[Koha-bugs] [Bug 12873] Reserve can be cancelled by any logged in user

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873

--- Comment #1 from Rafal Kopaczka <rkopaczka at afm.edu.pl> ---
Created attachment 31377
  -->
http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=31377&action=edit
[PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is
possible to cancel reservations through simply running opac-modreserve.pl with
existing reserve_id number. This may provide remove even all reservations from
system. The only limitat

Test plan:
1. Create reserves by 2 different users, and get their ID's
2. Before patch, hold may by cancelled by anyone who run site:
http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX
3. After patch hold may by cancelled only by user whose reserve is.

-- 
You are receiving this mail because:
You are watching all bug changes.