Go to file
Laura_Escamilla b7045022df
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bf5c5952105b5f881a1519b4f236c3d6d1b3d5ac)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-08-10 08:18:05 -06:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
C4 Bug 30233: (follow-up) Fix POD formatting codes in _apply_substitution 2026-08-10 08:18:03 -06:00
Koha Bug 30233: (follow-up) fix some errors reported by QA tools 2026-08-10 08:18:01 -06:00
acqui Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
admin Bug 29587: Test mail option in SMTP servers 2026-06-15 18:12:16 -06:00
api Bug 41889: Update API to allow for null patron_id to be returned when listing checkouts 2026-07-13 16:10:36 -06:00
authorities Bug 21453: Copy data to the correct subfields when linking authorities with authorities 2026-04-23 09:24:58 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
catalogue Bug 42637: Check if biblio exists before checking if it is fast add 2026-05-18 16:05:41 -06:00
cataloguing Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
circ Bug 41940: Remove uninitialized value warnings in circulation.pl 2026-05-20 09:04:58 -06:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
docs Bug 42726: Add 26.11 release team 2026-06-08 13:53:09 -06:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
ill Bug 37762: Circulation: Hook to checkouts/checkins 2026-05-08 12:25:43 -06:00
installer Bug 42397: DBRev 26.05.01.001 2026-07-07 16:07:50 -06:00
koha-tmpl Bug 40610: Update OPAC templates to improve ease of translation 2026-07-13 16:10:35 -06:00
labels Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
lib Bug 41521: Silent perlcritic warnings 2026-03-24 09:55:54 +01:00
members Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
misc Bug 42640: Script search_for_data_inconsistencies.pl use binmode UTF-8 2026-07-09 13:06:51 -06:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac Bug 43019: Fix branch comparison 2026-08-10 08:18:04 -06:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 41705: Use PRG pattern for POS receipt printing to avoid popup blockers 2026-06-04 15:09:06 -06:00
preservation Bug 35267: Apply preferences to preview and mailing 2026-04-17 09:18:06 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 42803: Only perform the lookups when !$filter is true 2026-07-09 13:06:41 -06:00
reserve Bug 37762: Circulation: Hook to holds 2026-05-08 12:25:43 -06:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 42078: Allow vendor ID searches on serial subscription vendor search page 2026-07-07 16:07:52 -06:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel
…
suggestion Bug 42757: Use default suggestor or fallback to librarian 2026-06-08 13:53:26 -06:00
svc Bug 42084: (QA follow-up) Simplify 2026-06-08 13:53:12 -06:00
t Bug 30233: (follow-up) Add tests for _apply_substitution and combined modifiers 2026-08-10 08:18:02 -06:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:48:24 -06:00
tools Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-08-10 08:18:05 -06:00
virtualshelves Bug 40916: Fix another occurance 2025-10-06 09:15:22 -06:00
xt Bug 42764: Include filename in codespell test output 2026-06-11 09:53:36 -06:00
.codespell-ignore Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-11 09:53:35 -06:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 26355: Add a Vue island for the self-renewal modal 2026-05-01 09:30:00 -06:00
.htaccess
…
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.nvmrc Bug 42353: Store the node version in .nvmrc 2026-04-15 09:14:53 -06:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Bug 42397: DBRev 26.05.01.001 2026-07-07 16:07:50 -06:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MANIFEST.SKIP
…
Makefile.PL Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
about.pl Bug 42453: Remove warning 2026-07-13 16:10:30 -06:00
app.psgi Bug 38365: Integrate CSP middleware into Plack apps 2026-03-16 11:57:12 +01:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-05-20 09:04:55 -06:00
cypress.config.ts Bug 41362: Allow Cypress tests to use KOHA_USER and KOHA_PASS as override 2026-01-06 07:45:35 -07:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 42356: Silence Sass if-function deprecation warning 2026-04-17 09:18:15 -06:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
package.json Bug 34973: Upgrade Font Awesome in the OPAC to 7.2 2026-06-04 15:09:08 -06:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
tsconfig.json
…
yarn.lock Bug 34973: Update yarn.lock 2026-06-09 15:42:19 -06:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo