https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42974
Bug ID: 42974
Summary: Acquisitions receiving is not limited by basket owning
library
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Acquisitions
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
In acquisitions, when receiving order lines and adding them to the invoice, all
pending items display, even those from other libraries. It is possible to
update and receive items owned by other libraries on baskets managed by other
libraries.
I would expect that an account with the permissions order_manage and
edit_items, but without the permissions order_manage_all or edit_any_item would
not be able to receive or modify them.
Indeed, the file basket.pl wants order_manage and then farther down it looks
like it checks if you own the basket or have the order_manage_all perm, and if
not throws the cannot_manage_basket, "You are not authorised to manage this
basket."
However, it appears that the parcel.pl file for receiving invoices only cares
about the order_receive permission and doesn't check any other permissions.
This stage of the process should follow other acq permissions and restrict
receiving to managing libraries.
Bug is applicable for at least versions 24.11 through 26.05.
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[email protected]
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
