https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #1 from Sukhmandeep <sukhmandeep.benipal@inLibro.com> --- Created attachment 173400 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173400&action=edit Bug 38040: Disabled tables element for staff The test plan is the same has mentioned before: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes' 2. Set canreservefromotherbranches to "Don't allow (with independent branches)" 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=35434 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 176050 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176050&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes holds so that release notes| |staff patrons can only edit | |or delete holds for their | |library when: | |- | |IndependentBranches = "Yes" | |- | |IndependentBranchesPatronMo | |difications = "Yes" | |- | |IndependentBranchesTransfer | |s = "Yes" | |- | |canreservefromotherbranches | |= "Don't allow (with | |independent branches)". | | | |Previously, any staff | |member from any library | |could edit or delete the | |holds for patrons from | |other libraries. Only | |superlibrarians should be | |able to edit or delete all | |holds. Assignee|koha-bugs@lists.koha-commun |sukhmandeep.benipal@inLibro |ity.org |.com --- Comment #3 from David Nind <david@davidnind.com> --- I updated the assignee, edited the commit message, and added a release note. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177197|0 |1 is obsolete| | --- Comment #6 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 177198 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177198&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177198|0 |1 is obsolete| | --- Comment #7 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 177292 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177292&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled Rebased Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |william.lavoie@inLibro.com Attachment #176050|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #9 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 177472 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=177472&action=edit Bug 38040: Light reformating When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177472|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA CC| |nick@bywatersolutions.com --- Comment #13 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- This patch only deals with the template, I can easily edit the html, remove the disabled class, and still cancel the hold. A check needs to be added into the perl scripts or the modules. It also affects all non-superlibrarians, regardless of independentbranches being enabled/disabled, we need to check that preference first. I think maybe we need an additional permission for reserves here - which says whether you can affect all holds or not. Taking away the ability to modify/cancel holds would be a big change in behavior that I am not sure all libraries using independent branches would agree to. The trend has been to move parts of Independent Branches to more granular system preferences ( IndependentBranchesPatronModifications , IndependentBranchesTransfers ) so maybe we need 'IndependentBranchesReserves'? This current code could be adapted to work in IntranerUserJS if it is sufficient for your library, happy to help with that or any of the changes above if I can -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177492|0 |1 is obsolete| | --- Comment #15 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 178015 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178015&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #17 from William Lavoie <william.lavoie@inLibro.com> --- Hi Owen, Thank you for the feedback, I have added checks in the perl scripts for deletion as well as the other operations (changing priority, adding an expiration date, batch deletions, etc). After a discussion with Caroline, we agreed with your solution to add a system preference 'IndependentBranchesHolds' (the Koha terminology favors 'Hold' over 'Reserve'). I have added an atomic update. Additionally, in order to allow users to change priority within their own library, I changed the way holds are displayed so that for non-superlibrarians, when 'IndependentBranchesHolds' is set to 'Yes', the holds are displayed by library, similarly to having 'HoldsSplitQueue' set to 'branch'. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178015|0 |1 is obsolete| | --- Comment #19 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 179186 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179186&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and validate that step 7 is not possible now. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179187|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39433 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #22 from David Cook <dcook@prosentient.com.au> --- There's a git merge error in the second patch. Can you fix that and squash the patches together? (Then perhaps split out the DB update into a separate patch?) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #24 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #23)

Thanks for your work to-date on this one. I need this fix soon for one of my libraries, as I think it's the last piece of the puzzle of IndependentBranches/LibraryGroups/heaps of my own fixes to get Koha usable for this particular set of libraries...

