Context: EPerson A and EPerson B are in the Edit Workflow group of a collection
and use XMLUI for workflow.
It is possible for EPerson B to edit a workflowitem that has been claimed by EPerson A
if the task list screen in XMLUI was rendered to EPerson B before the task was claimed.
Both EPersons can edit the same item metadata simultaneously and the resulting metadata
after both save can, but not always, be a combination of those edits.
If EPerson B clicks on the link to an individual workflow item in the displayed list, s/he
is advanced to the screen that should be only for a successful claimer and can then
select "Edit metadata". So there seem to be several places where checks for workflowitem
ownership could be made but aren't.
If on the other hand EPerson B checks an item on such a stale displayed list, then
the returned list does not show the item in the owned list. However if EPerson A then
returns the same item to the pool, then B is silently advanced as the owner.
It is not the case that the dspace-api allows a second eperson to claim the item
rather it looks like XMLUI ignores the owner and allows another to edit or even see the owner screen
so the save metadata action is not checking the owner vs. the eperson or ??
I tested this on both 1.6.2 and 1.7.1 with the same results
xmlui-api/.../java/aspect/submission FlowUtils and workflow/*