[Koha-bugs] [Bug 34024] REST API should not allow changing the pickup location on found holds

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34024

--- Comment #2 from Emily Lamancusa <emily.lamancusa at montgomerycountymd.gov> ---
I think those restrictions are coded in at the UI level, so the API provides an
unintentional loophole.

To reproduce on KTD:
1. Place a hold for pickup at CPL
2. Check in an item at CPL to fill the hold and set it to Waiting
3. Note that the hold now appears in the Holds Awaiting Pickup table for
Centerville
4. Send an API request to /api/vi/holds/:hold_id/pickup_location to change
   the pickup location to MPL
5. Note that the request succeeds and the hold is moved to the Holds Awaiting
   Pickup table for Midway.

For In Transit holds, the API should respect OPACAllowUserToChangeBranch, when
applicable.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.