What I mean is... I can dedicate time to working with inLibro on this. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #26 from David Cook <dcook@prosentient.com.au> --- Inspecting the code more closely and looks like you've got your patches out of order as well. Btw in installer/data/mysql/mandatory/sysprefs.sql the syspref needs to be added in alphabetical order by variable name. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #28 from David Cook <dcook@prosentient.com.au> --- Since this one is quite important for me, I'm going to try to resurrect it... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #30 from David Cook <dcook@prosentient.com.au> --- So... I'm a bit confused here. I've followed the test plan and I've reviewed the code, and it seems to me that the text "A patron from library Centerville" comes from the Library Groups feature and not IndependentBranches. Because I can't get "A patron from library Centerville" to appear in main following the test plan, and when I look at the code that makes sense, because it's a Library Groups feature. As a result, it seems to me that the solution should actually be with Library Groups and not IndependentBranches. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #32 from David Cook <dcook@prosentient.com.au> --- Since the holds in tmpl/intranet-tmpl/prog/en/includes/holds_table.inc are actually hashrefs from reserve/request.pl we can actually do the permission check in the controller, and then we just look for the flag in the template/view so that we can toggle the display accordingly. Something like "$logged_in_user->can_manage_hold($hold->patron)" would be good, because it could apply to both IndependentBranches and Library Groups. Plus we can then use it for validating the actions/ops server-side as well. The only question that remains then is how to gracefully handle errors server-side. Although really I think something like pre-validating before the action/op and throwing a 403 is not a bad idea. Simple and effective. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #34 from David Cook <dcook@prosentient.com.au> --- I've uploaded an alternate patch, which hides the hold management controls at the template level if you can't see the patron data (via either IndependentBranches or Library Groups). This serves my immediate purposes, but let me know what you think at the community level, and we can keep working on the feature (ie validating requests to request.pl, modrequest.pl, etc.) -- Note that even with the controls hidden, if your logged in patron has permission to change priority, they can still change their own holds relative to holds from other branches. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #36 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 180531 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180531&action=edit Bug 38040: Preventing editing other libraries' holds with IndependentBranches enabled -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178016|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180531|0 |1 is obsolete| | --- Comment #38 from William Lavoie <william.lavoie@inLibro.com> --- Created attachment 180581 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180581&action=edit Bug 38040: Preventing editing other libraries' holds with IndependentBranches enabled I added the verification to modrequest.pl as well. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 William Lavoie <william.lavoie@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180532|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #41 from William Lavoie <william.lavoie@inLibro.com> --- Test plan: 1. Set IndependentBranches, IndependentBranchesPatronModifications, IndependentBranchesTransfers and IndependentBranchesHolds to 'Yes'. 2. Set canreservefromotherbranches to "Don't allow (with independent branches)". 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches. 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name -- OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled -- NOT OK 8. Apply the patch and update the database 9. Validate that step 7 is not possible now and that holds from the staff's library can be modified or deleted. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179714|0 |1 is obsolete| | --- Comment #42 from Magnus Enger <magnus@libriotech.no> --- Created attachment 180898 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180898&action=edit Bug 38040: [alternate] Restrict hold management if cannot see patron data This patch leverages the Koha::Patron->can_see_patron_infos() function to determine whether or not the UI will display hold management functions. If the logged in user cannot see the patron info, it seems to follow that they should not be able to manage the hold either. NOTE: This should work for both IndependentBranches and Library Group functionality. This is only the front-end modification. To be coded: a back-end modification that throws a 403 for stateful actions to holds the logged in user is not allowed to manage. Signed-off-by: Magnus Enger <magnus@libriotech.no> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180582|0 |1 is obsolete| | --- Comment #44 from Magnus Enger <magnus@libriotech.no> --- Created attachment 180900 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180900&action=edit Bug 38040: DB Update - Adding IndependentBranchesHolds syspref Signed-off-by: Magnus Enger <magnus@libriotech.no> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|william.lavoie@inLibro.com |hammat.wele@inlibro.com CC|sukhmandeep.benipal@inLibro | |.com, | |william.lavoie@inLibro.com | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lin-wei.li@inLibro.com Attachment #180900|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180898|0 |1 is obsolete| | --- Comment #47 from Lin Wei <lin-wei.li@inLibro.com> --- Created attachment 182445 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182445&action=edit Bug 38040: [alternate] Restrict hold management if cannot see patron data This patch leverages the Koha::Patron->can_see_patron_infos() function to determine whether or not the UI will display hold management functions. If the logged in user cannot see the patron info, it seems to follow that they should not be able to manage the hold either. NOTE: This should work for both IndependentBranches and Library Group functionality. This is only the front-end modification. To be coded: a back-end modification that throws a 403 for stateful actions to holds the logged in user is not allowed to manage. Signed-off-by: Magnus Enger <magnus@libriotech.no> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180900|0 |1 is obsolete| | --- Comment #49 from Lin Wei <lin-wei.li@inLibro.com> --- Created attachment 182447 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182447&action=edit Bug 38040: DB Update - Adding IndependentBranchesHolds syspref Signed-off-by: Magnus Enger <magnus@libriotech.no> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Status|Signed Off |In Discussion --- Comment #51 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to David Cook from comment #45)

Magnus did you sign off both approaches?

This looks like a good question to be answered before starting QA. Could you please address it, Magnus ? Thanks. Changing status to reflect need for feedback. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 Hammat wele <hammat.wele@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182446|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 --- Comment #52 from Hammat wele <hammat.wele@inlibro.com> --- Created attachment 204959 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204959&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes' 2. Set canreservefromotherbranches to "Don't allow (with independent branches)" 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name ==> OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled ==> NOT OK 8. Apply the patch 9. Update Database ./installer/data/mysql/updatedatabase.pl 10. Run yarn api:bundle 11. Set IndependentBranchesHolds preference to YES 12. Repeat step 6 and 7 it's not possible to modify or delete holds from other branches 13. prove t/db_dependent/api/v1/holds.t should be success -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #54 from David Nind <david@davidnind.com> --- Thanks for the easy to follow test plan! I've Failed QA as the tests fail if the IndependentBranches system preferences are enabled as set out in the test plan, if they are not enabled the tests pass: ... Test Summary Report ------------------- t/db_dependent/api/v1/holds.t (Wstat: 2816 (exited 11) Tests: 11 Failed: 5) Failed tests: 3-5, 10-11 Non-zero exit status: 11 Parse errors: Bad plan. You planned 21 tests but ran 11. Files=1, Tests=11, 9 wallclock secs ( 0.03 usr 0.01 sys + 7.86 cusr 1.20 csys = 9.10 CPU) Result: FAIL Testing notes: 1. After the patches, and with IndependentBranchesHolds system preference set to "Yes": - For holds from patrons from other libraries, all you see in the table row in the "Patron" column is "A patron from another library" - all the other table columns for that row are blank -- You are receiving this mail because: You are watching all bug changes.