[Bug 42916] New: Cannot modify hold expiration date with only place_holds permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Bug ID: 42916 Summary: Cannot modify hold expiration date with only place_holds permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, lisette@bywatersolutions.com, tomascohen@gmail.com Target Milestone: --- To recreate: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to edit the expiration date, the date immediately disappears and it not updated I can modify other things like pickup library, suspend, delete, and cancel. This seems to be a change in behavior before 25.11.05 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |23269 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23269 [Bug 23269] Long hold queues are slowing the service -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Donna <bwsdonna@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bwsdonna@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #1 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 200992 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200992&action=edit Bug 42916: Only require place_holds permission to modify a hold To test: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to edit the expiration date, the date immediately disappears and it not updated 4/ APPLY PATCH, yarn build, restart_all 5/ Try editing the expiration date, you should be able to 6/ Also attempt to change an item level hold into a "Next available" one, you should get no error and it should update correctly -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |lucas@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200992|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #2 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Created attachment 200994 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=200994&action=edit Bug 42916: Only require place_holds permission to modify a hold To test: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to edit the expiration date, the date immediately disappears and it not updated 4/ APPLY PATCH, yarn build, restart_all 5/ Try editing the expiration date, you should be able to 6/ Also attempt to change an item level hold into a "Next available" one, you should get no error and it should update correctly Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |cj.lynce@westlakelibrary.or | |g -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA CC| |emily.lamancusa@montgomeryc | |ountymd.gov Keywords| |regression --- Comment #3 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- I'm afraid this one isn't going to be that simple, unfortunately. That API endpoint also allows modifying the hold priority, which has a separate permission. I'm not seeing another endpoint that allows modifying the expiration date but not the priority, so I think we're going to have to add a new one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #4 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- (In reply to Emily Lamancusa (emlam) from comment #3)
I'm afraid this one isn't going to be that simple, unfortunately. That API endpoint also allows modifying the hold priority, which has a separate permission. I'm not seeing another endpoint that allows modifying the expiration date but not the priority, so I think we're going to have to add a new one.
This fix may be to broad, I agree. However, I really don't want to have to implement a whole new endpoint to fix a regression. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Rebecca Coert <rcoert@arlingtonva.us> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rcoert@arlingtonva.us -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #5 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- (In reply to Lucas Gass (lukeg) from comment #4)
This fix may be to broad, I agree. However, I really don't want to have to implement a whole new endpoint to fix a regression.
I'm not excited about it either, and I'm definitely open to it if there's another solution! We can't fix one regression by introducing another, though. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Chip Halvorsen <Chip.Halvorsen@WestlakeLibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Chip.Halvorsen@WestlakeLibr | |ary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 ayoung <ayoung@oslri.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ayoung@oslri.net --- Comment #6 from ayoung <ayoung@oslri.net> --- +1 Our member staff have noted this regression, and it is causing some issues in workflow. Just commenting to say I believe this deserves attention. Thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Alex Carver [Acerock7] <alex@rcls.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alex@rcls.org --- Comment #7 from Alex Carver [Acerock7] <alex@rcls.org> --- +1 This was reported to me as well as an issue for frontline staff. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 susan.murphy@kcpls.org changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |susan.murphy@kcpls.org --- Comment #8 from susan.murphy@kcpls.org --- Yes, this was reported to us as well and needs some attention as it does change our workflow. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #9 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Hi, we could reuse the endpoint by adding permission checks in the controller itself. This being an actual bug, and given the fact an extra endpoint with the right permissions doesn't hurt at all, I'd go for it. Best regards. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #10 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203129 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203129&action=edit Bug 42916: Add PUT /holds/{hold_id}/expiration_date To test: 1. APPLY PATCH, restart_all, yarn build 2. Have a superlibrarian, staff user with place_holds permission, and staff user without place_holds permission 3. Have at least 1 hold, note the expiration date and the hold ID. 4. Use your favorite API tool to make a request o update the hold expiration date. 5. Make the request as superlibrarian, staff user with place_holds permission, and staff user without place_holds permission. It should work for the superlibrarian and the staff user with place_holds permission. The expiration date should be updated. 6. The staff user without place_holds permission should get something like: Authorization failure. Missing required permission(s).","required_permissions":{"reserveforothers":"modify_holds_priority -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #200994|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203209 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203209&action=edit Bug 42916: Implement new PUT route when changing expiration date To test: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to edit the expiration date, the date immediately disappears and it not updated 4/ APPLY PATCH, yarn build, restart_all 5/ Try editing the expiration date, you should be able to 6/ Also attempt to change an item level hold into a "Next available" one, you should get no error and it should update correctly -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916 --- Comment #12 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 203210 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203210&action=edit Bug 42916: Add tests To test: -prove t/db_dependent/api/v1/holds.t -test should pass -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org