Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 30178: (bugs 27526 and 28445 follow-up) Every librarian can edit every item with IndependentBranches on

Browse source 
Problem arises after applying bugfix 27526 and 28445: with
IndependentBranches on, a librarian without superlibrarian privileges,
can edit (and potentially delete) every item (i.e. also from a foreign
branch).  This is because can_be_edited calculation is buggy (in two spots).

Test plan:
1. Have (at least) two branches defined.
2. Have IndependentBranches set.
3. Have a biblio record with items belonging to different branches.
4. Be a librarian without superlibrarian rights, with editcatalogue
   and tool permissions set.

Scenario A (Edit items):
1. Go to Edit -> Edit items view (cataloguing/additems.pl).
2. You will be able to edit every item, also ones not from the branch
   you are from (cf. the button 'Actions').
3. Apply the patch.
4. Repeat 1.
5. You should be able to edit only the items from your branch.

Scenario B (Edit items in batch):
1. From Normal view go to Edit -> Edit items in batch.
2. You will be able to batch edit every item, also ones not from the branch
   you are from.
3. Apply the patch.
4. Repeat 1.
5. You should be able to edit only the items from your branch (and
   see 'Cannot edit' for others.

Scenario C (Delete items in batch):
1. From Normal view go to Edit -> Delete items in batch.
2. You will not see the string 'Cannot delete' and only by chance
   will not be able to activate the checkboxes next to foreign items.
3. Apply the patch.
4. Repeat 1.
5. You should be able to delete only the items from your branch (and
   see 'Cannot delete' for others.

Scenario D and E:
Analogous steps can be executed from Tools -> Batch item modification
and Tools -> Batch item deletion

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Janusz Kaczmarek 2022-02-24 21:26:46 +01:00 committed by Fridolin Somers
parent 1bbfda8c78
commit e55914a5d0
4 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers.inc
View file

@ -246,7 +246,7 @@
</thead>
<tbody>
[% FOREACH item IN items %]
[% SET can_be_edited = ! ( Koha.Preference('IndependentBranches') && ! logged_in_user && item.homebranch != Branches.GetLoggedInBranchcode() ) %]
[% SET can_be_edited = ! ( Koha.Preference('IndependentBranches') && ! logged_in_user.is_superlibrarian && item.homebranch != Branches.GetLoggedInBranchname() ) %]
<tr>
[% IF checkboxes_edit %]

2
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
View file

@ -80,7 +80,7 @@
</thead>
<tbody>
[% FOREACH item IN items %]
[% SET can_be_edited = ! ( Koha.Preference('IndependentBranches') && ! logged_in_user && item.homebranch != Branches.GetLoggedInBranchcode() ) %]
[% SET can_be_edited = ! ( Koha.Preference('IndependentBranches') && ! logged_in_user.is_superlibrarian && item.homebranch != Branches.GetLoggedInBranchname() ) %]
[% IF item.itemnumber == itemnumber%]
[% UNLESS can_be_edited %]
<tr id="row[% item.itemnumber | html %]" class="active">

2
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
View file

@ -1,6 +1,8 @@
[% USE raw %]
[% USE Koha %]
[% USE KohaDates %]
[% USE Asset %]
[% USE Branches %]
[% SET footerjs = 1 %]
[% PROCESS 'i18n.inc' %]
[% INCLUDE 'doc-head-open.inc' %]

1
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
View file

@ -2,6 +2,7 @@
[% USE Asset %]
[% USE Koha %]
[% USE KohaDates %]
[% USE Branches %]
[% SET footerjs = 1 %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Batch item modification &rsaquo; Tools &rsaquo; Koha</title>