Go to file
Laura_Escamilla 605b6fc4b5
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
(cherry picked from commit 2dff8abf7f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-07-30 09:31:00 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-11-10 14:42:18 +01:00
C4 Bug 41102: Error 500 on the About page when biblioserver Zebra configuration is missing 2026-07-17 14:33:47 +02:00
Koha Bug 41292: Rename whitelist to allowlist and add force_password_reset_when_set_by_staff 2026-07-22 11:24:30 +02:00
acqui Bug 41594: Disable access to invoice-files.pl if AcqEnableFiles disabled 2026-03-27 13:40:22 +00:00
admin Bug 41100: EDI vendor account port numbers no longer editable 2025-12-04 15:38:35 +01:00
api Bug 40543: Remove pickup_library.branchname embed 2025-10-10 14:11:53 +02:00
authorities Bug 36603: (QA follow-up) Resolve two conditional declarations 2024-11-08 16:42:53 +01:00
basket Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 40559: Fix noisy warning in MARCdetail 2025-12-02 11:24:04 +01:00
cataloguing Bug 42262: encodeURIComponent for the 006 value 2026-07-17 14:09:03 +02:00
circ Bug 41904: "Use of uninitialized value..." warning in del_message.pl 2026-05-27 12:31:37 +00:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-07-23 16:04:05 +01:00
debian Bug 41337: Add missing Bash variable to `koha-create` 2026-07-17 14:24:52 +02:00
docs Bug 42726: Add 26.11 release team 2026-07-08 07:39:32 +02:00
erm
…
errors Bug 37741: Do not send cookie back from error pages 2024-08-30 12:45:45 +02:00
etc Bug 41032: Fix Open Fifth missing in plugin repos config 2025-12-04 14:35:24 +01:00
ill Bug 40171: Remove extraneous join() 2025-10-31 15:05:58 +00:00
installer Increment version for 24.11.17 release 2026-06-24 10:20:07 +02:00
koha-tmpl Bug 42277: Remove JS error when viewing a subscription 2026-07-17 14:16:50 +02:00
labels Bug 30745: (QA follow-up) tidy 2024-11-18 17:44:31 +01:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 41212: Sort debit_types for manual invoice by description 2025-12-04 11:34:49 +01:00
misc Bug 40744: Ignore --del-exp-selfreg if pref is not set 2026-07-17 14:15:32 +02:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 43019: Fix branch comparison 2026-07-30 09:30:27 +00:00
patron_lists Bug 37266: [24.11.x] patron_lists/delete.pl should have CSRF protection 2025-02-24 19:30:42 +01:00
patroncards Bug 39800: Error 500 when trying to delete patron card template 2025-10-03 15:36:48 +02:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2026-01-20 14:14:47 +00:00
pos Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern 2025-12-02 09:52:51 +01:00
preservation Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
recalls Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
reports Bug 42735: [24.11] Fix SQL injection 2026-06-18 15:50:41 +02:00
reserve Bug 38412: Display warning on biblio level 2025-09-19 14:40:19 +02:00
reviews Bug 2486: Show user comments in staff interface 2024-08-26 17:39:42 +02:00
rotating_collections Bug 31930: Ignore whitespace before and after barcodes 2025-09-17 17:20:55 +02:00
serials Bug 40861: Remove warning from serials/acqui-search-result.pl 2025-10-16 12:16:45 +02:00
services
…
skel
…
suggestion Bug 42071: Add 'show' to options that load a single suggestion 2026-05-27 12:11:01 +00:00
svc Bug 41518: Only show autorenewal text if autorenewal allowed 2026-05-27 14:43:37 +00:00
t Bug 41510: (RM follow-up) Perltidy a missed file at merge time 2026-07-22 11:17:25 +02:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-22 20:18:26 +01:00
tools Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-07-30 09:31:00 +00:00
virtualshelves Bug 40585: (follow-up) Display error if no records were found 2025-10-16 11:22:02 +02:00
xt RMaint 24.11 fix xt/find-license-problems.t 2026-01-20 14:54:44 +01:00
.editorconfig
…
.gitignore Bug 35402: Update the OPAC and staff interface to Bootstrap 5 2024-08-23 15:58:41 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-11-10 15:47:59 +01:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38546: Set tabWidth and useTabs in prettierrc 2025-08-06 09:56:52 +00:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 24.11.17 release 2026-06-24 10:20:07 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 40027: (follow-up) Add .github/ to Makefile.PL 2025-11-10 14:44:11 +01:00
README
…
README.md
…
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-09 09:41:05 +01:00
about.pl Bug 40608: (follow-up) Add warning in about page 2025-09-26 16:24:09 +02:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL
…
changelanguage.pl
…
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-07-17 14:14:34 +02:00
cypress.config.ts Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
eslint.config.mjs Bug 38167: Migrate ESLint config to new flat format 2025-08-06 09:57:04 +00:00
fix-perl-path.PL
…
gulpfile.js Bug 36640: (follow-up) CSS fixes for DataTables controls 2024-11-14 14:19:34 +01:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 36064: (QA follow-up) Simplify and tidy 2024-10-25 11:09:51 +02:00
package.json Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
rewrite-config.PL
…
rspack.config.js Bug 37824: (QA follow-up) Fix improper handling of jQuery and DataTables libraries by marking them as externals 2024-09-16 18:41:17 +02:00
tsconfig.json
…
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 38770: [24.11.x] Update yarn.lock 2026-01-20 15:08:12 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo