Koha-clms/tools
Laura_Escamilla 605b6fc4b5
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
(cherry picked from commit 2dff8abf7f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-07-30 09:31:00 +00:00
..
csv-profiles
…
access_files.pl Bug 33341: Address some perlcritic errors in 5.36 2023-03-28 14:50:33 +02:00
additional-contents.pl Bug 38630: (QA follow-up) Fixing few calls of getTranslatedLanguages 2025-09-29 09:34:52 +02:00
ajax-inventory.pl Bug 37961: Inventory problem resolution fails by POSTing without an op or csrf_token 2024-09-30 15:21:51 +01:00
automatic_item_modification_by_age.pl Bug 36634: Replace cud-show with show in tools/automatic_item_modification_by_age.pl 2024-04-19 18:06:38 +02:00
batchMod.pl Bug 39871: (QA follow-up) Do not hardcode nullable check 2025-07-28 10:09:52 +02:00
batch_delete_records.pl Bug 27893: Optionally skip biblio with open orders in batch delete 2024-04-19 18:06:32 +02:00
batch_extend_due_dates.pl Bug 37483: Use cud-list for extend due dates tool 2024-09-27 18:00:32 +02:00
batch_record_modification.pl Bug 34478: SQUASH Follow-up to previous batch operations patches 2024-03-01 11:00:05 +01:00
batch_records_ajax.pl Bug 34913: Adjust "Manage staged MARC records" 2024-01-26 15:13:43 +01:00
cleanborrowers.pl Bug 36526: Remove circular dependency from Koha::Objects 2024-05-03 16:02:44 +02:00
copy-holidays.pl Bug 34478: Changes for tools/holidays 2024-03-01 10:58:36 +01:00
csv-profiles.pl Bug 34478: Correct op name in CSV profile deletion confirmation step 2024-03-01 11:00:07 +01:00
exceptionHolidays.pl Bug 34478: Changes for tools/holidays 2024-03-01 10:58:36 +01:00
export.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
holidays.pl Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
import_borrowers.pl Bug 40549: Silence two warnings in patron import tool 2025-09-19 14:31:20 +02:00
inventory.pl Bug 40702: Add missing "Title" header in Inventory csv export 2025-10-16 08:11:17 +02:00
letter.pl Bug 37826: Remove the use of the script_name variable where it is unnecessary 2025-03-19 23:57:51 +01:00
manage-marc-import.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
marc_modification_templates.pl Bug 34478: Fixes for MARC modification template management 2024-03-01 11:00:05 +01:00
modborrowers.pl Bug 40843: Sort patron attributes by description 2025-12-04 11:31:14 +01:00
newHolidays.pl Bug 38633: Prevent holidays from being ignored 2025-10-16 12:07:06 +02:00
overduerules.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
page.pl Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-07-30 09:31:00 +00:00
picture-upload.pl Bug 37488: Validate paths in datalink.txt/idlink.txt files 2024-08-16 16:22:21 +02:00
problem-reports.pl Bug 34478: Manual fix - problem_reports 2024-03-01 10:56:59 +01:00
quotes-upload.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
quotes.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
scheduler.pl Bug 39170: Improve validation of report ID 2025-02-24 19:30:48 +01:00
showdiffmarc.pl Bug 37826: Remove the use of the script_name variable where it is unnecessary 2025-03-19 23:57:51 +01:00
stage-marc-import.pl Bug 34478: Changes for tools/stage-marc-import 2024-03-01 10:58:40 +01:00
stockrotation.pl Bug 36193: cud- treatment for tools/stockrotation.pl 2024-03-12 17:47:33 +01:00
tools-home.pl Bug 33595: (bug 26628 follow-up) Fix authorization for tools-home.pl 2023-05-16 11:47:15 +02:00
upload-cover-image.pl Bug 34478: (follow-up) upload-cover-image.pl: Remove bitwise-and from condition 2024-03-01 10:59:56 +01:00
upload-file.pl Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
upload.pl Bug 34478: Changes for tools/upload 2024-03-01 10:58:42 +01:00
viewlog.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00