Bug 13917

Summary: OPAC: Placing holds still possible by URL even if turned off by system preference
Product: Koha Reporter: Marc Véron <veron>
Component: Hold requestsAssignee: Marc Véron <veron>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: chris, gmcharlt, jonathan.druart, katrin.fischer, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: OPAC: Putting holds still possible by URL even if turned off by system preference
Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference
[PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference

Description Marc Véron 2015-03-26 13:46:27 UTC
To reproduce:

1)
In staff client, set System preference 'RequestOnOpac' to 'Allow patrons to place holds on items from the OPAC.'
2)
Log in to OPAC with a patron' credentials, search a record, place hold without confirming, copy URL, something like 
[YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1
3)
In staff client, set  System preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.'
4)
Log out. Log in again in OPAC.
5)
Paste URL in browser's address bar

Result: Page displays, you can put a hold on the requested item.

Expected: 
404 page, similar to solution for Bug 12703
Comment 1 Marc Véron 2015-03-26 14:15:24 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2015-04-12 18:18:25 UTC
Re-tested, still applies.
Comment 3 Jonathan Druart 2015-04-13 09:50:57 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-04-13 09:51:28 UTC
Hum, I would raise the severity to major for this one.
Comment 5 Katrin Fischer 2015-04-15 20:25:19 UTC
Created attachment 37917 [details] [review]
[PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference

To test:

1)
Prepare an URL that put's a hold in OPAC (see comment #1), e.g.
[YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1

2)
Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.'

3)
Go diectly to this URL.
Result: The page displays to confirm hold (wrong)

4)
Apply patch

5)
Repeat step 3
Result: Redirect to 404 page (OK)

6)
Set system preference to "Allow"

7)
Repeat step 3
Result: The page displays to confirm hold (OK), like it would be from link in OPAC.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2015-04-15 20:26:22 UTC
I think if we look really close... we'd find more features that need this kind of fix - thx for the patch!
Comment 7 Tomás Cohen Arazi 2015-04-20 13:32:02 UTC
Patch pushed to master.

Nice catch Marc!
Comment 8 Chris Cormack 2015-04-22 05:44:31 UTC
Pushed to 3.18.x will be in 3.18.6