https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 Bug ID: 43949 Summary: Holds table: show the patron's library for patrons the user cannot see Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, lisette@bywatersolutions.com, tomascohen@gmail.com Target Milestone: --- On a record's holds list (reserve/request.pl, holds.js load_patron_holds_table) the patron column is built from the /api/v1/holds response with embed=patron. When the logged in staff user is not allowed to see the patron (IndependentBranches, or library groups with "Hide patron info" and no view_borrower_infos_from_any_libraries permission), Koha::Object->to_api redacts the embedded patron: every field is set to undef except those in Koha::Patron->unredact_list, which is only branchcode (exposed as library_id). The redacted patron is therefore a non-null object, so the fallback added in bug 42915 (row.patron == null, showing "A patron from library X") never runs. Instead $patron_to_html (patron-format.js) gets a patron with no name, and because patron.library is not embedded it can only ever print the generic "A patron from another library", even though patron-format.js already supports "A patron from <library name>" when patron.library is present. Proposed fix: - Allow patron.library in the x-koha-embed enum of GET /holds (api/v1/swagger/paths/holds.yaml) - Request the patron.library embed from the holds table in holds.js - $patron_to_html then shows "A patron from <patron's home library>" for patrons the user cannot see The library name is not sensitive: library_id is already exposed for redacted patrons, and the list of libraries is public. The existing row.patron == null fallback in holds.js shows the pickup library, which is not the patron's library, so it is left as a last resort only. Test plan: 1. Set up two libraries, A and B, and a staff user at library A without the view_borrower_infos_from_any_libraries permission (or enable IndependentBranches) 2. Place a hold for a patron whose home library is B on a record 3. As the staff user at A, open the record's holds page (reserve/request.pl) 4. Before the patch: the patron cell reads "A patron from another library" 5. After the patch: it reads "A patron from <name of library B>" 6. As a superlibrarian, confirm patrons are shown by name as before 7. prove t/db_dependent/api/v1/holds.t -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.