https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16815 Bug ID: 16815 Summary: API routes to list, create, update, delete holds need permissions Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Hold requests Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com The REST api for holds CRUD should require hold permissions! I think it needs reserveforothers and it's subpermissions implemented. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.