficult to do quickly, so I did a hacky workaround...