[Bug 43949] New: Holds table: show the patron's library for patrons the user cannot see
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 Bug ID: 43949 Summary: Holds table: show the patron's library for patrons the user cannot see Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, lisette@bywatersolutions.com, tomascohen@gmail.com Target Milestone: --- On a record's holds list (reserve/request.pl, holds.js load_patron_holds_table) the patron column is built from the /api/v1/holds response with embed=patron. When the logged in staff user is not allowed to see the patron (IndependentBranches, or library groups with "Hide patron info" and no view_borrower_infos_from_any_libraries permission), Koha::Object->to_api redacts the embedded patron: every field is set to undef except those in Koha::Patron->unredact_list, which is only branchcode (exposed as library_id). The redacted patron is therefore a non-null object, so the fallback added in bug 42915 (row.patron == null, showing "A patron from library X") never runs. Instead $patron_to_html (patron-format.js) gets a patron with no name, and because patron.library is not embedded it can only ever print the generic "A patron from another library", even though patron-format.js already supports "A patron from <library name>" when patron.library is present. Proposed fix: - Allow patron.library in the x-koha-embed enum of GET /holds (api/v1/swagger/paths/holds.yaml) - Request the patron.library embed from the holds table in holds.js - $patron_to_html then shows "A patron from <patron's home library>" for patrons the user cannot see The library name is not sensitive: library_id is already exposed for redacted patrons, and the list of libraries is public. The existing row.patron == null fallback in holds.js shows the pickup library, which is not the patron's library, so it is left as a last resort only. Test plan: 1. Set up two libraries, A and B, and a staff user at library A without the view_borrower_infos_from_any_libraries permission (or enable IndependentBranches) 2. Place a hold for a patron whose home library is B on a record 3. As the staff user at A, open the record's holds page (reserve/request.pl) 4. Before the patch: the patron cell reads "A patron from another library" 5. After the patch: it reads "A patron from <name of library B>" 6. As a superlibrarian, confirm patrons are shown by name as before 7. prove t/db_dependent/api/v1/holds.t -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@openfifth.c |ity.org |o.uk -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 --- Comment #1 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 209883 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209883&action=edit Bug 43949: Add tests Test that the patron.library embed is available on GET /holds and that the library of a patron the user cannot see is exposed while the patron's other details stay redacted. To test: 1. prove t/db_dependent/api/v1/holds.t 2. Tests fail without the following patch Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 --- Comment #2 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 209884 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209884&action=edit Bug 43949: Show the patron's library for patrons the user cannot see in the holds table Koha::Object->to_api redacts the embedded patron for staff who cannot see it, keeping only library_id, so the holds table could only ever print "A patron from another library". patron-format.js already supports "A patron from <library name>" when patron.library is present, so allow the patron.library embed on GET /holds and request it from the holds table. To test: 1. Have a staff user at library A without view_borrower_infos_from_any_libraries (or enable IndependentBranches) 2. Place a hold for a patron whose home library is B on a record 3. As that user, view the record's holds (reserve/request.pl) 4. Without the patch the patron cell reads "A patron from another library"; with it, "A patron from <library B name>" 5. As a superlibrarian patrons are still shown by name 6. prove t/db_dependent/api/v1/holds.t Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #209883|0 |1 is obsolete| | Attachment #209884|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 210043 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210043&action=edit Bug 43949: Add tests Test that the patron.library embed is available on GET /holds and that the library of a patron the user cannot see is exposed while the patron's other details stay redacted. To test: 1. prove t/db_dependent/api/v1/holds.t 2. Tests fail without the following patch Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 --- Comment #4 from David Nind <david@davidnind.com> --- Created attachment 210044 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210044&action=edit Bug 43949: Show the patron's library for patrons the user cannot see in the holds table Koha::Object->to_api redacts the embedded patron for staff who cannot see it, keeping only library_id, so the holds table could only ever print "A patron from another library". patron-format.js already supports "A patron from <library name>" when patron.library is present, so allow the patron.library embed on GET /holds and request it from the holds table. To test: 1. Have a staff user at library A without view_borrower_infos_from_any_libraries (or enable IndependentBranches) 2. Place a hold for a patron whose home library is B on a record 3. As that user, view the record's holds (reserve/request.pl) 4. Without the patch the patron cell reads "A patron from another library"; with it, "A patron from <library B name>" 5. As a superlibrarian patrons are still shown by name 6. prove t/db_dependent/api/v1/holds.t Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #5 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. Step 1 of the test plan - I used Henry Acevedo and: - Changed username to henry and password so that I could log in as Henry - Changed library from Midway to Centerville - Gave these permissions: . Staff access, allows viewing of catalogue in staff interface (catalogue) . Place and modify holds for patrons (reserveforothers) . All: Add, modify and view patron information (borrowers) . Then removed: View patron ... (view_borrower_infos_from_any_libraries) 2. Step 2: using the koha user I placed a hold for Mary Burton (Midway) on Programming Perl (262). 3. Logged in as Henry and viewed the holds section for the record (Programming Perl). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949 --- Comment #6 from David Nind <david@davidnind.com> --- Additional testing notes (using KTD): 1. After apply the patch: - Rebuild everything: yarn build - Restart everything: restart_all -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org