Angular Holdings Editor : Update item regardless of working location and profile

Bug #2018491 reported by Britta Dorsey
20
This bug affects 4 people
Affects Status Importance Assigned to Milestone
Evergreen
Confirmed
High
Andrea Neiman

Bug Description

Evergreen 3.9.1 (primary testing)
Evergreen MOBIUS server (confirm circulator/cataloger profiles)
Evergreen 3.10.1 (Jabok server)

Tested and found that circ1, localadmin, and cat2 profile holders are able to edit items outside of their working location. I am assuming it is due to the UPDATE_COPY permission.

It does bring up a Change Operator request if you attempt to change anything other than the circulation/owning locations. For example, as a Cat2 I attempted to change a stat cat for an item owned by a different library. When I clicked Apply All, Save & Exit, I received a "Change Operator" login. When I went back in and changed the circulation/owning libraries, it saved and closed without the credentials request.

Here's testing log for MOBIUS server:
1. Logged in as br1jmcginnis under RPLS-WEPL-permissionscheck
2. Searched for "concerto" in the staff catalog
3. Selected Le concerto (TCN 2)
4. Went to Holdings View and selected an item owned by SPLS-BPL (CONC71000337)
5. Right-clicked and selected Edit Items
6. Changed the circulating and owning library attributes. Apply All, Save & Exit closed the Holdings Editor and the item was transferred to RPLS_WEPL.

___
Related Bugs: https://bugs.launchpad.net/evergreen/+bug/1932062
https://bugs.launchpad.net/evergreen/+bug/1763811

tags: added: cat-holdingseditor cataloging permissions
Revision history for this message
Michele Morgan (mmorgan) wrote :

Marking Confirmed.

I tested this on a 3.9.4 system as well as 3.11.

Following Britta's steps, as a user with UPDATE_COPY at the system level, I was able to open an item outside of my system in the Angular holdings editor, change the owning and circulating library fields to my own working location, and successfully save the item.

Changed in evergreen:
status: New → Confirmed
importance: Undecided → High
Ruth Frasur (rfrasur)
Changed in evergreen:
assignee: nobody → Ruth Frasur (rfrasur)
Revision history for this message
Andrea Neiman (aneiman) wrote :

Evergreen Indiana has contacted with Equinox to produce a fix for this bug.

Changed in evergreen:
assignee: Ruth Frasur (rfrasur) → Andrea Neiman (aneiman)
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.