https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 75446 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75446&action=edit Bug 20793: Don't show a holds link in staff for users without permission On the results list in staff the 'Holds (x)' link always shows independent of the permissions of the staff user. This patch tightens the permission checks on the result page to explicitly check for the place_holds permission. To test: - Create a staff user with place_holds permission - Check the result list, you should see 2 links to the holds page: - 'Place holds' on top of the results list - 'Holds (x)' at the bottom of each entry in the results list - Verify both links work - Create a staff user without place_holds_permission - Without the patch you'll see the second link, but it will lead to a permission error - With the patch you'll still see the 'Holds (x)', but it will no longer be a link. - Go to the detail page of a record with an existing hold. - Repeat test with both staff users. - One time the Hold information in the bibliographic information should show as a link, the other time as a simple text. Displaying the information about existing holds still make sense as this is the current beheviour. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #75446|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 75474 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75474&action=edit Bug 20793: Don't show a holds link in staff for users without permission On the results list in staff the 'Holds (x)' link always shows independent of the permissions of the staff user. This patch tightens the permission checks on the result page to explicitly check for the place_holds permission. To test: - Create a staff user with place_holds permission - Check the result list, you should see 2 links to the holds page: - 'Place holds' on top of the results list - 'Holds (x)' at the bottom of each entry in the results list - Verify both links work - Create a staff user without place_holds_permission - Without the patch you'll see the second link, but it will lead to a permission error - With the patch you'll still see the 'Holds (x)', but it will no longer be a link. - Go to the detail page of a record with an existing hold. - Repeat test with both staff users. - One time the Hold information in the bibliographic information should show as a link, the other time as a simple text. Displaying the information about existing holds still make sense as this is the current beheviour. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Thx a lot for the follow-up, Owen. Looks much better! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #75474|0 |1 is obsolete| | Attachment #75617|0 |1 is obsolete| | --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 75690 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75690&action=edit Bug 20793: Don't show a holds link in staff for users without permission On the results list in staff the 'Holds (x)' link always shows independent of the permissions of the staff user. This patch tightens the permission checks on the result page to explicitly check for the place_holds permission. To test: - Create a staff user with place_holds permission - Check the result list, you should see 2 links to the holds page: - 'Place holds' on top of the results list - 'Holds (x)' at the bottom of each entry in the results list - Verify both links work - Create a staff user without place_holds_permission - Without the patch you'll see the second link, but it will lead to a permission error - With the patch you'll still see the 'Holds (x)', but it will no longer be a link. - Go to the detail page of a record with an existing hold. - Repeat test with both staff users. - One time the Hold information in the bibliographic information should show as a link, the other time as a simple text. Displaying the information about existing holds still make sense as this is the current beheviour. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |nick@bywatersolutions.com --- Comment #8 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20793 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #10 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.11.x for 17.11.08 -- You are receiving this mail because: You are watching all bug changes.