Go to file
Laura_Escamilla afdbbd117e
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-08-04 14:01:22 +12:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-23 23:06:52 +02:00
C4 Bug 30233: (follow-up) Log a warning when _apply_substitution discards a bad pattern 2026-07-30 15:54:03 +12:00
Koha Bug 30233: (follow-up) fix some errors reported by QA tools 2026-07-30 15:53:54 +12:00
acqui Bug 41594: [25.05.x] Disable access to invoice-files.pl if AcqEnableFiles disabled 2026-04-21 12:02:52 -06:00
admin Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
api Bug 41594: [25.05.x] Add Cypress tests 2026-04-21 12:02:52 -06:00
authorities Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
basket Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
bookings Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
catalogue Bug 34879: Remove unused file from Koha 2026-03-30 18:02:28 -04:00
cataloguing Bug 41989: Call getlanguage after get_template_and_user 2026-05-23 15:58:40 -04:00
circ Bug 41904: "Use of uninitialized value..." warning in del_message.pl 2026-05-23 15:58:43 -04:00
clubs Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
debian Bug 39164: (QA follow-up) Add setting to koha conf files 2026-06-19 12:47:43 +12:00
docs Bug 42726: Add 26.11 release team 2026-06-23 13:46:37 +12:00
erm Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
errors Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
etc Bug 39164: (QA follow-up) Add setting to koha conf files 2026-06-19 12:47:43 +12:00
ill Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
installer Increment version for 25.05.12 release 2026-07-09 11:53:25 +12:00
koha-tmpl Bug 42733: Job progress fix 2026-06-26 12:16:48 +12:00
labels Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 41040: Prevent form submission if no filters have been selected 2026-03-30 18:02:25 -04:00
misc Update release notes for 25.05.12 release 2026-07-09 11:53:31 +12:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
opac Bug 43019: Fix branch comparison 2026-08-04 13:45:36 +12:00
patron_lists Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
patroncards Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
plugins Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
pos Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
preservation Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
recalls Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
reports Bug 42735: Fix SQL injection 2026-07-09 11:52:50 +12:00
reserve Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
reviews Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
serials Bug 38009: Add a generate next button in serials receive page 2026-06-24 15:06:37 +12:00
services Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 42071: Add 'show' to options that load a single suggestion 2026-05-23 15:58:41 -04:00
svc Bug 41518: Only show autorenewal text if autorenewal allowed 2026-05-23 15:58:47 -04:00
t Bug 30233: (follow-up) fix some errors reported by QA tools 2026-07-30 15:53:54 +12:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:57:07 -06:00
tools Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-08-04 14:01:22 +12:00
virtualshelves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
xt Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
.codespell-ignore Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40838: Add generated bookings CSS assets to gitignore 2025-09-25 16:22:51 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-10-29 10:02:28 +01:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 25.05.12 release 2026-07-09 11:53:25 +12:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
MANIFEST.SKIP
…
Makefile.PL Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-05 17:42:04 +00:00
about.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
app.psgi Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
cpanfile Bug 40164: Add Template::Plugin::JSON dependency 2025-07-10 22:47:33 +02:00
cypress.config.ts Bug 40346: Use KOHA_INTRANET_URL for the baseUrl 2025-08-22 09:47:41 +02:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
gulpfile.js Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
help.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
package.json Bug 36674: (follow-up) Stop emitting Cypress API client source maps 2026-02-17 16:34:56 +00:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
rspack.config.js Bug 36674: (follow-up) Stop emitting Cypress API client source maps 2026-02-17 16:34:56 +00:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
yarn.lock Bug 40170: Update yarn.lock 2025-07-10 22:47:42 +02:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo