Shelving Location Editor appears to allow staff to see and edit other library's shelving locations
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Evergreen |
New
|
Undecided
|
Unassigned | ||
Bug Description
Evergreen 3.5 through 3.8.0
All staff, regardless of permissions assigned, can see the shelving locations for their entire consortium (Administration -> Local Administration -> Shelving Locations Editor). Staff should be restricted to the appropriate locations similar to how the org unit selector restricts what org units are shown in the Group Penalty Thresholds (Administration -> Local Administration -> Group Penalty Thresholds)
Additionally, staff with the following permissions granted at the System or Library level are able to edit all shelving locations in their consortium:
- CREATE_
- UPDATE_
- DELETE_
For some reason when the permissions are set at the Branch level staff are properly restricted to editing the shelving locations for just their branch.
To test this I added the three COPY_LOCATION permissions to an account with the Circulators permission group on a 3.8.0 server with Concerto data. (The Local Administrator and System Administrator accounts have the EVERYTHING permission rather than the individual COPY_LOCATION permissions so aren't great to test this.)
| Michele Morgan (mmorgan) wrote | #1 |
| Christine Burns (christine-burns) wrote | #2 |
| tags: | added: silentfailure |
| Terran McCanna (tmccanna) wrote | #3 |
| summary: |
- Shelving Location Editor allows staff to see and edit other library's - shelving locations + Shelving Location Editor appears to allow staff to see and edit other + library's shelving locations |
| Susan Morrison (smorrison425) wrote | #4 |
| Susan Morrison (smorrison425) wrote | #5 |
I have not been able to reproduce this on 3.7 or 3.8.
I do see that when an action is attempted that is not permitted by the user, the toast reports Update Succeeded, but no change has actually been made.
I tested on the 3.8 community demo server as follows:
Logged in as admin, and, in the User Permission Editor added the following permissions at the System level to user br1bbrown:
- CREATE_
- UPDATE_
- DELETE_
Logged in as br1bbrown, I attempted the following:
Add a shelving location owned by CONS
Edit a shelving location owned by CONS
Edit a shelving location owned by SYS2
For all of these actions "Update Succeeded" was reported, but no updates were actually made.
I was able to successfully add and edit shelving locations owned by BR1 and SYS1 as I would expect.
Could the issue be that "Update Succeeded" is being reported when it actually failed? This in itself is a fairly serious bug IMO, and happens in other interfaces, too. But I am not seeing an issue with the permissions not working as they should.