Reviewers, editors and final editors; can submit even in collections with a restricted group of submitters

[DanGastardelli]

Describe the bug

When having collections with a submitter group and some workflow role group (whether reviewer, editor or final editor), the member of the role group can submit to the collection even without being part of the submitter group. The test was done in versions 7.5, 8.1 and 9.0.

To Reproduce

Steps to reproduce the behavior:

1. Log in to DSpace;

2. Create a submitter group and a workflow role;

3. Include different users in each group;

4. Log in as one of the users who is only in the chosen workflow group;

5. Attempt to submit to this collection.

Expected behavior

If the user is only in a workflow role for the collection and is not part of the submitter group, he/she will not be able to submit.

[tdonohue]

Thank @DanGastardelli for reporting this. I'm able to verify this on the demo site (https://demo.dspace.org) using the following steps:

1. Login as the Admin account (dspacedemo+admin@gmail.com)
2. Go to "Access Control" -> "People" and check the permissions of the demo submitter account (dspacedemo+submit@gmail.com)
   a. Write down which "SUBMIT" groups that person is in, especially the Collection name
3. Now go to a Collection which is NOT listed in the prior step (2a). Edit it, and create the "Reviewer" role
4. Add the demo submitter account (dspacedemo+submit@gmail.com) to that role.
5. Logout and login now as the Demo Submitter account
6. Go to "New -> Item".
7. You'll see an option to submit to the Collection where you have the "Reviewer" role. Select it and start a submission
8. Finish the Submission and click save. It will all succeed, even though you only have "Reviewer" privileges.

Obviously, this seems incorrect, as you don't have SUBMIT privileges. Even though you have special privileges granted on the Collection, it doesn't seem like you should be allowed to submit to it.

I'll bring this to the next developers meeting to discuss. https://wiki.lyrasis.org/display/DSPACE/2025-01-23+DSpace+Developers+Meeting