Koha-clms/tools
Laura_Escamilla 1ffbc32ad2
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
2026-08-11 12:39:48 +00:00
..
csv-profiles
…
access_files.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
additional-contents.pl Bug 41614: available options template params also needed for op=list 2026-03-24 07:48:24 +01:00
ajax-inventory.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
automatic_item_modification_by_age.pl Bug 42746: (QA follow-up) Sanitize agefield and substitution field at the sink too 2026-08-11 12:39:38 +00:00
batchMod.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
batch_delete_records.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
batch_extend_due_dates.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
batch_modify_holds.pl Bug 41882: Enforce pickup location rules 2026-04-29 09:09:20 -06:00
batch_record_modification.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
batch_records_ajax.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cleanborrowers.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
copy-holidays.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
csv-profiles.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
exceptionHolidays.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
export.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
holidays.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
import_borrowers.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
inventory.pl Bug 38946: Add enumchron to inventory table 2026-02-27 11:38:33 -07:00
letter.pl Bug 40659: (follow-up) include substitutions in the possible options for template 2026-04-23 16:04:12 -06:00
manage-marc-import.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
marc_modification_templates.pl Bug 16994: Import and export MARC modification templates 2026-04-17 09:18:16 -06:00
modborrowers.pl Bug 40843: Sort patron attributes by description 2025-11-19 12:28:16 -07:00
newHolidays.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
overduerules.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
page.pl Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-08-11 12:39:48 +00:00
picture-upload.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
problem-reports.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
quotes-upload.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
quotes.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
restore-records.pl Bug 17387: (follow-up) move records_restore under editcatalogue permission 2026-04-15 14:10:27 -06:00
scheduler.pl Bug 16631: Institute library limits 2026-07-28 14:32:25 +00:00
showdiffmarc.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
stage-marc-import.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
stockrotation.pl Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
tools-home.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
upload-cover-image.pl Bug 8088: (follow-up) Tidy 2026-04-15 14:10:15 -06:00
upload-file.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
upload.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
viewlog.pl Bug 41358: Apply consistent JSON logging to holds (Bug 40866) 2026-07-16 10:54:22 +00:00