https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30557
--- Comment #33 from Andrew Fuerste-Henry <[email protected]> --- I wrote up a test plan for permissions enforcement: 1 - As a superlibrarian, create 3 item lists owned by the superlibrarian with Public, Private, and Group visibilities 2 - Create a user with staff access (catalogue) permission but no item list or other permissions. Give your user a different home branch than your superlibrarian accout 3 - As a superlibrarian, create a private list owned by your user 3 - Log in as your user 4 - Confirm you can access the Item Lists module and see only the public list and the private list owned by the user 5 - Return to your superlibrarian login and create a library group containing the superlibrarian and user's libraries 6 - Return to your user login, confirm you can now see the group list 7 - On the Item Lists home page (/cgi-bin/koha/lists/items) confirm your user is not offered buttons for New item list, Edit, or Delete 8 - Click into one of the lists owned by the superlibrarian (/cgi-bin/koha/lists/items/X) and confirm your user is not offered a button for Add items 9 - Click into the list owned by your user, confirm you are able to add items to it 10 - Confirm your user can add items to the list they own from bib details, item search, and report results 11 - confirm your user can edit the list they own 12 - confirm your user can delete the list they own 13 - Give your user the permission Add/remove items in public or group lists (manage_item_list_contents) 14 - As your user, confirm you can add items to public & group lists owned by the superlibrarian via the Item Lists module, bib details, item search, and report results 15 - Give your user the permission Edit item lists owned by others / public (edit_item_lists) 16 - Confirm your user can now edit the public & group lists owned by the superlibrarin 17 - Give your user the permission Delete item lists owned by others / public (delete_item_lists) 18 - Confirm your user can now delete the public & group lists owned by the superlibrarin 19 - Give your user the permisison Create item lists (create_item_lists). Make sure they *do not* have the permission Search, list and view patrons (list_borrowers) 20 - Confirm your user can now create item lists with themselves as the owner 21 - Give your user the permission Search, list and view patrons (list_borrowers) 22 - Confirm your user can now find and assign other users as list owner when creating an item list -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
