In 24.11, staff can create public lists from search results even if they don't have the create_public_lists permission put in place by Bug 13888 - 'Lists' permission should allow/disallow using the lists module in staff. To recreate: -Find or create a staff member with no permissions from the lists group -While logged in as that staff member, perform a catalog search, select the checkboxes on multiple search results, and click the 'Add to list' button -Select the 'New list' option -Note the option to set the new list to public or private - set to 'Public' -Go to Lists, and note that no Public lists tab shows (so you can't see the list you just created) -Next, log in as a staff member with edit_public_list_contents -Go to Lists, and note that the list created by the permission-less staff member shows up in Public lists -Note that the list is also visible in the OPAC
Edited to clarify: the staff member who can see the list (not the creator) needs edit_public_list_contents *and* use_public_lists
This sounds familiar. I recently did a local blitz on lists where I locked them down both in the staff interface and the OPAC. I've only posted the work for the OPAC (bug 39372) as I think fixing the staff interface was too difficult to do quickly, so I did a hacky workaround...